How we audit this product

DisplayPilot is made by one person, and it is a paid product with no reviews. Rather than asking you to take our word, here is the actual record: how we look for problems, and the ones we found — including two that turned out to be our own mistakes in the checking, not in the product.

The method

• Four angles. Every feature is read four ways: where it connects to the rest of the system, what happens on every failure branch, whether the claims we make about it match the code, and whether the behaviour is semantically right rather than merely plausible.
• Suspect the checker first. When a check fails, the more likely cause is the check. Several of the entries below are exactly that.
• A check must fail on a planted defect. Every automated check is verified by deliberately breaking something and confirming it goes red. A check that cannot fail is decoration.
• Checks report what they measured. The quietest failure mode is a check that matches nothing and then prints “all good”. Each of ours prints how many items it looked at, and a meta-check asserts those counts never drop.

What we found (a sample)

Wrong → what it cost → the fix.

• Our privacy page said we cannot see your email. Our code stored it in plain text, indefinitely. That is the worst kind of error — a public claim the code contradicted. The page and the storage were both fixed, and the claim is now one of the things an automated check compares against the code.
• We advertised US$14 while charging ¥99, which was worth about US$14.82 — we had understated our own price by 5.9%. The claim was corrected to match what is actually collected.
• Our publishing verifier could report success when both hosts were broken. It compared content hashes only, so two identical 404 pages counted as “consistent”. It now checks for a real 200 response as well.
• A licence-page sentence described a payment provider we never used, and anything that did not look like our own code was still being sent to a third-party endpoint. The endpoint was removed entirely: activation now happens only on your Mac.
• A release link pointed at a file that had never been published. Every release page carried a “technical details” link to a 404. The file is published now, and the link form was fixed too.
• The last step of the money path had never been tested in this project. Issuing a licence depends on a signing key in the login keychain; if that key were ever regenerated, every newly issued code would be rejected by every installed app, silently. We now run a two-second check that compares the keychain key against the key embedded in the app.
• Payments could arrive without anyone knowing. Unmatched transfers were written to a log and never announced. They now trigger a notification.
• Translation gaps could crash the app. A translation missing a format specifier (a %d or an %@) crashes or shows a wrong value at runtime; the checks now compare specifiers, not just coverage.

Where we were wrong about the checking itself

• A build that looked unsigned. Our own script reported “no signature”, because one codesign invocation does not print the authority chain. The build was fine; the check was not.
• 424 “missing” files that were not missing. A link checker could not resolve parent-directory paths and reported hundreds of normal links as broken.
• A guard that passed while measuring nothing. One check reported “all good” when the measurement had silently failed — the exact failure mode it was written to catch.

What runs now

Before anything is published, 16 automated checks run, followed by the full test suite and a compile. They cover the app’s claims against its code, the localisation, the prices, the site’s pages and metadata, the privacy and licence texts, the launch copy, and every internal link and asset on the site (including case, which matters because macOS is case-insensitive and the web is not). Any one of them failing stops the release.

The complete list, with the command for each, is in the project repository. If you find a claim on this site that our code does not support, that is a bug worth reporting — tell us and we will fix it publicly.

Check our build claims yourself · Where we are not the right choice