{ "url": "https://m.klikbca.com", "auditedAt": "2026-07-27T13:34:36.823Z", "mode": "report", "status": "partial", "statusDetail": "Public login audited; 3 checks requiring authenticated banking/account access are blocked by the credential boundary.", "page": { "appType": "mpa", "framework": "legacy server-rendered JSP/HTML with JavaScript redirects", "notes": "The m. entry redirects to login.jsp and, in some browser runs, onward to fixed-width ibank.klikbca.com. Only the public authentication surface was safe to exercise." }, "evidenceUsed": [ "screenshot", "layout-metrics", "evaluate-probe", "raw HTML/CSS", "trace", "HAR", "discoverability", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "axe-core", "Lighthouse", "custom raw-CDP Runtime/Log probe" ], "guidanceConsulted": [ "accessibility", "accessible-error-announcement", "language-detection", "language-model", "summarizer", "translator", "css", "highlight-text-ranges", "css-layout", "animated-select-picker", "autofill-address-form", "autofill-highlight-inputs", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "brand-consistent-forms", "branded-select-styling", "custom-select-picker-layouts", "form-fields-automatically-fit-contents", "forms", "required-field-feedback", "rich-media-picker", "select-menu-interaction", "validate-input-after-interaction", "html", "passkey-authentication", "passkey-conditional-create", "passkey-management", "passkey-reauthentication", "passkey-registration", "passkeys", "batch-analytics-events", "break-up-long-tasks", "calculate-total-foreground-time", "conditional-async-dependencies", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "deprioritize-background-fetches", "detect-initial-visibility-state", "efficient-background-processing", "faster-spa-view-transitions", "full-session-analytics", "identify-heavy-scripts", "identify-inp-causes", "improve-next-page-load-performance", "interactions-in-complex-layouts", "optimize-image-priority", "optimize-preload-priority", "optimize-script-priority", "performance", "resolution-optimized-pseudo-elements", "schedule-tasks-by-priority", "sequence-distributed-events", "privacy", "security", "adapt-scrollbar-to-contrast-preferences", "anchor-positioning-tab-underline", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "apply-webgl-shaders", "calculate-event-differentials", "calculate-with-intrinsic-sizes", "capture-location-agnostic-data", "carousel-slide-effects", "carousel-snap-highlights", "child-state-based-styling", "complex-shapes", "component-specific-light-dark-theme", "consistent-cross-document-transitions", "content-based-styling", "coordinate-global-events", "cross-document-transitions", "customize-scrollbar-color-and-thickness", "dark-mode", "declarative-dialog-popover-control", "deliver-optimized-decorative-images", "design-token-reactivity", "directional-navigation-transitions", "dynamic-sibling-animations", "dynamic-sibling-styling", "export-html-media-from-canvas", "expose-canvas-content-to-browser-features", "flicker-free-client-side-ab-testing", "fluid-scaling", "format-human-readable-durations", "group-element-transitions", "improve-text-layout-and-legibility", "individual-transform-properties", "interactive-content-in-3d-scenes", "interactive-content-reveal", "interest-triggered-action-previews", "interest-triggered-tooltips", "light-dismiss-a-dialog", "manage-recurring-intervals", "model-partial-time-concepts", "move-dom-element-without-losing-state", "navigation-drawer", "overflow-clipping-control", "parallax-scroll-effects", "persistent-app-tours", "persistent-toast-notifications", "persistent-top-layer-ui", "physics-based-easing", "platform-controls-dismiss-dialog", "position-aware-tooltips", "precise-text-alignment", "prevent-text-wrapping", "pull-to-reveal", "reduce-style-repetition", "resilient-context-menus-and-nested-dropdowns", "same-document-transitions", "scroll-entry-exit-effects", "scroll-position-aware-elements", "scroll-progress-indicator", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "scrollability-affordance-hints", "scrollytelling", "search-hidden-content", "shaped-cutouts", "shrinking-header-on-scroll", "size-aware-styling", "soft-edge-content-fade", "stabilize-reactive-state", "stack-drill-down", "style-parent-with-has", "support-global-calendar-systems", "swipe-to-remove", "visually-stable-font-fallbacks", "visually-stable-mixed-fonts", "visually-texture-content", "agentic-forms", "agentic-javascript-tools", "webmcp" ], "artifacts": [ { "type": "other", "path": "evidence/axe.json", "caption": "axe", "findingIds": [ "F-03", "F-14", "F-15", "F-16", "F-29" ] }, { "type": "other", "path": "evidence/cdp-probe.json", "caption": "cdp probe", "findingIds": [ "F-04", "F-09", "F-12", "F-19", "F-20" ] }, { "type": "other", "path": "evidence/cdp-probe.mjs", "caption": "cdp probe", "findingIds": [] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F-24", "F-25" ] }, { "type": "other", "path": "evidence/curl-headers.txt", "caption": "curl headers", "findingIds": [ "F-24", "F-25" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [ "F-26" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [ "F-22", "F-26" ] }, { "type": "other", "path": "evidence/guidance-catalog.json", "caption": "guidance catalog", "findingIds": [] }, { "type": "other", "path": "evidence/guidance-mapped-missing.json", "caption": "guidance mapped missing", "findingIds": [] }, { "type": "other", "path": "evidence/guidance-retrieved.md", "caption": "guidance