Little Forest

The problem

Penn has over a hundred and sixty domains in the platform. Nobody can audit that by hand, so Little Forest crawls them and reports what it finds — cookies, trackers, accessibility problems, all of it by page.

But a crawl is only as good as what it is allowed to see. Hosting providers block bots. Consent banners hide the very scripts you are trying to inventory. The scan comes back clean and the site is not.

What I worked on

Crawler access and coverage: allow-listing the scanner with hosting providers, getting site owners into the platform, and training the people who have to read the results — because a report nobody understands is just a PDF with opinions.

Consent-aware scanning was the interesting part. Once a banner is deployed, a rescrape stops finding the cookies, because auto-blocking is doing its job. So we recorded the steps — accept, toggle, then crawl — and let the scanner replicate them. That is how you get a scan that reflects a real visitor instead of a legal fiction.

On the document side I sat in the accessibility working sessions evaluating remediation tooling with the university’s accessibility team and Penn Medicine: what the tools get right, where the human has to review, and how to keep a remediated PDF from becoming someone else’s problem.

The lesson

Governance tools rarely talk to each other: the consent platform and the scanner have no shared model, so the mapping is manual. And document accessibility is not a tooling problem at all — it is a habit problem. We discourage posting PDFs wherever possible; when one is unavoidable, somebody has to own making it readable.