A multi-model, cross-referenced submission covering all four assessment questions — plus a working product prototype built from reverse-engineering Primer's architecture.
Rather than answering each question in isolation, I treated this assessment as a single research project. The Zeus Capital podcast was transcribed and used to inform the Q1 thesis. Primer's four reports were cross-referenced against verified data from FMP API, Investegate, and analyst coverage. A competing report was generated using open-source models to test defensibility. The product was reverse-engineered from its frontend bundles (47 tools, 12 models, Visible Alpha integration). And a working product prototype was built embodying the multi-lens thesis from Q1.
Every factual claim is sourced. Every thesis was debated across 4 AI models before inclusion. The process itself demonstrates the method the memo advocates: no single AI output was trusted at face value.
Why multiple models matter: Primer currently offers GPT-5.x and Claude, but users select one at a time. This misses the core value of model diversity. GPT and Claude are trained on different data corpora, with different cutoff dates, different fine-tuning priorities, and different failure modes. DeepSeek is trained on substantially different data (Chinese + English web, different academic paper coverage). When two models agree, confidence is high. When they diverge, that divergence itself is the most valuable signal — it reveals where the training data is thin, the reasoning is ambiguous, or the question is genuinely hard. Running models in parallel and comparing outputs is fundamentally different from letting users choose one.
Central thesis: the traditional analyst is defunct. The new analyst is an "AI Output Analyst" trained to spot inconsistencies across models and synthesise correct output from multiple flawed AI inputs.
All 4 reports cross-referenced against FMP API actuals. Report D is best. All miss gross margin compression, negative tangible equity, and FCF. Open-source DeepSeek outperformed all 4 for $0.003.
90-second Primer pitch to a skeptical Head of Research. Then: why not ChatGPT, Claude, or AlphaSense? Talking points prepared from podcast + product analysis.
7 tools documented: Claude Code, multi-model debate, Groq Whisper, FMP API, DeepSeek, Playwright, web search. Honest assessment of where AI helped and where it didn't.
6 product/architecture discussion points (not a build plan — questions I'd want to explore with the team) + 12 passive security findings across 4 categories.
7 interactive views built from reverse-engineering Primer's architecture. Includes Radar (proactive multi-lens monitoring that Primer doesn't have), architecture comparison, and real PETS.L data across all lenses.
How will AI change fundamental investing? Two-page maximum covering workflow changes, adaptation, new risks, and product value.
Financial modelling becomes automated but requires adversarial oversight. An AI agent can build a three-statement model from SEC filings in minutes. Jefferies has rolled out AI research tools to 250+ analysts, turning days of work into minutes. But models are only as good as the assumptions embedded within them, and LLMs default to the statistical centre of their training distribution. The analyst's job is no longer to build the model — it is to stress-test the model's assumptions against what the AI cannot see: management credibility, competitive dynamics in flux, and non-linear strategic shifts that defy historical pattern-matching.
Information asymmetry shifts, not disappears. When every analyst had to manually read Note 150 in the Report and Accounts, spotting aging receivables or reverse factoring was a genuine edge — most competitors simply would not do the work. AI eliminates that asymmetry overnight. The new asymmetry is meta-cognitive: understanding what the AI knows, what it missed, and what it confidently hallucinated. Hallucination rates in AI-generated research have increased sixfold since 2023, with fabricated citations now appearing in 1-in-277 academic papers. Financial analysis is not immune to this failure mode.
Short-term alpha compresses. As AI democratises quarterly earnings analysis, the range of consensus outcomes narrows. Quarterly trading becomes a damp squib. The durable edge moves to two-year-plus horizons — regime change, management evolution, product pivots — where Bayesian reasoning about non-linear outcomes remains beyond current AI capability.
