Audit the flows static scanners can't see

Yes. The analyzer observes DOM mutations directly, so React Router, Vue Router, Next.js App Router, Nuxt, SolidJS — all behave the same from its perspective. Lazy-loaded and suspense-bound components are audited the moment they appear.

Yes, and you do not need to configure anything. The analyzer audits the page in your own browser, so if you are signed in to the app in that tab, it walks the logged-in journey as you. Cookie, form and header auth are for the Web Scanner, which runs on our machines rather than yours.

Yes. Save the session to your workspace and share it with an accessibility team — every member can open the timeline and step through each snapshot. A snapshot is a page from your application, including any scripts it contained, so every read path returns it as opaque text rather than as HTML: the browser will not execute it. Uploads use a short-lived, single-purpose upload URL, so the credential that writes one snapshot cannot be reused for anything else. Issues can be hidden per scan before you share, which does not suppress the same finding elsewhere.

Every finding is recorded against the state it was captured in, so a violation that was present from the first state appears there and a violation introduced by an interaction appears at that step. Comparing the two states tells you which is which.

A person drives the journey — there is no recorded script that replays it on every deploy, so this is a review activity rather than a regression gate. The timeline is the states you captured, not a video of the screen. These are the same automated rules a static scan runs, so they reach the same subset of WCAG and a journey with no findings is not a journey that works. Whether the focus order makes sense, and what a screen reader actually announces, are human judgements not checked here — use the keyboard while you record.