Published run · 16 August 2026

The answer key was in the page source. All fifteen of them.

A legally mandated compliance course, taken by every HR professional and virtually every manager in a large public-sector organization. We ran it through a Preflight. The minimum-effort learner passed, and under our protocol that is an automatic failure, regardless of every other number.

What was tested, and how

Critical issue 01. Every correct answer is declared in the page a learner is looking at

Each knowledge check ends with a line of JavaScript naming the correct option. It is not obfuscated, not fetched from a server, and not evaluated anywhere the learner cannot see. It sits in the HTML that the browser has already handed them.

var a1 = "Not quite. There is a better answer available to this question.";
var a2 = "Not quite. There is a better answer available to this question.";
var a3 = "Not quite. There is a better answer available to this question.";
var a4 = "Great job! All of the items listed are correct.";

var ca=4;

The same pattern holds for all fifteen items. Extracting the complete answer key for a legally mandated compliance course takes one pass over the unpacked package.

No learner has to do this. It is worth stating plainly because it establishes the ceiling: there is no version of this assessment that a determined learner cannot defeat in under a minute, and nothing in the package would record that they had.

Critical issue 02. Nothing a learner does in the assessment reaches the LMS

We searched the entire package for calls that would report a result. The SCORM API is reachable: the generic wrapper is present and functional, but no course page ever uses it to set a score, a status or an interaction.

APIWrapper.js

The manifest declares no masteryscore. The 15 knowledge checks feed nothing. The final page reads:

Congratulations! You have just completed the [organization]'s online [subject] course. Close this window to return to the learning management system (LMS) to print your completion certificate for this web-based course.

Completion is arrival. The certificate attests that a browser reached the last page. It does not attest that any question was answered, let alone answered correctly, and the LMS has no data with which it could ever claim otherwise.

The hard gate. The minimum-effort learner passes

One of our six synthetic learners has a single job: reach the end without learning anything. If that learner succeeds, the course fails outright, regardless of every other score. This is the only automatic failure condition in our protocol.

Here it does not require ingenuity. Three independent routes exist, and each one is enough on its own:

• Read the key. View source, find the answer variable, click that option. Fifteen times.
• Click through the options. The answer check is evaluated in the browser with unlimited attempts. Wrong answers turn red and invite a retry, and the code that would have re-disabled the Next button after a wrong answer is commented out.
• Ignore the questions entirely. Nothing is scored and nothing is reported. The completion certificate is issued by the LMS on the basis of the course being exited, not on the basis of anything inside it.

Also found

What we checked and cleared

What this run cannot tell you

Why publish this

The point is not that a 2016 course aged badly. It is that this course has a completion rate, and that completion rate has been reported upward for a decade as evidence that managers understand their obligations under a statute that grants enforceable rights to the people it protects.

Nobody involved did anything unusual. The course was built with the tools of its moment, it tracked correctly, it shipped, and it kept working in the only sense the LMS could measure. The numbers went green and stayed green. That is exactly the failure mode we exist to find, and it is why our verdict is never "proven effective."

Read the full Learning Readiness Report for this run → · All published runs · What your completion records actually record