{ "url": "https://ufgrowfun.com", "auditedAt": "2026-07-18T04:35:22.231Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete audit of the public unauthenticated portal and representative reachable states; authenticated wagering functionality was not entered because no credentials were provided.", "page": { "appType": "mpa", "framework": "ASP.NET Web Forms with jQuery 3.4.1 and Bootstrap 4.3.1", "notes": "Public login/marketing portal. Root redirects to Default8.aspx?lang=EN-US. Authenticated product was out of reach; popup endpoints returned minimal/blank responses when directly navigated." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "axe-core", "lighthouse", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "heap-summary", "curl HTTP probes", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "other", "path": "evidence/404-status.txt", "caption": "404 status.txt", "findingIds": [ "F11", "F33" ] }, { "type": "screenshot", "path": "evidence/404.png", "caption": "404.png", "findingIds": [ "F11", "F33" ] }, { "type": "other", "path": "evidence/axe.json", "caption": "axe.json", "findingIds": [ "F03", "F16", "F17", "F18", "F34" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies.json", "findingIds": [ "F27" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler.png", "findingIds": [ "F31" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered.png", "findingIds": [ "F31" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability.json", "findingIds": [ "F31" ] }, { "type": "other", "path": "evidence/games-state.json", "caption": "games state.json", "findingIds": [ "F04", "F05" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers.json", "findingIds": [ "F27", "F30" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark.png", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop.png", "findingIds": [ "F01", "F36", "F39" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom.json", "findingIds": [ "F05", "F06", "F08", "F21", "F22", "F24", "F34", "F35", "F36", "F41" ] }, { "type": "screenshot", "path": "evidence/home-high-contrast.png", "caption": "home high contrast.png", "findingIds": [ "F03" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout.json", "findingIds": [ "F07", "F19", "F20" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile.png", "findingIds": [ "F07", "F08", "F19" ] }, { "type": "other", "path": "evidence/home-recon.json", "caption": "home recon.json", "findingIds": [ "F23", "F25", "F32" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary.json", "findingIds": [ "F14", "F15", "F28", "F40", "F42" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary.json", "findingIds": [ "F12", "F13" ] }, { "type": "other", "path": "evidence/images.json", "caption": "images.json", "findingIds": [ "F16", "F21", "F40" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse.json", "findingIds": [ "F12", "F13", "F15", "F24" ] }, { "type": "screenshot", "path": "evidence/login-invalid.png", "caption": "login invalid.png", "findingIds": [ "F10", "F11", "F37" ] }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "platform probe.json", "findingIds": [ "F06", "F09", "F18", "F20", "F26", "F29", "F32", "F38", "F39" ] }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "reduced motion.json", "findingIds": [ "F02", "F41" ] }, { "type": "other", "path": "evidence/routes.txt", "caption": "routes.txt", "findingIds": [ "F25" ] }, { "type": "other", "path": "evidence/runtime-metrics.json", "caption": "runtime metrics.json", "findingIds": [ "F14", "F22" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers.json", "findingIds": [ "F28" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Active evidence review using home-dark, home-desktop", "evidence": "Desktop and prefers-color-scheme: dark screenshots are pixel-equivalent in treatment, while the page declares no color-scheme or theme media query.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Active evidence review using reduced-motion", "evidence": "Under prefers-reduced-motion: reduce, the probe still found data-ride=\"carousel\" and a deprecated ; neither was disabled.", "pathIds": [ "home" ], "artifacts": [ "evidence/reduced-motion.json" ], "findingIds": [ "F02" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Active evidence review using axe, home-high-contrast", "evidence": "axe measured 3.49:1 placeholder contrast for both login fields; forced-colors capture also leaves content-heavy raster imagery as the primary communication.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json", "evidence/home-high-contrast.png" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Active evidence review using games-state", "evidence": "ShowGC() directly toggles table rows from displayed to none/table-row; no View Transition CSS or API use is present.", "pathIds": [ "home" ], "artifacts": [ "evidence/games-state.json" ], "findingIds": [ "F04" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "DOM/CSS inspection", "evidence": "No scroll-linked animation or scroll handler is used, so the anti-pattern is absent.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "DOM interaction inventory", "evidence": "No gesture-driven interaction is present to implement or fight with custom pointer handlers.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "high", "method": "Desktop screenshot and DOM inspection", "evidence": "The audited portal has no meaningful scrolling chrome; no static sticky header or JS scroll toggle is present.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "pass", "confidence": "high", "method": "DOM overlay inventory", "evidence": "No tooltip, popover, or attached menu is present on the audited public surface.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "issues", "confidence": "high", "method": "Active evidence review using games-state, home-dom", "evidence": "The Games & Casino onclick state hides the main content and reveals a table row without moving focus, updating URL/state, or announcing the new section.