MCAT app audit — October 28, 2026

Follow-up status

The subsequent editorial follow-up resolves the 35 warnings listed in this historical audit. Current full-bank validation reports 0 errors and 0 warnings. The original findings below are retained as the audit record, not as unresolved warnings.

Scope and outcome

Reviewed the browser application, subject progression, timers, local persistence, HTML rendering, service worker, question-bank validator, and local development server. The baseline was commit 4fe4b5eefb1a76f8f7762ae59b5383660cef722a. This is a source and regression review, not an independent penetration test or certification of every scientific explanation.

Three local regression suites pass. At the initial audit, content validation reported 0 structural errors and 35 editorial warnings. The initial CI run passed all Windows checks and all Linux application checks, including the real Chrome smoke test. A Chrome temporary-profile cleanup race was then corrected with bounded removal retries; final execution status is recorded in the pull request checks. A local interactive browser attempt was blocked by the computer-use environment and was not counted as a successful test.

Verified findings and fixes

Area	Finding	Fix and practical effect
HTML rendering	The formatting helper passed raw HTML through to HTML sinks. Existing notes were escaped, but stored answer text and future authored content could reach this helper. No remote input endpoint or demonstrated remote exploit was found.	Escape text before adding the app's bold/cloze markup; add a resource policy and referrer policy. HTML-like text stays text.
Local storage	Parse/write failures were silently ignored; malformed preference types could crash initialization.	Show read/save/delete warnings, check top-level data shapes, and normalize preferences. Nested records are not fully schema-validated.
Exam resume	A synchronously expired section could transition to break/results and then continue rendering its old question. Repeated end actions could record evidence twice.	Stop rendering when the timer transitions phase, mark completed exams, and guard already-ended sections.
Final review	The review window was recalculated from days remaining, so it shrank away before the test. Millisecond-based date offsets could drift at daylight-saving boundaries.	Anchor the review window to the original planning horizon and use calendar-day arithmetic.
Recall speed	Time spent choosing a runner-up could inflate measured fluency.	Use the original answer-selection time, excluding reflection time and the recall-first reveal delay.
Memory estimates	Immediate repeats could multiply long-term stability as if retrieval occurred after a delay.	Cap correct within-day stability gains at 10% per repeat. Delayed review remains necessary; this cap is a heuristic.
Mini-test reinforcement	Review omitted the actual passage text/figures and subsequent practice did not specifically lead with missed discretes.	Include source passages/figures in review; prioritize actual missed discretes before filling the session with same-subject practice.
Progress reset	Fluency history was omitted from reset.	Include fluency in the reset keys.
Offline support	Activation deleted unrelated caches; cache-write rejections could go unhandled; the worker intercepted unrelated same-origin requests.	Limit interception to listed assets, preserve unrelated caches, catch cache-write failure, and clear fallback timers.
Development server	A path-prefix check lacked a directory boundary and private dot paths were served.	Resolve the root, require a separator-bounded child path, deny dot paths, and handle unsupported methods/bad requests. This helper is loopback-only; it is not the GitHub Pages production server.

Validation

Application, progression, and service-worker scripts parse.
Existing final-two and real-question-bank progression suites pass.
Audit regressions exercise HTML escaping, storage failures, review-phase persistence, daylight-saving civil dates, fluency timing, conservative same-day repetition, expired first/final exam sections, duplicate guards, mini review, targeted reinforcement, reset behavior, and cache isolation/quota failures.
The content validator loads all data scripts, including authored variants and both exams. It checks structure and common cues; it does not independently establish scientific correctness.
GitHub Actions runs Node checks on Windows and Linux, parses the PowerShell helper, and runs a real headless Chrome smoke test on Linux. Actions are pinned to commit SHAs and checkout credentials are not persisted.

Learning-design assessment

Retrieval practice and practice distributed over time are reasonable foundations; a systematic review of health-professions education found benefits in many included experiments, with heterogeneous methods and outcomes. This supports the general approach, not the app's exact implementation or a guaranteed MCAT gain.

The AAMC describes the MCAT as assessing problem solving, critical thinking, and prerequisite science knowledge. It is not a clinical competency assessment. Same-subject passages, data interpretation, CARS, unfamiliar wording, and fresh full-lengths matter alongside fact recall.

The 20-fact/70% readiness thresholds, two-passage criterion, seven-day mini cooldown, speed targets, memory estimates, and score conversions remain transparent product heuristics, not validated cutoffs. Final-two tracking measures whether the correct answer was shortlisted; it does not establish scientific closeness or deserve extra score credit. Immediate success should not be labeled long-term mastery without delayed evidence. Confidence calibration and optional self-explanations are useful prompts, but a learner's confident explanation can still be wrong.