retrieved", "findingIds": [] }, { "type": "other", "path": "evidence/guidance-searches.jsonl", "caption": "guidance searches", "findingIds": [] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F-24", "F-25" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "heap baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post-carousel.json", "caption": "heap post carousel", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-dark-reduced.png", "caption": "home dark reduced", "condition": "360x800; prefers-color-scheme: dark; prefers-reduced-motion: reduce", "findingIds": [ "F-01", "F-02", "F-07", "F-08", "F-17" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "condition": "viewport 360x800", "findingIds": [ "F-07", "F-27" ] }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F-14", "F-19", "F-32" ] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "layout mobile", "condition": "viewport 360x800", "findingIds": [ "F-08", "F-18" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse", "findingIds": [ "F-11", "F-13", "F-18", "F-21" ] }, { "type": "trace-summary", "path": "evidence/load-trace-summary.json", "caption": "load trace summary", "findingIds": [ "F-11" ] }, { "type": "dom", "path": "evidence/login-raw.html", "caption": "login raw", "findingIds": [ "F-02", "F-05", "F-06", "F-09", "F-10", "F-20", "F-22", "F-27", "F-30" ] }, { "type": "other", "path": "evidence/network-summary.json", "caption": "network summary", "findingIds": [ "F-12", "F-13", "F-33", "F-34" ] }, { "type": "har", "path": "evidence/network.har", "caption": "network", "findingIds": [ "F-12", "F-33" ] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots", "findingIds": [ "F-22", "F-23", "F-28" ] }, { "type": "dom", "path": "evidence/root-raw.html", "caption": "root raw", "findingIds": [ "F-04", "F-22", "F-26" ] }, { "type": "other", "path": "evidence/runtime-probe.json", "caption": "runtime probe", "findingIds": [ "F-05", "F-06", "F-16", "F-21", "F-27", "F-31" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "sitemap", "findingIds": [ "F-23", "F-28" ] }, { "type": "other", "path": "evidence/static-probe.json", "caption": "static probe", "findingIds": [ "F-01", "F-02", "F-09", "F-21", "F-23", "F-29", "F-31" ] }, { "type": "dom", "path": "evidence/style.css", "caption": "style", "findingIds": [ "F-03", "F-17" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [] }, { "type": "trace", "path": "evidence/load-trace.json", "caption": "DevTools performance trace", "findingIds": [ "F-11", "F-12" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 55, "blocked": 3, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": false }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Emulated screenshot plus stylesheet probe", "evidence": "Dark/reduced screenshot remains a hard-coded white, blue and yellow surface; style.css has no prefers-color-scheme rule.", "findingIds": [ "F-01" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/home-dark-reduced.png", "evidence/static-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Reduced-motion emulation plus authored HTML/CSS inspection", "evidence": "The login contains an auto-advancing eight-image banner, while CSS has no prefers-reduced-motion handling.", "findingIds": [ "F-02" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/home-dark-reduced.png", "evidence/login-raw.html", "evidence/static-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "axe-core contrast audit plus CSS inspection", "evidence": "Axe measured contrast as low as 2.09:1 and no prefers-contrast/forced-colors adaptation exists.", "findingIds": [ "F-03" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/axe.json", "evidence/style.css" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "CDP CSS/runtime probe and route observation", "evidence": "The entry performs JavaScript document redirects and the carousel swaps state; CDP found no view-transition CSS.", "findingIds": [ "F-04" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/cdp-probe.json", "evidence/root-raw.html" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "No scroll-linked animation, parallax, reveal or scrollytelling surface exists on the public login page.", "reason": "No scroll-linked animation, parallax, reveal or scrollytelling surface exists on the public login page.", "pathIds": [ "public-entry" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "issues", "confidence": "high", "method": "Rendered control probe plus authored HTML inspection", "evidence": "Carousel navigation is hand-wired to onclick anchors without href; no scroll-snap or native gesture semantics were found.", "findingIds": [ "F-05" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/runtime-probe.json", "evidence/login-raw.html" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "The public login is a short, single-screen form with no sticky chrome or meaningful scroll state.", "reason": "The public login is a short, single-screen form with no sticky chrome or meaningful scroll state.", "pathIds": [ "public-entry" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "No tooltip, popover, anchored menu or similar overlay is present on the public login.", "reason": "No tooltip, popover, anchored menu or similar overlay is present on the public login.", "pathIds": [ "public-entry" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "issues", "confidence": "high", "method": "Runtime controls and authored banner markup inspection", "evidence": "Carousel arrows are href-less anchors and image banners are onclick-only, so navigation state and focus movement are not semantically communicated.", "findingIds": [ "F-06" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/runtime-probe.json", "evidence/login-raw.html" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Visual inspection at normal and preference-emulated load", "evidence": "Load screenshots show no consent wall, interstitial or content-obscuring popup.