A cold walk through one product’s first run. The landing page read as a stranger reads it, before anything is clicked. Every signup field, with elapsed time and a note of what the product had given before each was asked for. Verification emails: which arrived, how long they took, where they landed. The signup on a phone as well as a desktop browser. Empty states, and whether their suggestions can actually be acted on. Whether the first valuable moment you named in the brief was reached, and when. Returned as the walk in order with timings, findings separated into what stopped progress and what merely irritated. Three business days from the brief arriving.

This is never security testing: nothing is probed, fuzzed, enumerated, injected or attacked, no credentials are tested, no vulnerability scanning or automated tooling is used, and no load is generated.