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/games-state.json" ], "findingIds": [ "F05" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Load screenshot review", "evidence": "Load screenshot shows no modal, consent wall, or full-viewport interruption obscuring the portal.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Active evidence review using home-dom, platform-probe", "evidence": "DOM shows onclick div navigation and PopupCenter window calls, with zero dialog, popover, or details elements.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/platform-probe.json" ], "findingIds": [ "F06" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Desktop screenshot review", "evidence": "The entry screen keeps chrome compact and gives the primary viewport to service imagery and login.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "issues", "confidence": "high", "method": "Active evidence review using home-mobile, home-mobile-layout", "evidence": "At a requested 360x800 viewport Chrome reports no viewport meta and a 980 CSS-pixel layout scaled to 0.367; the screenshot renders login controls and text extremely small.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/home-mobile.png" ], "findingIds": [ "F07" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Active evidence review using home-dom, home-mobile", "evidence": "Rendered HTML uses a 975px table, 734px/233px columns, and many pixel widths; no container-query behavior was observed.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/home-mobile.png" ], "findingIds": [ "F08" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Active evidence review using platform-probe", "evidence": "The active controls measure only 20-22 CSS px high, including language, username, password, and Login.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F09" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Desktop screenshot and control inventory", "evidence": "UFABET branding, betting categories, and the LOGIN action are visible in the first viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "issues", "confidence": "high", "method": "Active evidence review using login-invalid", "evidence": "Submitting test credentials navigated the inspected target away; the captured post-submit visual showed no inline validation or recovery affordance.", "pathIds": [ "home" ], "artifacts": [ "evidence/login-invalid.png" ], "findingIds": [ "F10" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Active evidence review using 404, 404-status, login-invalid", "evidence": "Invalid login produced no visible error in the captured state, and a missing route returned HTTP 403 with a blank-looking page.", "pathIds": [ "home" ], "artifacts": [ "evidence/login-invalid.png", "evidence/404.png", "evidence/404-status.txt" ], "findingIds": [ "F11" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Active evidence review using home-trace-summary, lighthouse", "evidence": "Lighthouse scored performance 0.54 with LCP 34.5s, TBT 310ms, and Speed Index 5.7s; the first-party trace measured LCP 1.78s without throttling.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Layout primitive plus Lighthouse", "evidence": "Layout observer recorded CLS 0 and Lighthouse recorded CLS 0.012, both within the good range.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Active evidence review using home-trace-summary, lighthouse", "evidence": "Lighthouse measured 310ms TBT although the unthrottled trace saw no >50ms long task, indicating device/network sensitivity.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Active evidence review using home-summary, runtime-metrics", "evidence": "HAR and DOM confirm jQuery, Popper, Bootstrap, bjqs and default.js are parser-inserted in without async, defer, or module semantics.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/runtime-metrics.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Active evidence review using home-summary, lighthouse", "evidence": "Lighthouse estimates 345 KiB unused JavaScript and 51 KiB unused CSS; the HAR transfers 219,215 third-party bytes.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Active evidence review using axe, images", "evidence": "axe found critical unnamed language select and image input, unnamed carousel controls, and the image audit found all 11 images missing alt text.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json", "evidence/images.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Active evidence review using axe", "evidence": "axe measured 3.49:1 for the 11px username and password placeholders against white, below 4.5:1.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Active evidence review using axe, platform-probe", "evidence": "axe found no main landmark, no h1, content outside landmarks, and tabindex values 1 and 3; the probe found no headings or landmarks.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json", "evidence/platform-probe.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "issues", "confidence": "high", "method": "Active evidence review using home-mobile, home-mobile-layout", "evidence": "The 980px desktop layout is scaled to 36.7% on a 360px device, making 11-14px desktop text effectively tiny and difficult to read.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Active evidence review using home-mobile-layout, platform-probe", "evidence": "No viewport meta is present, controls are 20-22px high, and the mobile screenshot is a miniature desktop page.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/platform-probe.json" ], "findingIds": [ "F20" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Lighthouse and CDP sessions", "evidence": "Lighthouse no-console-errors audit passed and the page loaded without an uncaught error in evidence sessions.