@nurkamol/seo-audit 1.35.0 → 1.36.0

package/README.md

@@ -205,7 +205,62 @@ brew install --cask seo-audit
 ./mac/build.sh --run
 ```
 
-<p align="center"><img src="docs/shots/app.png" alt="The macOS app showing a report: 25 pages, 171 findings, 55 things to change" width="820"></p>
+<p align="center"><img src="docs/shots/app.png" alt="The macOS app showing a real audit of astro.build: 60 pages, 232 findings, 37 things to change, scored 87 out of 100" width="820"></p>
+
+<p align="center"><em>A real run against astro.build — and the one error at the top is a link to a page that does not exist, which is the bug this tool was written to catch.</em></p>
+
+<p align="center"><img src="docs/shots/compare.png" alt="The compare sheet: docs.astro.build against astro.build, showing the 26 findings that appeared" width="820"></p>
+
+<p align="center"><em>Compare two runs: a site against itself last week, or one property against another. Different hosts are matched by path.</em></p>
+
+#### If you downloaded the zip instead: "SEO Audit is damaged and can't be opened"
+
+It is not damaged. The app is **ad-hoc signed** rather than notarised, because
+notarising needs a paid Apple Developer account this project does not have.
+macOS puts a `com.apple.quarantine` flag on anything a browser downloads, and
+for an app without a notarisation ticket Gatekeeper refuses it — with a message
+that says "damaged" and offers to move it to the Trash, which reads exactly like
+malware and is the single most confusing thing about installing this.
+
+**`brew install --cask seo-audit` does not have this problem.** Homebrew checks
+the download against a checksum written by the build that produced it, then
+clears the flag for you. That is the recommended route, and the rest of this
+section is for people who would rather not use Homebrew.
+
+If you downloaded the zip by hand, verify it first. Every release attaches a
+`SHA256SUMS.txt` covering all four downloads, and lists the same checksums in
+its notes — save it next to the file and:
+
+```bash
+shasum -a 256 --ignore-missing -c SHA256SUMS.txt
+```
+
+`--ignore-missing` because you almost certainly downloaded one of the four, not
+all of them. The same command verifies the `.deb`, the `.AppImage` and the
+`setup.exe`, which matters most on Windows, where the advice for SmartScreen is
+otherwise just "run it anyway".
+
+Then, once it matches, clear the flag:
+
+```bash
+xattr -dr com.apple.quarantine "/Applications/SEO Audit.app"
+```
+
+No `sudo`: the app is yours, in a directory you can write to, and the command
+works as you. If it ever answers `Operation not permitted`, the copy is owned by
+another user — `sudo xattr -dr com.apple.quarantine "/Applications/SEO Audit.app"`
+is the fallback, but reach for it second, not first.
+
+This is exactly what right-click → **Open** does in the Finder, minus the
+dialog. Do it because the checksum matched, not because a README said to — the
+same command on a file you have not checked is how people get hurt.
+
+Or avoid the question entirely and build it yourself, which produces a signature
+your own machine already trusts:
+
+```bash
+./mac/build.sh --run
+```
 
 SwiftUI throughout, Liquid Glass, and the report drawn natively: cause cards
 that expand into the pages they affect, filtering, search, and export as PDF,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurkamol/seo-audit",
-  "version": "1.35.0",
+  "version": "1.36.0",
   "description": "Crawl a site's sitemap and check every page for SEO, metadata and structured-data problems that single-page graders miss. Zero dependencies.",
   "type": "module",
   "bin": {