Placeholder content in the shipped state

Until 2026-08-30 the scan looked at exactly one field here: the page title. The visible text went unchecked — although the same kind of leftover sits there and, unlike the title, every visitor sees it.

This is not a security question, but it is the first thing people notice, and it answers for them whether anyone went back over this. In generated apps it always arises the same way: the generator fills every section with sample copy so nothing looks empty while building, and whatever nobody touched ships that way.

We only report what is a placeholder **in full** — a sample street name, “Lorem ipsum”, an unreplaced template variable. Nothing keys on word fragments: those occur in real company names and real copy. Legal pages are excluded; a separate, stricter rule covers them.

Since 2026-09-22 images from services that only serve random pictures or grey boxes count too (picsum.photos, placehold.co, dummyimage.com and similar). Only what the page actually loads as an image counts — a sentence about these services or a link to them does not. Unsplash stays out, those are real photos.