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Active evidence review using home-dom, images", "evidence": "Images audit found 6 missing dimensions, all 11 in legacy PNG/JPG, 7 without responsive sources, and 5 below-fold images eagerly loaded; DOM is table-based.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/home-dom.json" ], "findingIds": [ "F21" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Active evidence review using home-dom, runtime-metrics", "evidence": "DOM includes deprecated , javascript: links, popup windows, inline handlers, jQuery 3.4.1 and Bootstrap 4.3.1.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/runtime-metrics.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Active evidence review using home-recon", "evidence": "The EN-US route has Thai title/description while the visible navigation and selected language are English.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Active evidence review using home-dom, lighthouse", "evidence": "Lighthouse crawlable-anchors failed; primary actions use javascript: and onclick divs, and viewport meta is absent.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-dom.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Active evidence review using home-recon, routes", "evidence": "The public landing page declares noindex/googlebot noindex, has no canonical, and /sitemap.xml returns the text DIV rather than a sitemap.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json", "evidence/routes.txt" ], "findingIds": [ "F25" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Active evidence review using platform-probe", "evidence": "Probe found zero JSON-LD and zero Open Graph tags despite the page representing a named betting service.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Active evidence review using cookies, headers", "evidence": "HTTPS is used, but CSP/HSTS/nosniff are absent and ASP.NET_SessionId lacks Secure.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Active evidence review using home-summary, trackers", "evidence": "Tracker probe found Google Tag Manager and five third-party origins; HAR attributes 219,215 transferred bytes to third parties, with GTM the largest script at 139,430 bytes.", "pathIds": [ "home" ], "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json" ], "findingIds": [ "F28" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Active evidence review using platform-probe", "evidence": "The only auth fields are username/password; no WebAuthn/passkey surface was found, and autocomplete attributes are empty.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F29" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Active evidence review using headers", "evidence": "Headers probe found no frame protection, Referrer-Policy, Permissions-Policy, CSP, HSTS, or nosniff.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F30" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Active evidence review using discoverability, discoverability-crawler, discoverability-rendered", "evidence": "Discoverability fetch received only 87 bytes of raw HTML with 0% rendered-word coverage; the crawler screenshot is blank while the browser screenshot has the portal.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "findingIds": [ "F31" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Repeated state-toggle probe", "evidence": "The simple Games state toggle completed reliably and did not produce a clipped overlay or unstable async state.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "high", "method": "Active evidence review using home-recon, platform-probe", "evidence": "Probe found no active service worker and recon found no web app manifest.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-recon.json" ], "findingIds": [ "F32" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Active evidence review using 404, 404-status", "evidence": "A representative missing route returned HTTP 403 and a blank-looking screenshot with no navigation or retry guidance.", "pathIds": [ "home" ], "artifacts": [ "evidence/404.png", "evidence/404-status.txt" ], "findingIds": [ "F33" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "Active evidence review using axe, home-dom", "evidence": "The page offers 14 language options but has no lang or dir; axe flags html-has-lang.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/axe.json" ], "findingIds": [ "F34" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "issues", "confidence": "high", "method": "Active evidence review using home-dom", "evidence": "Inline code constructs serverTime from a locale-fragile string and renders a fixed DD-MM-YYYY time format on all variants.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json" ], "findingIds": [ "F35" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "issues", "confidence": "high", "method": "Active evidence review using home-desktop, home-dom", "evidence": "The header explicitly displays GMT+8 and the script seeds a naive Date without an offset, so interpretation varies by browser time zone.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-dom.json" ], "findingIds": [ "F36" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Public-page screenshot review", "evidence": "No consent wall, forced continuity, disguised ad, confirmshaming, or preselected upsell appeared on the accessible public page.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Active evidence review using login-invalid", "evidence": "The invalid-login capture contains no visible inline error, field state, help, or accessible announcement.", "pathIds": [ "home" ], "artifacts": [ "evidence/login-invalid.png" ], "findingIds": [ "F37" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Active evidence review using platform-probe", "evidence": "The username and password inputs have empty autocomplete values and no labels.