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-dark-reduced.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "pass", "confidence": "high", "method": "Rendered DOM and authored HTML inspection", "evidence": "DOM inspection found no custom modal/popover/disclosure overlay requiring a semantic primitive.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/login-raw.html", "evidence/runtime-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "Mobile screenshots and layout inspection", "evidence": "The viewport is dominated by legacy framed chrome and empty space while the login content is rendered extremely small.", "findingIds": [ "F-07" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-dark-reduced.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "issues", "confidence": "high", "method": "Mobile layout metrics and screenshot", "evidence": "At a 360px viewport the layout primitive reports a 980 CSS-pixel layout viewport and no effective viewport meta; the page is scaled down rather than reflowed.", "findingIds": [ "F-08" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/home-dark-reduced.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "CSS/static and CDP feature probes", "evidence": "CSS has zero media queries and no @container rules; fixed-width tables and absolute positions govern layout.", "findingIds": [ "F-09" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/static-probe.json", "evidence/cdp-probe.json", "evidence/login-raw.html" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "Lighthouse target-size audit plus focused computed style", "evidence": "Lighthouse target-size passed and CDP measured a visible browser focus outline on the first link.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/lighthouse.json", "evidence/cdp-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "First-viewport visual and DOM inspection", "evidence": "The first view clearly asks for User ID and Internet Banking PIN and exposes a LOGIN action.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/home-mobile.png", "evidence/login-raw.html" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "blocked", "confidence": "high", "method": "Attempted public journey recon; stopped at credential boundary", "evidence": "End-to-end banking login and post-authentication tasks require valid customer credentials, which were not available and must not be fabricated.", "reason": "End-to-end banking login and post-authentication tasks require valid customer credentials, which were not available and must not be fabricated.", "pathIds": [ "public-entry" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Authored validation-function inspection", "evidence": "Client validation reports mistakes with blocking alert() calls and has no inline, persistent or programmatically associated recovery text.", "findingIds": [ "F-10" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/login-raw.html" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "DevTools trace summary corroborated with Lighthouse", "evidence": "The entry-url trace measured LCP 3.74s, outside the good 2.5s range, although Lighthouse on the redirected login measured 2.3s.", "findingIds": [ "F-11" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/load-trace-summary.json", "evidence/lighthouse.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Layout-shift observer and Lighthouse", "evidence": "Layout observed CLS 0.0018 and Lighthouse measured CLS 0.025, both within the good range.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/lighthouse.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Trace summary and Lighthouse", "evidence": "Trace observed no long tasks and 0ms TBT; Lighthouse measured 90ms TBT.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/load-trace-summary.json", "evidence/lighthouse.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "HAR summary confirmed against live script attributes", "evidence": "HAR captured 53 requests/1.30MB, parser-blocking classic scripts without async/defer, uncompressed JS up to 329KB, and multiple high-priority styles/scripts.", "findingIds": [ "F-12" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/network-summary.json", "evidence/cdp-probe.json", "evidence/network.har" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Lighthouse unused-code audit and HAR summary", "evidence": "Lighthouse estimates 46KiB unused JavaScript; HAR shows jsencrypt and security scripts loaded across both m. and ibank. redirect documents.", "findingIds": [ "F-13" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/lighthouse.json", "evidence/network-summary.json" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "axe-core and image audit", "evidence": "Axe found both credential inputs unlabelled, 16 image-alt failures and unnamed image links; the image probe found 23/23 rendered images missing alt.", "findingIds": [ "F-14" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/axe.json", "evidence/images.