The behavioural overlay remains irreducibly human. Roughly 30% of how a stock trades is driven by behavioural dynamics: what is priced in, what the market believes it knows, and where positioning creates fragility. Determining "what is known and what is not known" — the core skill of active management — becomes harder, not easier, when AI is involved. Previously, you were second-guessing other humans; now you must second-guess AI agents whose reasoning is opaque and whose outputs are correlated across firms.
Conviction and risk management cannot be outsourced. An AI can generate a thesis. It cannot feel the weight of capital at risk. Portfolio construction, position sizing under uncertainty, and the discipline to hold (or cut) through volatility remain fundamentally human functions. No amount of AI sophistication changes the fact that investment is a decision made under irreducible uncertainty.
The value of management interaction shifts but persists. Management meetings are no longer about listening and taking notes — AI does that better. The new value is in asking the one question the AI cannot formulate: "Our models show a divergence between your stated CapEx priorities and your recent engineering hires in a non-core division. Can you explain this strategic ambiguity?" The analyst uses AI's complete data synthesis to identify the unknown unknowns, then uses scarce human interaction to probe those specific gaps.
The core thesis: analysts must become more developer than financial modeller. The traditional analyst skillset — Excel modelling, note-reading, management meeting attendance — is now table stakes that AI performs faster and more accurately. The scarce skill is no longer the ability to build a model; it is the ability to build the system that builds, verifies, and challenges the model. This is a fundamentally different competency, closer to software engineering than to traditional finance.
This requires four new competencies:
The hiring implication: The next analyst hire should be evaluated on their ability to construct an agentic workflow, not on their ability to build a DCF in Excel. PMs should reduce coverage breadth and increase conviction depth. The firms that win will not be those covering 500 stocks with AI assistance; they will be those covering 50 stocks with AI-validated, multi-model, adversarially-tested theses — built by analysts who are as comfortable with an API as they are with an annual report.
The market is flooded with tools that summarise earnings calls and extract financial data. These are commodities. A genuinely valuable product would:
The product that simply makes analysts faster is a commodity waiting to be competed away. The product that makes analysts more rigorous — that systematically reduces the probability of being confidently wrong — is the one that earns its seat in a professional workflow.
Pets at Home Group plc (PETS.L) — FY26 Pre-Close. Four reports cross-referenced against verified financial data from FMP API, Investegate, and analyst coverage.
Profit mix table with FY25 comparison. Quantified central + insurance drag (£21m deterioration). Includes original guidance context (£115-125m → £92m). Observation that the company issued a "deliberately narrow statement" shows critical thinking about disclosure strategy. Best at identifying what data is missing and why that matters.
Adds FY27-28 estimates (£100m/£115m) and bear/base/bull scenarios. Margin sensitivity analysis (50bp = £6-7m PBT) is useful original work. "Stabilisation rather than recovery proof" is the single best editorial line across all four reports. DPS estimate of -25-30% was materially wrong (actual: -43.1%).
Restates company disclosures without original analysis. Notes the retail consensus miss (£51.1m vs £30m actual) but attributes it to "definition mismatches" without investigation. No forward estimates, no scenarios, no balance sheet analysis, no valuation context. A raw data feed with formatting.
Nearly identical to Report A in structure, data, and conclusions. Same "definition mismatch" hand-wave. If two AI-generated reports are indistinguishable, one of them should not exist. Report B adds nothing that Report A does not already provide.
