What was checked
On October 19, 2026 the public website and the code that produces it were reviewed. The pages were read, the live site was requested, and sign-in, contact, and member video access were inspected. This site does not keep a customer database, so there was no customer table to open.
Poor presentation and disclosure
Several public pages included notes for the builder. Some named the kinds of settings a feature expected. The video library told visitors to add titles by editing the catalog. The values of those settings were not on the pages.
A contact status check answered whether the form could send mail. The answer did not include a mail password or anyone’s messages. A closed staff page named the settings that would open it. The code itself was not printed. Those pages were rewritten for visitors in this release, and the status check was removed.
Configuration risks that were corrected here
Staff sign-in did not count attempts. Member sign-in already did. This release counts staff attempts as well.
Member access and staff access used similar stamps on their passes. This release stamps them for different jobs. The review found no sign that a pass had been swapped.
The live site already kept visitors on HTTPS. It did not send the fuller set of ordinary browser protections. This release adds them, and the YouTube player is still allowed to run. Those protections apply when this release is published.
What the evidence supports
Requests for environment files on the public site came back as not found. The contact form does not store messages on this site. The site does not take payment cards. No secret value was found on a public page or in the public files.
The review supports a report of poor presentation, information disclosure, and configuration risks, followed by corrections in this release. It does not support a report of a break-in. No breach is claimed.