01Defining better
I measure each keyword against a blended position-CTR curve, interpolated geometrically rather than linearly because click-through decays multiplicatively. I adjust the expectation for intent and brand, reduce it where AI overviews and shopping carousels sit above the organic results, and it can be recalibrated against the site's own data. Five sub-scores combine into a 0-100 figure that I shrink toward the middle in proportion to how little data supports it, so a keyword with eleven impressions can never top a list.
02Named evidence
One component renders every counted claim, turning each item it counts into a button that opens a drawer of the actual rows. I build the sentence from the rows, so the number and the things behind it cannot drift apart. Every chart also has a table view, so no value is gated behind a hover.
03Arithmetic guards
A keyword contributes only its single best finding to the headline recoverable-clicks figure, never the sum of them, and I cap the total at a share of what the site could theoretically earn. Without both, a long findings list adds up to more clicks than there are searches. Estimates show their inputs and their assumed success rates, and I have the interface say plainly that those rates are practitioner heuristics rather than measurements.
04Real exports
Audit summary tabs are not tables. They are titled blocks stacked vertically, each with its own header row, blank separators and trailing comment columns belonging to no header. My parser splits a sheet into blocks, classifies each one with a confidence score, then reports tab by tab what it understood and what it discarded, reading a broken formula cell as missing and never as zero. I also encoded the column traps that produce confidently wrong advice: Semrush Traffic is a model and never enters a clicks series, competition is paid density on a 0-1 scale while difficulty is organic on 0-100, "Nofollow: TRUE" and "Follow: TRUE" map to opposite fields, and CTR is always recomputed from clicks over impressions.
05Auth by type
The hosted backend would hold other companies' Google refresh tokens, so I typed the route table rather than leave it conventional: a route is session-protected unless it declares public, and a protected handler is handed a verified session object it cannot manufacture. Forgetting the check fails to compile instead of opening an endpoint. I encrypt refresh tokens at rest with AES-GCM, and sessions are HMAC-signed __Host- cookies with no sessions table, so a request costs no database read.