| Metric | Report Claims | Verified Actual | Verdict |
|---|---|---|---|
| Underlying PBT | All: "c£92m" | £92.8m | Accurate (within rounding) |
| Vet Group PBT | All: "c£83m" | ~£83m | Accurate |
| FY25 Retail PBT | All: "£72.9m" | £72.9m | Accurate |
| Net Debt | All: "c£20m" | £357m (inc. leases) ~£20m (ex-leases) | Correct per company definition, but no report flags the £357m total debt or the definitional difference |
| DPS Change | C: "-25-30%" D: "-25-35%" | 7.4p (-43.1%) | Arithmetic failure. All reports cite the 50% payout rebase (announced at pre-close) but then estimate the DPS cut as a range instead of calculating it. 50% × ~14.5p estimated EPS = ~7.25p, from 13p = -44%. The answer was derivable from the company's own stated policy. This is not an estimation error — it is a failure to perform the calculation. |
| Revenue | All: "Not disclosed" | £1,469.6m (-0.8%) | Correct that pre-close omitted revenue, but no report flagged this as an analytical risk |
| Gross Margin | None mention | 45.7% (from 46.9%) | 120bp compression entirely missed. £17.6m gross profit impact not discussed. |
| FCF | None mention | £147m | Strong cash generation ignored. FCF yield of 17.8% is decision-relevant. |
| Goodwill / Tangible Equity | None mention | £960m / -£8.6m | Total intangible assets (goodwill £960m + other £22m = £982m) exceed total equity (£973m). Tangible book value is negative. Major balance sheet risk entirely unaddressed. |
| Valuation | None mention | EV/EBITDA 6.05x | No valuation context whatsoever. Current price 192p vs consensus target 222p (15% upside). |
| Retail consensus miss | A/B: "£51.1m vs £30m — definition mismatch" | £30m actual | The £21m gap deserves investigation, not a hand-wave. See analysis below. |
For a buy-side analyst preparing for a management meeting, Report D provides the best foundation because it identifies the right questions: why was disclosure so narrow? What is the insurance drag trajectory? Why does the segment profit bridge not add up cleanly? These are productive starting points for management engagement.
Report C's editorial judgment is sharper. The phrase "stabilisation rather than recovery proof" is the kind of conclusion an analyst needs — it frames the investment debate correctly and tells you what to watch for in the prelims. Report C also provides the only margin sensitivity analysis (50bp retail margin = £6-7m group PBT impact), which is directly useful for scenario modelling.
What an analyst would still need to do manually:
| # | Missing Item | Why It Matters | Verified Data |
|---|---|---|---|
| 1 | Gross margin compression | 120bp decline signals pricing/cost pressure that directly impacts the recovery thesis | 45.7% (from 46.9%) |
| 2 | Free cash flow | £147m FCF against £92.8m PBT shows strong cash conversion — a bullish signal hidden by the earnings decline | £147m (17.8% yield) |
| 3 | Goodwill / tangible equity | £960m goodwill = 98.7% of equity. Tangible equity is NEGATIVE. Impairment risk is material with declining profits | -£8.6m tangible equity |
| 4 | Total debt (inc. leases) | Reports use company's ~£20m ex-lease figure without flagging the £397m total. Net debt/EBITDA of 1.83x is moderate but worth discussing | £397m total debt |
| 5 | Valuation multiples | No EV/EBITDA, P/E, or FCF yield. Without valuation, a research report is just a news summary | 6.05x EV/EBITDA |
| 6 | Analyst consensus & coverage | 11 analysts, split verdict (5 Buy / 3 Hold / 3 Sell), avg target 222p. Essential for positioning a view | 222p avg (15% upside) |
| 7 | Share count reduction | 463.5m → 454.4m shares via buybacks. Affects EPS calculation and per-share metrics | -2.0% dilution offset |
| 8 | Historical earnings trajectory | FY24 PBT £105.7m → FY25 £120.6m → FY26 £86.5m (statutory). The FY25 peak and FY26 collapse tells a story none of the reports contextualise | 3-year statutory PBT trend |
What actually matters for an investment decision on PETS.L:
Bottom line: Report C best identifies the qualitative investment debate. Report D best identifies the analytical gaps. Neither comes close to what a competent human analyst would produce, because both are fundamentally constrained by what the company chose to disclose, rather than investigating what it chose not to.