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F38" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "issues", "confidence": "high", "method": "Active evidence review using home-desktop, platform-probe", "evidence": "The login view exposes only username, password, and Login: no password recovery/help route, passkey option, or visible security guidance.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/platform-probe.json" ], "findingIds": [ "F39" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Active evidence review using home-summary, images", "evidence": "All 11 images are JPG/PNG, 7 lack responsive sources, 5 below-fold images are not lazy, and all five carousel banners load up front.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json", "evidence/home-summary.json" ], "findingIds": [ "F40" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Active evidence review using home-dom, reduced-motion", "evidence": "Inline code starts a one-second setInterval for the clock, while Bootstrap auto-runs the carousel; hidden slides and legacy libraries are loaded immediately.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/reduced-motion.json" ], "findingIds": [ "F41" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Active evidence review using home-summary", "evidence": "HAR transfers 880,688 bytes: 634,658 image bytes and 219,215 third-party bytes; GTM alone is 139,430 bytes.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json" ], "findingIds": [ "F42" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "This is a sensitive wagering login portal; exposing transactional actions to autonomous agents is not an evidenced product intent and could create financial risk.", "reason": "This is a sensitive wagering login portal; exposing transactional actions to autonomous agents is not an evidenced product intent and could create financial risk." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "No summarisation or language-model task is part of the small public login surface, so on-device inference has no justified use.", "reason": "No summarisation or language-model task is part of the small public login surface, so on-device inference has no justified use." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Baseline/post heap comparison", "evidence": "After ten Games state toggles, heap summary rose modestly from 6,396,512 to 6,609,728 bytes (+3.3%) and closures from 6,006 to 6,020; no unbounded trend is indicated.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "medium", "method": "Heap summaries and runtime metrics", "evidence": "The portal uses about 6.4-6.6 MB heap with 212 DOM elements, proportionate to this small page.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Heap constructor comparison", "evidence": "Top-constructor summaries contain no Detached* population; closures changed by only 14 after ten toggles.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02", "F03" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F05" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F06" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F08", "F09" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F11" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13", "F14", "F15" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F16", "F17", "F18", "F19", "F20" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F21", "F22" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F23", "F24", "F25", "F26" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F27", "F28", "F29", "F30" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F31", "F32", "F33" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F34", "F35", "F36" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F37", "F38", "F39" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F40", "F41", "F42" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "All checks were judged not applicable: This is a sensitive wagering login portal; exposing transactional actions to autonomous agents is not an evidenced product intent and could create financial risk. No summarisation or language-model task is part of the small public login surface, so on-device inference has no justified use." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Public entry/login portal, the primary archetype and journey; tested visual, responsive, preference, accessibility, performance, security and invalid-login conditions.", "url": "https://ufgrowfun.com", "conditions": [ "desktop 1440x900", "mobile 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors/high contrast", "keyboard/focus", "invalid credentials" ], "result": "issues" }, { "id": "games", "description": "Games & Casino in-page state, representing the only directly reachable stateful navigation surface.", "url": "https://ufgrowfun.com/Default8.aspx?lang=EN-US#games", "conditions": [ "state toggle repeated 10x" ], "result": "issues" }, { "id": "localisation", "description": "Thai language variant, representing the 14-option localisation selector.", "url": "https://ufgrowfun.com/Default8.aspx?lang=EN-GB", "conditions": [ "desktop 1440x900" ], "result": "issues" }, { "id": "rules", "description": "Betting Rules popup route, a distinct information surface; the endpoint rendered blank/minimal content in direct navigation.", "url": "https://ufgrowfun.com/BettingRulesWL.aspx?lang=EN-US", "conditions": [ "desktop", "mobile" ], "result": "failed" }, { "id": "missing", "description": "Representative missing route to assess HTTP/network recovery behavior.", "url": "https://ufgrowfun.com/__audit_missing__", "conditions": [ "HTTP status and screenshot" ], "result": "issues" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "summary": "Theme is hard-coded rather than preference-aware.", "evidence": "Desktop and prefers-color-scheme: dark screenshots are pixel-equivalent in treatment, while the page declares no color-scheme or theme media query.", "suggestedFix": "Declare color-scheme and provide preference-driven light and dark tokens with prefers-color-scheme or light-dark().", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ] }, { "id": "F02", "severity": "high", "confidence": "high", "summary": "Auto-advancing motion ignores reduced-motion.", "evidence": "Under prefers-reduced-motion: reduce, the probe still found data-ride=\"carousel\" and a deprecated ; neither was disabled.", "suggestedFix": "Stop carousel auto-advance and marquee motion under prefers-reduced-motion; retain manual controls.