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "axe-core contrast audit", "evidence": "Axe found seven contrast failures, including orange-on-white at 2.09:1.", "findingIds": [ "F-15" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/axe.json" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "axe-core structure audit and runtime controls", "evidence": "Axe found no main landmark or h1 and extensive content outside landmarks; carousel anchors are not real links.", "findingIds": [ "F-16" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/axe.json", "evidence/runtime-probe.json" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "issues", "confidence": "high", "method": "Mobile screenshot and CSS inspection", "evidence": "The 360px screenshot shows the fixed desktop layout scaled to tiny text; CSS includes 9px and 10px text sizes.", "findingIds": [ "F-17" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/home-dark-reduced.png", "evidence/style.css" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Lighthouse meta-viewport audit and mobile layout", "evidence": "Lighthouse fails meta-viewport because maximum-scale is below 5; the layout does not reflow at 360px.", "findingIds": [ "F-18" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/lighthouse.json", "evidence/layout-mobile.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Lighthouse and CDP Runtime/Log capture", "evidence": "Lighthouse reports no browser console errors; CDP recorded no uncaught exceptions.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/lighthouse.json", "evidence/cdp-probe.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "CDP document probe and image audit", "evidence": "The journey reaches a document with no parsed doctype and windows-1252, while the image audit reports 10 missing dimensions and one oversized image.", "findingIds": [ "F-19" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/cdp-probe.json", "evidence/images.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "CDP Log capture and DOM/source inspection", "evidence": "CDP logs malformed viewport-meta parsing and a password field outside a form; multiple actions use javascript: URLs.", "findingIds": [ "F-20" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/cdp-probe.json", "evidence/login-raw.html" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Static and rendered metadata inspection", "evidence": "The title is generic and both raw/rendered probes find no meta description.", "findingIds": [ "F-21" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/static-probe.json", "evidence/runtime-probe.json", "evidence/lighthouse.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Raw HTML, Lighthouse and robots fetch", "evidence": "The raw entry depends on JavaScript redirect, Full Site/Privacy actions use javascript: URLs, and robots.txt returns a branded 404 page.", "findingIds": [ "F-22" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/root-raw.html", "evidence/login-raw.html", "evidence/robots.txt", "evidence/discoverability.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Static metadata and direct robots/sitemap fetch", "evidence": "No canonical is present and both robots.txt and sitemap.xml return 404 content; no consistent indexing signals were found.", "findingIds": [ "F-23" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/static-probe.json", "evidence/robots.txt", "evidence/sitemap.xml" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "The public surface is a credential login, not an article, product, event or other rich entity that warrants schema.org or social-preview metadata.", "reason": "The public surface is a credential login, not an article, product, event or other rich entity that warrants schema.org or social-preview metadata.", "pathIds": [ "public-entry" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct response-header capture plus cookie audit", "evidence": "HTTPS, HSTS, nosniff and SAMEORIGIN are present on m. responses, but CSP, Referrer-Policy and Permissions-Policy are absent; one 400-day cookie is not Secure.", "findingIds": [ "F-24" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/curl-headers.txt", "evidence/headers.json", "evidence/cookies.json" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "high", "method": "Tracker and HAR origin inspection", "evidence": "Tracker scan found no known analytics trackers; network origins are limited to m.klikbca.com and the same-organisation ibank.klikbca.com.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/trackers.json", "evidence/network-summary.json" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "blocked", "confidence": "high", "method": "CDP load probe and authenticated-flow boundary", "evidence": "No permission prompt occurs on load, but the authentication methods available after the credential boundary (including passkey support) cannot be inspected without an account.", "reason": "No permission prompt occurs on load, but the authentication methods available after the credential boundary (including passkey support) cannot be inspected without an account.", "pathIds": [ "public-entry" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Header and cookie audits", "evidence": "Clickjacking and HSTS defenses exist, but CSP/frame-ancestors, Referrer-Policy and Permissions-Policy