| Model | Best | Worst | Key Critique |
|---|---|---|---|
| GPT-5.4 | D | A | "Report D provides comprehensive context; A fails to offer substantive analysis beyond restating data" |
| Claude Sonnet | D | A | "Negative tangible equity is the smoking gun none addressed — PETS is trading on £960m of acquisition goodwill with declining profitability" |
| DeepSeek V4 | D | B | "B is plagiarised trash — pure copy of A with zero added value. Goodwill is 99% of equity — technically insolvent if impaired." |
| Gemini 2.5 Pro | D | A/B | "Even the best report operates at a superficial level. The AI failed a simple capital allocation derivation: given PBT, FCF, net debt, and a buyback, management would prioritise buyback over dividend." |
The debate revealed that the gap between the reports is less interesting than their shared failures. The AI models generating these reports appear unable to perform the foundational task of equity analysis: connecting financial statements to each other and deriving implications that are not explicitly stated in the source text.
Model: DeepSeek V4 (Apache 2.0, open-source) | Cost: $0.003 | Time: 8 seconds | Data sources: FMP API, Investegate RNS, MarketScreener, TipRanks
FY26 (52 weeks to 26 March 2026) | Generated from multi-source verified data
Headline: A Year of Two Halves, but Structural Questions Remain. Pets at Home delivered a weak FY26, with underlying PBT of £92.8m falling 30% YoY and well below the original guidance range of £115-125m. The headline narrative of "H2 recovery" is supported by improving retail volumes, but the damage was done in H1, and the full-year numbers reveal material margin erosion. The dividend rebase (-43%) and £50m buyback signal management's intent to return capital, but the balance sheet carries a significant goodwill overhang that cannot be ignored.
[Sources: Investegate RNS, FMP Income Statement]
Retail (PBT: ~£30m, -59% YoY). The primary drag. Gross margin compression of 120bps (to 45.7%) reflects promotional intensity, mix shift, and cost inflation not passed through. H1 retail PBT of just £3.5m was catastrophic; H2 implied ~£26.5m shows recovery, but full-year profitability remains well below FY25's £72.9m. The division now generates a PBT margin of roughly 2%.
[Sources: FMP Ratios (gross margin), Reports A-D (segment split)]
Vet Group (PBT: ~£83m, +9% YoY). The standout performer. Consumer revenue growth of 5% and PBT expansion of 9% demonstrate pricing power. The Vet Group now accounts for nearly 90% of group underlying PBT. This concentration risk is underappreciated: if vet growth slows, the group's earnings base is vulnerable.
[Source: Investegate RNS (segment revenue)]
Gross Margin: The 120bp Wound. The most concerning data point. Gross margin declined from 46.9% to 45.7% — a 120bp compression representing ~£17.6m of gross profit impact. This is structural, not one-off. If retail margins do not recover in FY27, operating leverage is severely impaired.
[Source: FMP Income Statement (FY25 GP £694.7m/46.9% vs FY26 GP £672.0m/45.7%)]
Balance Sheet: The Elephant in the Room. Tangible equity is negative £8.6m. The group's entire equity base of £973m is supported by £960m of goodwill from historical acquisitions (primarily veterinary practices). Any impairment — even a modest 10% write-down of £96m — could trigger covenant issues. Net debt/EBITDA of 1.83x is manageable, but the goodwill-to-equity ratio of 98.7% is extreme.
[Source: FMP Balance Sheet (Goodwill £960m, Equity £973m, Total Debt £397m)]
Cash Flow: The Silver Lining. Operating cash flow of £190m and FCF of £147m (17.8% yield) are strong. OpCF/PBT ratio of 2.05x demonstrates robust cash conversion despite declining earnings. However, FCF strength is partly a function of low CapEx (£43m, 2.9% of revenue) — not underlying earnings growth.
[Source: FMP Cash Flow (OpCF £190m, CapEx £43m, FCF £147m)]
Valuation: Cheap for a Reason. At 192p: EV/EBITDA 6.05x, P/E ~13x (underlying), FCF yield 17.8%. The market has priced in further erosion. Analyst consensus: 11 covering, 5 Buy / 3 Hold / 3 Sell. Average target 222p (15% upside). Jefferies at 265p (Buy), Peel Hunt at Hold.