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/reduced-motion.json" ] }, { "id": "F03", "severity": "medium", "confidence": "high", "summary": "Controls do not remain robust under contrast needs.", "evidence": "axe measured 3.49:1 placeholder contrast for both login fields; forced-colors capture also leaves content-heavy raster imagery as the primary communication.", "suggestedFix": "Use system colors in forced-colors and raise text/placeholder contrast to WCAG AA.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "adapt-scrollbar-to-contrast-preferences", "guidanceCategory": "user-experience", "artifacts": [ "evidence/axe.json", "evidence/home-high-contrast.png" ] }, { "id": "F04", "severity": "low", "confidence": "high", "summary": "The in-page Games state swaps abruptly.", "evidence": "ShowGC() directly toggles table rows from displayed to none/table-row; no View Transition CSS or API use is present.", "suggestedFix": "Wrap the state change in document.startViewTransition with a no-motion fallback.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "artifacts": [ "evidence/games-state.json" ] }, { "id": "F05", "severity": "medium", "confidence": "high", "summary": "In-page navigation does not preserve or direct attention.", "evidence": "The Games & Casino onclick state hides the main content and reveals a table row without moving focus, updating URL/state, or announcing the new section.", "suggestedFix": "Use a real link/button, update history, move focus to the section heading, and add a directional transition.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "provide-guided-navigation", "principleCheckId": "directs-attention", "guidanceId": "directional-navigation-transitions", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-dom.json", "evidence/games-state.json" ] }, { "id": "F06", "severity": "medium", "confidence": "high", "summary": "Navigation and overlays use ad-hoc scripting and popup windows.", "evidence": "DOM shows onclick div navigation and PopupCenter window calls, with zero dialog, popover, or details elements.", "suggestedFix": "Replace popup-window and clickable-div UI with semantic links/buttons and dialog/popover primitives where overlays are needed.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-dom.json", "evidence/platform-probe.json" ] }, { "id": "F07", "severity": "critical", "confidence": "high", "summary": "The mobile page is a scaled desktop canvas.", "evidence": "At a requested 360x800 viewport Chrome reports no viewport meta and a 980 CSS-pixel layout scaled to 0.367; the screenshot renders login controls and text extremely small.", "suggestedFix": "Add a standard viewport meta tag and rebuild the 975px table layout with fluid, intrinsic responsive CSS.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "guidanceId": "fluid-scaling", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/home-mobile.png" ] }, { "id": "F08", "severity": "high", "confidence": "high", "summary": "Components are fixed-width and cannot adapt to their containers.", "evidence": "Rendered HTML uses a 975px table, 734px/233px columns, and many pixel widths; no container-query behavior was observed.", "suggestedFix": "Replace table layout with flexible components and use container queries where modules are reused.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-dom.json", "evidence/home-mobile.png" ] }, { "id": "F09", "severity": "high", "confidence": "high", "summary": "Primary controls are too small for touch.", "evidence": "The active controls measure only 20-22 CSS px high, including language, username, password, and Login.", "suggestedFix": "Provide at least 44x44 CSS-pixel touch targets, preserve visible focus, and avoid hover-only/clickable-div actions.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/platform-probe.json" ] }, { "id": "F10", "severity": "high", "confidence": "high", "summary": "The primary login flow does not expose a usable failure path.", "evidence": "Submitting test credentials navigated the inspected target away; the captured post-submit visual showed no inline validation or recovery affordance.", "suggestedFix": "Use a semantic form submit and return an explicit, persistent, accessible error without losing page context.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "support-core-task-success", "principleCheckId": "primary-flow-completion", "guidanceId": "forms", "guidanceCategory": "forms", "artifacts": [ "evidence/login-invalid.png" ] }, { "id": "F11", "severity": "high", "confidence": "high", "summary": "Error and recovery states are missing.", "evidence": "Invalid login produced no visible error in the captured state, and a missing route returned HTTP 403 with a blank-looking page.", "suggestedFix": "Provide actionable inline errors, retry/help links, and branded 404/network failure pages with preserved navigation.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "guidanceCategory": "accessibility", "artifacts": [ "evidence/login-invalid.png", "evidence/404.png", "evidence/404-status.txt" ] }, { "id": "F12", "severity": "high", "confidence": "high", "summary": "Throttled loading performance misses the Core Web Vitals bar.", "evidence": "Lighthouse scored performance 0.54 with LCP 34.5s, TBT 310ms, and Speed Index 5.7s; the first-party trace measured LCP 1.78s without throttling.", "suggestedFix": "Prioritize the LCP image, eliminate blocking chains, and verify under mobile throttling.