Remaining limitations

Inline event handlers still require an inline-script allowance in the content security policy. A future event-listener refactor can remove that allowance. No claim of an XSS-proof application is made.
Local storage is device/browser-specific, can be lost, and is not an encrypted backup. Visible failure warnings do not recover lost data. Nested corrupted records may need additional validation.
Full scientific and editorial peer review remains separate from this code audit. Familiarity with reused passages can inflate results even though full-length items are held out from subject progression.
The memory model and score estimates are not calibrated against a prospective MCAT cohort, and no learning tool can guarantee maximum potential or a test score.

Historical editorial warnings — resolved in follow-up

These original warnings are retained here for traceability and have since been resolved as documented in the follow-up. Some are substring matches (for example, “oxidation” inside “beta oxidation”), proper names, or natural differences in technical term length. Others can indicate useful edits. Duplicate stems across subjects can be intentional. Stem edits also change question IDs in the current app, so content revisions should consider progress migration and variant links.

QB_BIOCHEMISTRY[10]: key appears in stem — Which polar amino acid has a hydroxymethyl side chain, is the most com
QB_BIOCHEMISTRY[168]: key appears in stem — _____ arise from mutations of proto-oncogenes, promote cell cycling, a
QB_BIOCHEMISTRY[175]: key appears in stem — _____ is the general term for the DNA–protein material of the eukaryot
QB_BIOCHEMISTRY[207]: key is 2.5× longer than distractors — In prokaryotic translation initiation, the 30S ribosomal subunit binds
QB_BIOCHEMISTRY[335]: key appears in stem — The first step of beta oxidation is _____
QB_BIOCHEMISTRY[337]: key appears in stem — The third step of beta oxidation is _____
QB_BIOCHEMISTRY[352]: key is 1.9× longer than distractors — _____ is the enzyme that catalyzes the committed, rate-limiting step o
QB_BIOCHEMISTRY[373]: key is 2.1× longer than distractors — The rate-limiting enzyme of the pentose phosphate pathway is _____
QB_BIOCHEMISTRY[376]: key appears in stem — Dietary galactose comes mainly from digestion of _____
QB_BIOCHEMISTRY[470]: key appears in stem — Epinephrine binds a G protein-coupled receptor on liver cells, activat
QB_BIOLOGY[5]: key is the only capitalized choice — The _____ modifies, sorts and packages proteins it receives from the E
QB_BIOLOGY[190]: key is the only capitalized choice — _____ stimulates milk production by the mammary glands
QB_BIOLOGY[255]: key is the only capitalized choice — The _____ carry the impulse from the left and right bundle branches to
QB_BIOLOGY[264]: key is 2.2× longer than distractors — The main function of _____ is to lower blood pressure by promoting ren
QB_BIOLOGY[450]: key is 1.8× longer than distractors — Smooth muscle is called smooth because _____
QB_BIOLOGY[489]: key is 1.8× longer than distractors — The _____ forms a sleeve around each myofibril, and its main function
QB_BIOLOGY[514]: key is 2.2× longer than distractors — _____ is when a phenotype is expressed to different degrees among indi
QB_BIOLOGY[530]: key is 2.0× longer than distractors — _____ is the likelihood that two genes will be separated by crossing o
QB_CHEMISTRY[5]: key is 1.8× longer than distractors — Which principle states that the position and momentum of an electron c
QB_CHEMISTRY[23]: key appears in stem — The azimuthal quantum number l = 3 designates which type of orbital?
QB_CHEMISTRY[49]: key is the only capitalized choice — Van der Waals forces is a general term that includes _____ forces and
QB_CHEMISTRY[74]: key is the only capitalized choice — A reaction is at equilibrium if Q = _____
QB_CHEMISTRY[342]: key is 1.9× longer than distractors — _____ refers to the equilibrium between a carbonyl compound and an iso
QB_CHEMISTRY[368]: duplicate stem of QB_BIOCHEMISTRY[140]
QB_CHEMISTRY[502]: key is 2.2× longer than distractors — After ionizing a sample with a high-energy electron beam, a mass spect
QB_PHYSICS[44]: key appears in stem — Isovolumetric processes have constant _____
QB_PHYSICS[54]: key is 1.9× longer than distractors — Archimedes' principle states that the buoyant force equals the _____
QB_PHYSICS[81]: key is 2.0× longer than distractors — An electric dipole is a _____
QB_BEHAVIORAL_1[67]: key is 1.8× longer than distractors — The _____ carries sound from the pinna to the eardrum
QB_BEHAVIORAL_1[263]: key is 1.9× longer than distractors — _____ are characterized by physical symptoms that cause significant di
QB_BEHAVIORAL_1[309]: key is 1.9× longer than distractors — _____ states that deviance can be learned through our interactions wit
QB_BEHAVIORAL_1[344]: key is 1.8× longer than distractors — _____ is the attraction between people that leads to the development o
QB_BEHAVIORAL_1[375]: key is 1.9× longer than distractors — _____ is the bias toward making dispositional rather than situational
QB_VARIANTS_2[104]: key is 1.9× longer than distractors — A therapist teaches a patient who fears flying a deep-breathing relaxa
exam_1 P/S Q1: key is 1.9× longer than distractors — The finding that Group A made more dispositional attributions than Gro