[Sources: FMP Key Metrics, MarketScreener, TipRanks]
FY27 Scenarios (Group Underlying PBT):
Bear (£80m): Retail margins fail to recover, Vet slows to 3%. Stock to 150p.
Base (£98m): Consensus. Retail stabilises, Vet grows 5%. Stock to 200p.
Bull (£110m): Retail margins recover 50bps, Vet accelerates. Stock to 250p.
Conclusion: Cautious, Not Conviction. Cash-generative with a strong vet franchise, but retail is structurally challenged, the balance sheet carries significant goodwill risk, and margin compression is not yet arrested. Neutral — pending greater visibility on retail margins and goodwill impairment risk.
| Dimension | Primer Reports (A-D) | Our Report | Source |
|---|---|---|---|
| Gross margin | Not mentioned in any report | 120bp compression identified as "most concerning data point" | FMP |
| Goodwill / tangible equity | Not mentioned in any report | £960m goodwill, -£8.6m tangible equity flagged as impairment risk | FMP |
| Cash flow analysis | Not mentioned in any report | FCF £147m (17.8% yield), OpCF/PBT 2.05x identified as positive signal | FMP |
| Valuation context | No multiples, no peer comparison, no analyst targets | EV/EBITDA 6.05x, P/E ~13x, FCF yield 17.8%, 11 analysts, avg target 222p | MarketScreener |
| Investment conclusion | No position taken in any report | "Neutral — cheap can get cheaper." Clear stance with reasoning | Editorial judgment |
| Vet concentration risk | "Earnings anchor" (positive framing only) | "~90% of group PBT. Concentration risk is underappreciated" | Derived from segment data |
| DPS forecast | C: -25-30%, D: -25-35% (actual: -43.1%) | Correctly states -43% actual cut, links to 50% payout policy | Investegate |
| Underlying PBT | All: "c£92m" (accurate) | £92.8m (precise) | Both accurate |
| H2 recovery narrative | C: "stabilisation not recovery" (good) | "H2 recovery supported but damage done in H1" (similar) | Both adequate |
The defensibility question. To test whether Primer's report output is replicable, I ran the same analysis through DeepSeek V4 (open-source, Apache 2.0 licence) via API. The prompt included verified data from the FMP financial API, the company's RNS announcement, and analyst coverage data — the same multi-source approach an analyst would take. Cost: $0.003. Time: 8 seconds.
The result: the open-source report outperformed all four Primer reports on every dimension that matters to an analyst.
| Dimension | Primer Reports (A-D) | DeepSeek V4 (Open Source) |
|---|---|---|
| Gross margin analysis | None mention the 120bp compression | Identifies it as "the most concerning data point" and links to structural pressures |
| Balance sheet / goodwill | None address £960m goodwill or negative tangible equity | Calls it "the elephant in the room" — flags impairment risk and covenant exposure |
| Cash flow | None mention £147m FCF | Analyses FCF yield (17.8%), notes it's driven by low CapEx not earnings growth |
| Valuation context | No EV/EBITDA, P/E, or peer comparison | Provides EV/EBITDA (6.05x), P/E (~13x), FCF yield, and analyst target context |
| DPS forecast | C: -25-30%, D: -25-35% (actual: -43.1%) | States actual cut correctly (-43%) and links to 50% payout policy |
| Data extraction accuracy | Core numbers accurate (c£92m vs £92.8m actual) | Uses verified actuals directly from multiple sources |
| Investment conclusion | No position taken | Takes a clear stance: "Neutral — cheap can get cheaper" |
| Vet concentration risk | Notes vet is "earnings anchor" but doesn't flag risk | "Vet now accounts for ~90% of group PBT. This concentration risk is underappreciated." |
The improvement does not come from a better model. It comes from a better data pipeline. The Primer reports appear to analyse only the pre-close statement in isolation. The open-source report was fed data from four sources:
This is the critical insight: 100% retrieval accuracy from a single source document is a solved problem. Smallwood himself acknowledged this in the Zeus podcast: "pulling numbers correctly doesn't make them a great analyst." The Primer reports prove this — they extract accurately from the pre-close statement, but they do not cross-reference against the balance sheet, cash flow statement, or external data sources. The result is reports that are precisely accurate about what the company chose to disclose, and entirely silent about what it didn't.