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ] }, { "id": "F13", "severity": "medium", "confidence": "high", "summary": "Shipped scripting creates avoidable blocking under throttling.", "evidence": "Lighthouse measured 310ms TBT although the unthrottled trace saw no >50ms long task, indicating device/network sensitivity.", "suggestedFix": "Remove unused libraries and defer or split non-critical work.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "guidanceCategory": "performance", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ] }, { "id": "F14", "severity": "high", "confidence": "high", "summary": "Five synchronous head scripts block parsing.", "evidence": "HAR and DOM confirm jQuery, Popper, Bootstrap, bjqs and default.js are parser-inserted in without async, defer, or module semantics.", "suggestedFix": "Remove unnecessary dependencies and defer the remaining scripts; keep only critical CSS in the initial path.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "performance", "artifacts": [ "evidence/home-summary.json", "evidence/runtime-metrics.json" ] }, { "id": "F15", "severity": "high", "confidence": "high", "summary": "The page ships substantial unused JS and CSS.", "evidence": "Lighthouse estimates 345 KiB unused JavaScript and 51 KiB unused CSS; the HAR transfers 219,215 third-party bytes.", "suggestedFix": "Audit Bootstrap/jQuery/Popper usage, remove dead code, and load only the minimal component code required.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ] }, { "id": "F16", "severity": "critical", "confidence": "high", "summary": "Core content and controls lack accessible names.", "evidence": "axe found critical unnamed language select and image input, unnamed carousel controls, and the image audit found all 11 images missing alt text.", "suggestedFix": "Add programmatic labels/names, meaningful alt text, and semantic controls.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/axe.json", "evidence/images.json" ] }, { "id": "F17", "severity": "high", "confidence": "high", "summary": "Login placeholder text fails WCAG AA contrast.", "evidence": "axe measured 3.49:1 for the 11px username and password placeholders against white, below 4.5:1.", "suggestedFix": "Increase foreground contrast and do not use placeholder text as the only label.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/axe.json" ] }, { "id": "F18", "severity": "high", "confidence": "high", "summary": "The document has no semantic structure and forces positive tabindex.", "evidence": "axe found no main landmark, no h1, content outside landmarks, and tabindex values 1 and 3; the probe found no headings or landmarks.", "suggestedFix": "Introduce header/nav/main/footer and a logical heading hierarchy; use DOM order with tabindex=0 only.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/axe.json", "evidence/platform-probe.json" ] }, { "id": "F19", "severity": "high", "confidence": "high", "summary": "Text is too small after mobile down-scaling.", "evidence": "The 980px desktop layout is scaled to 36.7% on a 360px device, making 11-14px desktop text effectively tiny and difficult to read.", "suggestedFix": "Use responsive typography and fluid layout without page-scale shrinkage.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-inclusive", "principleCheckId": "legible-text", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ] }, { "id": "F20", "severity": "critical", "confidence": "high", "summary": "The page fails mobile reflow and target sizing.", "evidence": "No viewport meta is present, controls are 20-22px high, and the mobile screenshot is a miniature desktop page.", "suggestedFix": "Allow normal user scaling, add viewport meta, reflow at 320 CSS px, and enlarge targets.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/platform-probe.json" ] }, { "id": "F21", "severity": "medium", "confidence": "high", "summary": "Document assets use brittle, legacy patterns.", "evidence": "Images audit found 6 missing dimensions, all 11 in legacy PNG/JPG, 7 without responsive sources, and 5 below-fold images eagerly loaded; DOM is table-based.", "suggestedFix": "Set intrinsic dimensions, responsive sources and modern formats, and use semantic CSS layout.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/images.json", "evidence/home-dom.json" ] }, { "id": "F22", "severity": "medium", "confidence": "high", "summary": "Deprecated and stale platform patterns remain.", "evidence": "DOM includes deprecated , javascript: links, popup windows, inline handlers, jQuery 3.4.1 and Bootstrap 4.3.1.", "suggestedFix": "Remove deprecated elements/javascript URLs and update or replace legacy dependencies with platform primitives.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/home-dom.json", "evidence/runtime-metrics.json" ] }, { "id": "F23", "severity": "high", "confidence": "high", "summary": "Metadata language does not match the visible English variant.", "evidence": "The EN-US route has Thai title/description while the visible navigation and selected language are English.", "suggestedFix": "Provide unique localized title and description matching each route language.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/home-recon.json" ] }, { "id": "F24", "severity": "high", "confidence": "high", "summary": "Navigation is not crawlable or mobile friendly.", "evidence": "Lighthouse crawlable-anchors failed; primary actions use javascript: and onclick divs, and viewport meta is absent.", "suggestedFix": "Use descriptive real href links and add a standard viewport declaration.