2.4 KiB
2.4 KiB
Threat Register — Phoenix Salon + Spa
Date: 2026-08-05 Status: Initialized — pending Layer 2 threat diagnosis
| # | Threat | Category | Severity | Evidence Tier | Status |
|---|---|---|---|---|---|
| — | Audit pending | — | — | — | Pending |
Populated during Layer 2 threat diagnosis per the Audit Playbook.
Layer 1a Website Threat Update — 2026-08-05
Source: phoenixcameronpark.com (Vite SPA — homepage, /team, /services; full HTML source + JS bundle) Method: Full HTML + JS bundle string scan; rendered DOM inspection (home, team, services) Evidence Tier: Tier 1 (direct observation of live site)
Check 1 — Rebranding Residue (LaMae Salon / La Mae)
- Result: CLEAN — no residue found
- "LaMae" / "La Mae": 0 occurrences in HTML source, title tags, meta data, footer, or JS bundle
- All branding consistently reads "Phoenix Salon + Spa"
Check 2 — Ghost Staff (Amanda)
- Result: CLEAN — no ghost staff
- "Amanda" appears 2× in the JS bundle — both are client review author "Amanda R." (testimonial data), NOT staff
- /team roster: Ashley Thornhill (Owner + Esthetician), Lola Rogers (Hair Stylist), Grace Grabowski (Hair Stylist), Jennifer Francis (Lash Artist)
- No Amanda on team, bio, or services pages
Check 3 — Roster Mapping (Grace, Mallory, Ashley)
- Grace Grabowski — PASS: full profile + services (Precision Haircuts, Innovative Color, Seamless Extensions, Balayage & Highlights) + "Book with Grace"
- Ashley Thornhill — PASS: full profile + services (Custom Corrective Facials, Microdermabrasion, Chemical Peels, Brazilian & Bikini Waxing) + "Book with Ashley"
- Mallory Carlos — FAIL: NOT on team page. Only referenced in the "2026 Style Readers' Choice Nominee" blurb (Home + Services). No profile, no services list, no booking path.
Findings
| # | Threat | Category | Severity | Evidence Tier | Status |
|---|---|---|---|---|---|
| T-1 | Mallory Carlos referenced as nominee but has no website profile/booking path — review-to-site conversion gap | Roster Mapping | Medium | Tier 1 | Open |
Register appended via Layer 1a website capture (2026-08-05). R1-R6 are GBP rules — not applicable to website scan; website checks follow the qualitative review-data threats (rebranding residue, ghost staff, roster mapping).