are absent and all cookies report SameSite=None.", "findingIds": [ "F-25" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/headers.json", "evidence/curl-headers.txt", "evidence/cookies.json" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "No-JS/raw discoverability comparison", "evidence": "Discoverability measured only 2% raw/rendered content overlap and isJsShell=true; without JS the page only says JavaScript is required.", "findingIds": [ "F-26" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/root-raw.html" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "issues", "confidence": "high", "method": "Repeated rendered navigation plus DOM/static inspection", "evidence": "The same entry journey inconsistently transitions from m. login to fixed-width ibank desktop UI, and overlays/navigation rely on brittle javascript: handlers and absolute positioning.", "findingIds": [ "F-27" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/home-mobile.png", "evidence/runtime-probe.json", "evidence/login-raw.html" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "Authenticated internet banking is intrinsically online and transaction data must not be presented as operable offline; no installability intent is evident.", "reason": "Authenticated internet banking is intrinsically online and transaction data must not be presented as operable offline; no installability intent is evident.", "pathIds": [ "public-entry" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Direct HTTP failure-state fetch", "evidence": "Representative missing routes (/robots.txt and /sitemap.xml) return a bare legacy 404 with no navigation or recovery action.", "findingIds": [ "F-28" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/robots.txt", "evidence/sitemap.xml" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "axe lang audit plus static CSS/DOM probe", "evidence": "The bilingual Indonesian/English page has no html lang or dir; CSS uses no logical properties.", "findingIds": [ "F-29" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/axe.json", "evidence/static-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "The public login presents no dates, currencies, durations or locale-formatted values to assess.", "reason": "The public login presents no dates, currencies, durations or locale-formatted values to assess.", "pathIds": [ "public-entry" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "The public login presents no event scheduling or time-zone-sensitive data.", "reason": "The public login presents no event scheduling or time-zone-sensitive data.", "pathIds": [ "public-entry" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Visual and authored-copy inspection", "evidence": "Public login copy states its purpose, contains no consent wall, upsell, pricing or forced-continuity choice, and exposes no misleading default.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/home-mobile.png", "evidence/login-raw.html" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Authored validation-function inspection", "evidence": "Validation uses blocking alert() messages, focuses fields manually, and provides no inline aria-live/aria-invalid feedback.", "findingIds": [ "F-30" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/login-raw.html" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Static and rendered input-attribute inspection", "evidence": "Both User ID and password/PIN inputs explicitly set autocomplete=\"off\" instead of appropriate username/current-password tokens.", "findingIds": [ "F-31" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/static-probe.json", "evidence/runtime-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "blocked", "confidence": "high", "method": "Attempted account-flow recon; stopped at credential boundary", "evidence": "Cancellation, transaction confirmation, reauthentication and account-management flows are behind valid customer authentication and could not be exercised safely.", "reason": "Cancellation, transaction confirmation, reauthentication and account-management flows are behind valid customer authentication and could not be exercised safely.", "pathIds": [ "public-entry" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Image audit", "evidence": "Image audit reports 23 legacy GIF/PNG/JPG images, no modern formats, 10 missing dimensions, five missing srcset and one oversized asset.", "findingIds": [ "F-32" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/images.json" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "HAR request and resource breakdown", "evidence": "The login fetches all eight banner images and 12 scripts during the entry journey, including duplicate libraries across redirects.", "findingIds": [ "F-33" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "HAR byte/origin analysis", "evidence": "The lightweight login transfers 1.30MB; 1.19MB is attributed to the ibank subdomain and includes eight promotional banners plus large scripts.", "findingIds": [ "F-34" ], "pathIds": [ "public-entry" ], "artifacts": [ "evidence/network-summary.json" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "A high-sensitivity authenticated banking login has no declared agent-facing surface; exposing transaction tools is not assumed appropriate.", "reason": "A high-sensitivity authenticated banking login has no declared agent-facing surface; exposing transaction tools is not assumed appropriate.", "pathIds": [ "public-entry" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Recon and applicability judgement", "evidence": "The public login has no summarisation, generation or other inference task where built-in on-device AI would improve the experience.", "reason": "The public login has no summarisation, generation or other inference task where built-in on-device AI would improve the experience.", "pathIds": [ "public-entry" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Baseline/post heap comparison after repeated real interaction", "evidence": "After ten carousel-next interactions heap self-size decreased from 8,602,299 to 8,535,825 bytes; node count changed only 132,280 to 132,410.