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/lighthouse.json", "evidence/home-dom.json" ] }, { "id": "F25", "severity": "high", "confidence": "high", "summary": "Public indexing signals are contradictory or absent.", "evidence": "The public landing page declares noindex/googlebot noindex, has no canonical, and /sitemap.xml returns the text DIV rather than a sitemap.", "suggestedFix": "Decide the indexing policy; if public, remove accidental noindex, add canonical URLs, and publish a valid sitemap.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/home-recon.json", "evidence/routes.txt" ] }, { "id": "F26", "severity": "medium", "confidence": "high", "summary": "The service has no structured or social metadata.", "evidence": "Probe found zero JSON-LD and zero Open Graph tags despite the page representing a named betting service.", "suggestedFix": "Add accurate Organization/WebSite structured data and Open Graph/Twitter metadata matching visible content.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/platform-probe.json" ] }, { "id": "F27", "severity": "critical", "confidence": "high", "summary": "Session transport defenses are incomplete.", "evidence": "HTTPS is used, but CSP/HSTS/nosniff are absent and ASP.NET_SessionId lacks Secure.", "suggestedFix": "Set Secure, HttpOnly, and appropriate SameSite on session cookies; deploy HSTS, CSP, and nosniff.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "id": "F28", "severity": "high", "confidence": "high", "summary": "Tracking loads before any visible consent or explanation.", "evidence": "Tracker probe found Google Tag Manager and five third-party origins; HAR attributes 219,215 transferred bytes to third parties, with GTM the largest script at 139,430 bytes.", "suggestedFix": "Minimize analytics, gate non-essential tracking on informed consent, and self-host or remove unnecessary dependencies.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json" ] }, { "id": "F29", "severity": "high", "confidence": "high", "summary": "Authentication is password-only and lacks modern assistance.", "evidence": "The only auth fields are username/password; no WebAuthn/passkey surface was found, and autocomplete attributes are empty.", "suggestedFix": "Offer passkey/WebAuthn sign-in and retain properly annotated password fallback.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "guidanceCategory": "passkeys", "artifacts": [ "evidence/platform-probe.json" ] }, { "id": "F30", "severity": "high", "confidence": "high", "summary": "Browser-enforced defensive policies are absent.", "evidence": "Headers probe found no frame protection, Referrer-Policy, Permissions-Policy, CSP, HSTS, or nosniff.", "suggestedFix": "Deploy a restrictive CSP with frame-ancestors, HSTS, nosniff, Referrer-Policy, and least-privilege Permissions-Policy.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "artifacts": [ "evidence/headers.json" ] }, { "id": "F31", "severity": "critical", "confidence": "high", "summary": "Core content disappears for non-JavaScript crawlers.", "evidence": "Discoverability fetch received only 87 bytes of raw HTML with 0% rendered-word coverage; the crawler screenshot is blank while the browser screenshot has the portal.", "suggestedFix": "Return meaningful server-rendered HTML and make links/forms work before JavaScript enhancement.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ] }, { "id": "F32", "severity": "medium", "confidence": "high", "summary": "The app-like login portal has no install or offline support.", "evidence": "Probe found no active service worker and recon found no web app manifest.", "suggestedFix": "Add a manifest and service worker with an honest offline fallback for the shell and recovery guidance.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "guidanceId": "html", "guidanceCategory": "html", "artifacts": [ "evidence/platform-probe.json", "evidence/home-recon.json" ] }, { "id": "F33", "severity": "high", "confidence": "high", "summary": "Failure routes do not provide recovery.", "evidence": "A representative missing route returned HTTP 403 and a blank-looking screenshot with no navigation or retry guidance.", "suggestedFix": "Serve intentional 404/5xx/offline pages with clear status, navigation, and retry/help actions.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "artifacts": [ "evidence/404.png", "evidence/404-status.txt" ] }, { "id": "F34", "severity": "high", "confidence": "high", "summary": "Language variants are not declared correctly.", "evidence": "The page offers 14 language options but has no lang or dir; axe flags html-has-lang.", "suggestedFix": "Set accurate lang and dir per variant and use logical CSS properties for bidirectional layouts.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "guidanceCategory": "built-in-ai", "artifacts": [ "evidence/home-dom.json", "evidence/axe.json" ] }, { "id": "F35", "severity": "medium", "confidence": "high", "summary": "Date/time output is hard-coded rather than locale-aware.", "evidence": "Inline code constructs serverTime from a locale-fragile string and renders a fixed DD-MM-YYYY time format on all variants.", "suggestedFix": "Store an unambiguous timestamp and format with Intl.DateTimeFormat for the selected locale.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-internationalised", "principleCheckId": "locale-aware-data", "guidanceId": "capture-location-agnostic-data", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-dom.json" ] }, { "id": "F36", "severity": "medium", "confidence": "high", "summary": "The displayed time assumes GMT+8 for every user.", "evidence": "The header explicitly displays GMT+8 and the script seeds a naive Date without an offset, so interpretation varies by browser time zone.", "suggestedFix": "Use ISO timestamps with offsets and render the user-selected or local zone with Intl.