> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qaos.machdel.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Issue Reference

> Overview of every issue type QAOS detects, organized by category and severity.

QAOS detects issues across two broad domains — **security** and **UI/UX** — using a combination of deterministic checks and LLM-powered analysis.

***

## Severity levels

Every detected issue is assigned a severity level:

<CardGroup cols={2}>
  <Card title="Critical" icon="circle-exclamation" color="#dc2626">
    Immediate exploitation risk or user-blocking defect. Address before deployment.
  </Card>

  <Card title="High" icon="triangle-exclamation" color="#f97316">
    Significant security exposure or serious accessibility barrier. High priority.
  </Card>

  <Card title="Medium" icon="circle-minus" color="#eab308">
    Notable risk or usability degradation. Should be addressed in the current sprint.
  </Card>

  <Card title="Low" icon="circle-info" color="#84cc16">
    Minor issue or best-practice deviation. Address when bandwidth allows.
  </Card>
</CardGroup>

***

## Security issues

Security issues are detected by the **Security Agent** and mapped to OWASP and industry-standard vulnerability categories.

| Category                                                          | Issues                                                                        | Max Severity |
| ----------------------------------------------------------------- | ----------------------------------------------------------------------------- | ------------ |
| [Access Control](/issues/security/access-control)                 | Unauthenticated access, privilege escalation, forced browsing, method bypass  | Critical     |
| [Authentication](/issues/security/authentication)                 | Default credentials, password spraying, rate limiting, weak passwords         | Critical     |
| [Session Management](/issues/security/session-management)         | Session ID in URL, weak tokens, missing HttpOnly flag                         | Critical     |
| [Injection](/issues/security/injection)                           | XSS, SQL/NoSQL injection, ORM parameter extraction                            | High         |
| [Cryptography](/issues/security/cryptography)                     | Unencrypted pages, weak hashing, misconfigured headers, CORS, exposed secrets | Critical     |
| [Information Disclosure](/issues/security/information-disclosure) | Exposed files, server version leakage, verbose error pages, console logging   | Critical     |
| [Input Validation](/issues/security/input-validation)             | Unvalidated input fields                                                      | Low          |

***

## UI/UX issues

UI/UX issues are detected by the **UI/UX Agent** and focus on WCAG 2.1 accessibility compliance and general UX best practices.

| Category                                        | Issues                                                                | Max Severity |
| ----------------------------------------------- | --------------------------------------------------------------------- | ------------ |
| [Accessibility](/issues/quality/accessibility)  | Keyboard navigation, screen reader support, color contrast, text size | High         |
| [Forms](/issues/quality/forms)                  | Labels, error messages, required field indicators                     | Critical     |
| [Navigation](/issues/quality/navigation)        | Link clarity, navigation consistency, destructive action confirmation | Critical     |
| [Responsive Design](/issues/quality/responsive) | Touch targets, horizontal overflow, missing page titles               | High         |

***

## How detection works

QAOS uses three detection methods:

<Steps>
  <Step title="Deterministic handlers">
    Fast, code-based checks that analyze the raw DOM, cookies, HTTP response headers, or JavaScript source for specific patterns. Examples: checking the `HttpOnly` flag on session cookies, scanning scripts for `Math.random()` used as a token generator.
  </Step>

  <Step title="LLM evaluation">
    The agent sends page state (DOM, screenshot, accessibility tree) to an LLM with a structured prompt asking it to evaluate the page against specific issue definitions. This catches context-dependent issues that code patterns alone can't detect.
  </Step>

  <Step title="Subtask-based testing">
    For certain issues, the agent proposes and executes interactive sub-tests — such as attempting to log in with known default credentials, submitting forms with XSS payloads, or trying to access protected resources after logging out.
  </Step>
</Steps>