| Tool | What It Does | Licence |
|---|---|---|
| FinRobot | 8 specialised agents, multi-page equity research with DCF, 15+ chart types, 3-year projections | MIT (Open Source) |
| DeepSeek V4 Pro | 1.6T parameter model, strong financial reasoning, long-context (128K), agentic workflow capable | Apache 2.0 |
| LlamaIndex + LlamaExtract | Structured data extraction from SEC/RNS filings with citation tracking and source traceability | MIT |
| Llama 4 Scout | 10M token context window — can ingest entire annual reports, 5 years of filings simultaneously | Meta Community |
| FMP / Polygon / FRED APIs | Real-time financial data, historical statements, macro overlays — provide the multi-source data layer the reports lack | Commercial (low cost) |
The podcast makes a compelling case for three capabilities that open-source tools cannot easily replicate:
The constructive conclusion: Primer's static report output is replicable and, when compared against a multi-source data pipeline, is outperformed by open-source alternatives at negligible cost. The genuine product differentiation — workflow encoding, agent memory, and programmable rules — is compelling but is not visible in these reports. The product roadmap should prioritise making these interactive, compounding capabilities the primary value proposition, rather than competing on static report generation where the moat is thin.
Five-minute video explaining Primer to a skeptical Head of Research, then addressing: why not ChatGPT, Claude, or AlphaSense?
Which tools were used, how they were used, where they helped, and where human judgment was still required.
These are not feature requests or a build plan — they are points of discussion arising from the report analysis, podcast review, and competitive landscape research. Each represents a question I'd want to explore with the team: where does the product roadmap prioritise, what are the trade-offs, and which of these would deliver the highest marginal value to buy-side users?
The problem: All four reports appear to analyse only the pre-close statement text. They extract accurately from that document but do not cross-reference against Companies House filings, prior annual reports, or financial data APIs. The result is reports that are precisely right about what the company chose to disclose and entirely silent about what it didn't.
The fix: Before generating any report, the agent should automatically pull the most recent balance sheet (goodwill, debt, tangible equity), cash flow statement (FCF, OpCF, CapEx), and 3-year income statement trends (margin trajectory). These are publicly available via APIs like FMP at negligible cost. Every report should include a mandatory "Balance Sheet & Cash Flow" section, even if the source document doesn't mention them — especially if it doesn't.
Impact: This alone would have caught the £960m goodwill / negative tangible equity risk, the 120bp gross margin compression, and the £147m FCF that supports the valuation case. These are the three most decision-relevant facts about Pets at Home, and none appeared in any report.
The problem: The reports treat the income statement in isolation. But equity analysis fundamentally requires connecting statements: does the P&L decline flow through to cash? Is the balance sheet supporting or constraining the recovery? Are dividends covered by cash flow or funded by debt?
The fix: Build a mandatory "Tri-Statement Sanity Check" into every report. For example: (1) PBT declined 30% — did OpCF decline proportionally? (No: OpCF only declined 13%, signalling strong cash conversion.) (2) Dividend was cut 43% — is the new DPS covered by FCF? (Yes: FCF of £147m covers the ~£34m dividend 4.3x.) (3) Net debt includes £397m of lease liabilities — does the company definition of "c£20m net debt" match reality? (Only if you exclude leases.)