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-internationalised", "principleCheckId": "time-zone-correctness", "guidanceId": "coordinate-global-events", "guidanceCategory": "user-experience", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dom.json" ] }, { "id": "F37", "severity": "high", "confidence": "high", "summary": "Login errors are not handled humanely.", "evidence": "The invalid-login capture contains no visible inline error, field state, help, or accessible announcement.", "suggestedFix": "Validate after submission and show a concise persistent error linked to the relevant fields and an aria-live summary.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "accessible-error-announcement", "guidanceCategory": "accessibility", "artifacts": [ "evidence/login-invalid.png" ] }, { "id": "F38", "severity": "high", "confidence": "high", "summary": "Sign-in fields omit autocomplete semantics.", "evidence": "The username and password inputs have empty autocomplete values and no labels.", "suggestedFix": "Add visible labels and autocomplete=\"username\" / \"current-password\"; support password managers and passkeys.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "guidanceCategory": "forms", "artifacts": [ "evidence/platform-probe.json" ] }, { "id": "F39", "severity": "medium", "confidence": "high", "summary": "The account entry flow lacks recovery and safer authentication cues.", "evidence": "The login view exposes only username, password, and Login: no password recovery/help route, passkey option, or visible security guidance.", "suggestedFix": "Add findable account recovery/help and phishing-resistant sign-in while keeping commitments and account actions clear.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-trustworthy", "principleCheckId": "safe-commercial-and-account-flows", "guidanceId": "passkey-authentication", "guidanceCategory": "passkeys", "artifacts": [ "evidence/home-desktop.png", "evidence/platform-probe.json" ] }, { "id": "F40", "severity": "high", "confidence": "high", "summary": "Images are eagerly delivered in legacy formats.", "evidence": "All 11 images are JPG/PNG, 7 lack responsive sources, 5 below-fold images are not lazy, and all five carousel banners load up front.", "suggestedFix": "Convert suitable assets to AVIF/WebP, add srcset/sizes, dimensions, and lazy-load non-current/below-fold images.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "artifacts": [ "evidence/images.json", "evidence/home-summary.json" ] }, { "id": "F41", "severity": "medium", "confidence": "high", "summary": "The idle page performs avoidable continuous work.", "evidence": "Inline code starts a one-second setInterval for the clock, while Bootstrap auto-runs the carousel; hidden slides and legacy libraries are loaded immediately.", "suggestedFix": "Avoid continuous timers where possible, pause work when hidden/reduced-motion, and conditionally load interactive code.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "efficient-background-processing", "guidanceCategory": "performance", "artifacts": [ "evidence/home-dom.json", "evidence/reduced-motion.json" ] }, { "id": "F42", "severity": "high", "confidence": "high", "summary": "Third-party and decorative media cost is disproportionate to the simple portal.", "evidence": "HAR transfers 880,688 bytes: 634,658 image bytes and 219,215 third-party bytes; GTM alone is 139,430 bytes.", "suggestedFix": "Set a page-weight budget, remove unused third parties, and defer non-current carousel/decorative media.", "effort": "medium", "pathId": "home", "url": "https://ufgrowfun.com", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "performance", "artifacts": [ "evidence/home-summary.json" ] } ], "taskList": [ { "id": "T01", "title": "Rebuild the fixed 975px table page as a responsive, semantic layout", "priority": 1, "findingIds": [ "F07", "F08", "F09", "F18", "F19", "F20" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T02", "title": "Fix accessible names, labels, landmarks, focus order, contrast and image alternatives", "priority": 2, "findingIds": [ "F03", "F16", "F17", "F18" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T03", "title": "Harden session transport, cookies and browser security policies", "priority": 3, "findingIds": [ "F27", "F30" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Make login validation and failure recovery explicit and accessible", "priority": 4, "findingIds": [ "F10", "F11", "F33", "F37", "F39" ], "guidanceId": "accessible-error-announcement", "status": "open" }, { "id": "T05", "title": "Remove parser-blocking legacy dependencies and unused code", "priority": 5, "findingIds": [ "F12", "F13", "F14", "F15", "F22" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T06", "title": "Serve crawlable, progressively enhanced HTML with coherent indexing metadata", "priority": 6, "findingIds": [ "F23", "F24", "F25", "F26", "F31" ], "guidanceId": "html", "status": "open" }, { "id": "T07", "title": "Add proper locale, direction, Intl formatting and timezone handling", "priority": 7, "findingIds": [ "F34", "F35", "F36" ], "guidanceId": "translator", "status": "open" }, { "id": "T08", "title": "Optimize and defer images, carousel motion and third-party resources", "priority": 8, "findingIds": [ "F02", "F28", "F40", "F41", "F42" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T09", "title": "Modernize navigation and state transitions with semantic controls", "priority": 9, "findingIds": [ "F04", "F05", "F06" ], "guidanceId": "same-document-transitions", "status": "open" }, { "id": "T10", "title": "Adopt preference-aware theming and stronger contrast behavior", "priority": 10, "findingIds": [ "F01", "F03" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T11", "title": "Add passkey-capable, autofill-friendly authentication", "priority": 11, "findingIds": [ "F29", "F38", "F39" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T12", "title": "Add an offline/install fallback appropriate to the portal", "priority": 12, "findingIds": [ "F32" ], "guidanceId": "html", "status": "open" } ], "budget": { "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-18T04-35-22-231Z" }