# Threat Register — Phoenix Salon + Spa

**Date:** 2026-08-05
**Status:** Initialized — pending Layer 2 threat diagnosis

| # | Threat | Category | Severity | Evidence Tier | Status |
|---|--------|----------|----------|---------------|--------|
| — | *Audit pending* | — | — | — | Pending |

*Populated during Layer 2 threat diagnosis per the Audit Playbook.*

---

## Layer 1a Website Threat Update — 2026-08-05

**Source:** phoenixcameronpark.com (Vite SPA — homepage, /team, /services; full HTML source + JS bundle)
**Method:** Full HTML + JS bundle string scan; rendered DOM inspection (home, team, services)
**Evidence Tier:** Tier 1 (direct observation of live site)

### Check 1 — Rebranding Residue (LaMae Salon / La Mae)
- **Result: CLEAN — no residue found**
- "LaMae" / "La Mae": 0 occurrences in HTML source, title tags, meta data, footer, or JS bundle
- All branding consistently reads "Phoenix Salon + Spa"

### Check 2 — Ghost Staff (Amanda)
- **Result: CLEAN — no ghost staff**
- "Amanda" appears 2× in the JS bundle — both are client review author **"Amanda R."** (testimonial data), NOT staff
- /team roster: Ashley Thornhill (Owner + Esthetician), Lola Rogers (Hair Stylist), Grace Grabowski (Hair Stylist), Jennifer Francis (Lash Artist)
- No Amanda on team, bio, or services pages

### Check 3 — Roster Mapping (Grace, Mallory, Ashley)
- **Grace Grabowski** — PASS: full profile + services (Precision Haircuts, Innovative Color, Seamless Extensions, Balayage & Highlights) + "Book with Grace"
- **Ashley Thornhill** — PASS: full profile + services (Custom Corrective Facials, Microdermabrasion, Chemical Peels, Brazilian & Bikini Waxing) + "Book with Ashley"
- **Mallory Carlos** — **FAIL: NOT on team page.** Only referenced in the "2026 Style Readers' Choice Nominee" blurb (Home + Services). No profile, no services list, no booking path.

### Findings

| # | Threat | Category | Severity | Evidence Tier | Status |
|---|--------|----------|----------|---------------|--------|
| T-1 | Mallory Carlos referenced as nominee but has no website profile/booking path — review-to-site conversion gap | Roster Mapping | Medium | Tier 1 | Open |

*Register appended via Layer 1a website capture (2026-08-05). R1-R6 are GBP rules — not applicable to website scan; website checks follow the qualitative review-data threats (rebranding residue, ghost staff, roster mapping).*