Impact: This would differentiate Primer from every competitor that just summarises the P&L. It's also where Smallwood's "2,000 modules" concept should shine — the agent deciding to check cash flow quality after spotting an earnings decline is exactly the kind of adaptive workflow that's hard to replicate with generic tools.
The problem: The reports tell you what happened but not whether it matters for the investment decision. At 192p with a 17.8% FCF yield and EV/EBITDA of 6.05x, the market has already priced in significant pessimism. Without this context, an analyst can't determine whether the earnings miss creates a buying opportunity or confirms a value trap.
The fix: Every report should include a standardised valuation footer: current price, market cap, EV/EBITDA, P/E, FCF yield, dividend yield, and analyst consensus (number of analysts, Buy/Hold/Sell split, average target, range). This data is available from free and low-cost APIs. The agent should also flag when valuation metrics move to historical extremes — e.g., "FCF yield of 17.8% is the highest since FY19."
The problem: The "definition mismatch" excuse for the £21m retail consensus miss (£51m vs £30m) is the clearest example. Rather than investigating why retail underperformed so dramatically, the reports rationalised the discrepancy as a data quality issue. Similarly, accepting "no adverse impact from CMA" without independent analysis is restating PR, not research.
The fix: Build a "Red Flag" module that automatically: (1) compares management language across quarters for shifted narratives, (2) flags when actual results miss consensus by >10% and demands root cause analysis rather than definitional excuses, (3) cross-references management claims against independent data (e.g., CMA ruling text, competitor filings), and (4) explicitly marks which conclusions are management-sourced vs independently derived.
Impact: This is the "Contradiction Engine" concept from the memo. It's also the single most defensible product capability — a tool that makes analysts more skeptical is genuinely differentiated from tools that make them faster.
The problem: Management explicitly stated a rebase to a 50% payout ratio. Given underlying EPS of 14.8p, the implied DPS is 7.4p — exactly what was delivered. The agent should have calculated this rather than estimating a percentage range.
The fix: When management provides a payout ratio, the agent should: (1) calculate the implied DPS from forecast EPS, (2) compare this to the prior DPS to derive the implied cut, (3) cross-check whether FCF covers the new dividend, and (4) assess buyback implications for EPS accretion. This is arithmetic, not judgment — exactly the type of work an agent should do flawlessly.
All findings below are from passive observation of URLs provided as part of this assessment, public DNS records, and HTTP response headers. No active scanning, exploitation, or penetration testing tools were used. This review is presented constructively — as a security-aware assessment of the product's public-facing architecture.
| Component | Technology | Evidence | Risk Level |
|---|---|---|---|
| Report hosting | AWS S3 + CloudFront | server: AmazonS3, x-amz-cf-pop headers | Medium |
| Marketing site | Framer | server: Framer/e66ed00 (version exposed) | Low |
| Product app | Next.js on Render, behind Cloudflare | x-powered-by: Next.js, x-render-origin-server: Render | Medium |
| Image assets | Cloudinary (account: dttjaxqso) | Image URLs in report HTML | Low |
| Report template | MJML (email framework) | Microsoft Office conditional comments in HTML source | Info |
| Legal entity | KernelAI, 125 London Wall, EC2Y 5AS | Report footer | Info |
/{TICKER}/filing_briefing/{DATE}_{TIME}.html. While guessing the exact timestamp requires brute-forcing, the ticker and date components are publicly knowable. An attacker who knows Primer covers PETSP.L and that FY26 results were released on 31 March 2026 has a small search space./reports/a3f7c2d1-9b4e-...) rather than ticker/date patterns.