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post-carousel.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Heap summary plus Performance.getMetrics", "evidence": "Baseline heap is 8.6MB with 132,280 nodes; CDP reports 10.6MB JS heap and 498 DOM nodes, proportionate for this page.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/cdp-probe.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Before/after heap constructor and total comparison", "evidence": "Neither heap summary reports Detached* constructors, and repeated carousel interaction produced only 130 additional snapshot nodes with lower total self-size.", "pathIds": [ "public-entry" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post-carousel.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F-01", "F-02", "F-03" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F-04", "F-05" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F-06" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F-07" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F-08", "F-09" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F-10" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F-11", "F-12", "F-13" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F-14", "F-15", "F-16", "F-17", "F-18" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F-19", "F-20" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F-21", "F-22", "F-23" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F-24", "F-25" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F-26", "F-27", "F-28" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F-29" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F-30", "F-31" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F-32", "F-33", "F-34" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "A high-sensitivity authenticated banking login has no declared agent-facing surface; exposing transaction tools is not assumed appropriate. The public login has no summarisation, generation or other inference task where built-in on-device AI would improve the experience." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "public-entry", "description": "Entry redirect and public login archetype; represents the only unauthenticated core surface.", "url": "https://m.klikbca.com", "conditions": [ "360x800", "desktop redirect behavior", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "keyboard focus" ], "result": "issues" }, { "id": "crawler-no-js", "description": "Raw/no-JavaScript entry and crawler-visible content.", "url": "https://m.klikbca.com", "conditions": [ "JavaScript disabled/raw fetch" ], "result": "issues" }, { "id": "invalid-login-state", "description": "Credential form markup and client validation/error recovery, without submitting credentials.", "url": "https://m.klikbca.com/login.jsp", "conditions": [ "empty/invalid input source path" ], "result": "issues" }, { "id": "carousel-repeat", "description": "Repeated public carousel interaction for memory retention.", "url": "https://m.klikbca.com", "conditions": [ "10 next-slide actions" ], "result": "pass" }, { "id": "authenticated-banking", "description": "Post-login transaction, account, reauthentication and completion paths; not covered because valid customer credentials were unavailable.", "url": "https://m.klikbca.com", "conditions": [ "authentication required" ], "result": "skipped" } ], "findings": [ { "id": "F-01", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "severity": "high", "confidence": "high", "summary": "Dark mode is not supported", "evidence": "Dark/reduced screenshot remains a hard-coded white, blue and yellow surface; style.css has no prefers-color-scheme rule.", "artifacts": [ "evidence/home-dark-reduced.png", "evidence/static-probe.json" ], "suggestedFix": "Add color-scheme and a prefers-color-scheme/light-dark() token palette.", "effort": "medium" }, { "id": "F-02", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "severity": "medium", "confidence": "high", "summary": "Reduced-motion preference is ignored", "evidence": "The login contains an auto-advancing eight-image banner, while CSS has no prefers-reduced-motion handling.", "artifacts": [ "evidence/home-dark-reduced.png", "evidence/login-raw.html", "evidence/static-probe.json" ], "suggestedFix": "Pause auto-advance and disable non-essential transitions under prefers-reduced-motion: reduce.", "effort": "small" }, { "id": "F-03", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "Text contrast fails WCAG AA", "evidence": "Axe measured contrast as low as 2.09:1 and no prefers-contrast/forced-colors adaptation exists.", "artifacts": [ "evidence/axe.json", "evidence/style.css" ], "suggestedFix": "Replace low-contrast orange/white and white/blue pairs