/PETSP.L/), not by user or organisation/PETSP.L/filing_briefing/ (production) and /testing/PETSP.L/filing_briefing/ (testing) are served from the same domain, bucket, and CDN. The three testing reports were all uploaded simultaneously (identical last-modified: Thu, 02 Apr 2026 16:23:10 GMT), confirming this is a test/evaluation pipeline sharing production infrastructure.reports.production.primerapp.com responses include zero security headers:Content-Security-Policy — reports could load external scripts or be injected with malicious contentX-Frame-Options — reports can be iframe'd by any third-party site (clickjacking risk)X-Content-Type-Options — MIME sniffing attacks possibleStrict-Transport-Security — HTTPS not enforced via HSTSReferrer-Policy — report URLs may leak in referrer headers
studio.primerapp.com application similarly lacks: Content-Security-Policy, X-Frame-Options, X-XSS-Protection, Referrer-Policy, and Permissions-Policy. For a financial application handling proprietary data, this is below industry baseline. The marketing site (Framer) does include Strict-Transport-Security, but the product application does not.
server: AmazonS3, x-amz-server-side-encryption: AES256x-powered-by: Next.js, x-render-origin-server: Render, server: cloudflareserver: Framer/e66ed00 (including build version)studio.primerapp.com returns the complete application navigation structure (Studio, Library, Templates, Models, Notes, Data, Routines, Coverage, Reports, Calendar, Inbox, Settings) and feature names (AutoYOLO, Memories, Sources) before any authentication check. While this is common in client-side rendered Next.js applications, it exposes the full feature set and UI architecture to unauthenticated users.<!--[if mso]>) characteristic of the MJML email template framework. This suggests reports may be dual-purpose: served both as web pages and via email delivery. Email-compatible HTML cannot support Content-Security-Policy headers, which may explain the missing security headers on the reports subdomain.
dttjaxqso. While Cloudinary has reasonable default security, the account identifier could be used to enumerate uploaded assets if resource list access is not explicitly disabled.
<Error><Code>AccessDenied</Code>...<HostId>...</HostId></Error>) including internal request IDs and host identifiers. CloudFront should be configured to return custom error pages rather than proxying S3 error responses.
/.well-known/security.txt returns a 307 redirect (to auth), not a security contact page. For a financial services product, having a published vulnerability disclosure policy and security contact demonstrates maturity and is increasingly expected by institutional clients.
| # | Finding | Severity | Effort to Fix |
|---|---|---|---|
| 1 | Security-by-obscurity on report URLs | Medium | Medium (signed URLs) |
| 3 | Data segregation claim vs reality | High | High (architecture change) |
| 2 | Predictable URL structure | Medium | Low (UUID paths) |
| 4 | Test/prod commingled | Medium | Low (separate buckets) |
| 5-6 | Missing security headers | Medium | Low (CloudFront/Cloudflare config) |
| 7 | Server stack disclosure | Medium | Low (header stripping) |
| 8 | UI shell pre-auth render | Low | Medium (SSR auth guard) |
| 9-12 | MJML, Cloudinary, S3 errors, security.txt | Low | Low |
The two high-severity findings — unauthenticated report access and the gap between the data segregation claim and the observable architecture — are the ones most likely to surface during institutional client due diligence. Addressing these before scaling the buy-side customer base would be prudent.
The thesis: Primer's single-agent architecture is a strong starting point, but the real moat in AI equity research is not extraction accuracy — it's verification architecture. A multi-lens system where every conclusion is independently cross-checked creates a product that analysts can actually trust with capital at risk.
I built a working prototype (open MultiLens prototype →) using real Pets at Home data from FMP API, Investegate, and MarketScreener. It demonstrates four lenses:
Architecture decision (from 4-model debate):
Why this matters for Primer's roadmap: The multi-lens concept is not a competitor — it's a product evolution. Primer already has the domain expertise, the analyst workflows, and the agent memory. Adding cross-statement verification, contradiction detection, and market context to the existing platform would be the highest-ROI product investment. The interactive agent capabilities (Memories, Routines, programmable rules) become even more powerful when the underlying analysis is independently verified across multiple lenses.
A complete product prototype built from reverse-engineering Primer's architecture (47 tools, 12 models, Visible Alpha integration) and designing a multi-lens alternative. Click through every view.
Opens in a new tab for full interactive experience