and verify forced-colors.", "effort": "medium" }, { "id": "F-04", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "severity": "low", "confidence": "high", "summary": "State changes do not use view transitions", "evidence": "The entry performs JavaScript document redirects and the carousel swaps state; CDP found no view-transition CSS.", "artifacts": [ "evidence/cdp-probe.json", "evidence/root-raw.html" ], "suggestedFix": "Progressively enhance route and carousel state swaps with View Transitions while preserving reduced motion.", "effort": "small" }, { "id": "F-05", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "implement-natural-interactions", "principleCheckId": "physical-gestures", "guidanceId": "carousel-slide-effects", "severity": "medium", "confidence": "high", "summary": "Carousel controls fight platform semantics", "evidence": "Carousel navigation is hand-wired to onclick anchors without href; no scroll-snap or native gesture semantics were found.", "artifacts": [ "evidence/runtime-probe.json", "evidence/login-raw.html" ], "suggestedFix": "Use buttons or scroll-snap carousel controls with keyboard, touch and accessible state.", "effort": "small" }, { "id": "F-06", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "provide-guided-navigation", "principleCheckId": "directs-attention", "guidanceId": "carousel-snap-highlights", "severity": "medium", "confidence": "high", "summary": "Navigation state is not communicated", "evidence": "Carousel arrows are href-less anchors and image banners are onclick-only, so navigation state and focus movement are not semantically communicated.", "artifacts": [ "evidence/runtime-probe.json", "evidence/login-raw.html" ], "suggestedFix": "Use semantic controls and announce/highlight the active carousel item and destination.", "effort": "small" }, { "id": "F-07", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "improve-text-layout-and-legibility", "severity": "high", "confidence": "high", "summary": "Legacy chrome overwhelms the login", "evidence": "The viewport is dominated by legacy framed chrome and empty space while the login content is rendered extremely small.", "artifacts": [ "evidence/home-mobile.png", "evidence/home-dark-reduced.png" ], "suggestedFix": "Replace framed tables and decorative chrome with a focused, content-first login card.", "effort": "medium" }, { "id": "F-08", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "adapt-to-the-form-factor", "principleCheckId": "responsive-no-horizontal-scroll", "guidanceId": "fluid-scaling", "severity": "critical", "confidence": "high", "summary": "Mobile layout is a scaled desktop canvas", "evidence": "At a 360px viewport the layout primitive reports a 980 CSS-pixel layout viewport and no effective viewport meta; the page is scaled down rather than reflowed.", "artifacts": [ "evidence/layout-mobile.json", "evidence/home-dark-reduced.png" ], "suggestedFix": "Use a valid viewport meta and fluid intrinsic layout that reflows at narrow widths.", "effort": "large" }, { "id": "F-09", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "severity": "high", "confidence": "high", "summary": "Components cannot adapt to available space", "evidence": "CSS has zero media queries and no @container rules; fixed-width tables and absolute positions govern layout.", "artifacts": [ "evidence/static-probe.json", "evidence/cdp-probe.json", "evidence/login-raw.html" ], "suggestedFix": "Remove fixed table widths/absolute positions and adopt intrinsic/container-responsive components.", "effort": "medium" }, { "id": "F-10", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "severity": "high", "confidence": "high", "summary": "Validation offers weak recovery", "evidence": "Client validation reports mistakes with blocking alert() calls and has no inline, persistent or programmatically associated recovery text.", "artifacts": [ "evidence/login-raw.html" ], "suggestedFix": "Render inline actionable status with retry guidance and preserved context.", "effort": "medium" }, { "id": "F-11", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "severity": "medium", "confidence": "high", "summary": "Entry LCP is slow across redirects", "evidence": "The entry-url trace measured LCP 3.74s, outside the good 2.5s range, although Lighthouse on the redirected login measured 2.3s.", "artifacts": [ "evidence/load-trace-summary.json", "evidence/lighthouse.json" ], "suggestedFix": "Remove redirect work, prioritise the actual LCP and serve the correct login document directly.", "effort": "small" }, { "id": "F-12", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "severity": "high", "confidence": "high", "summary": "Resource delivery is inefficient", "evidence": "HAR captured 53 requests/1.30MB, parser-blocking classic scripts without async/defer, uncompressed JS up to 329KB, and multiple high-priority styles/scripts.", "artifacts": [ "evidence/network-summary.json", "evidence/cdp-probe.json", "evidence/network.har" ], "suggestedFix": "Compress scripts, defer noncritical classic JS, avoid duplicate redirect loads and trim blocking chains.", "effort": "medium" }, { "id": "F-13", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "severity": "medium", "confidence": "high", "summary": "Unused and duplicate JavaScript ships on login", "evidence": "Lighthouse estimates 46KiB unused JavaScript; HAR shows jsencrypt and security scripts loaded across both m. and ibank. redirect documents.", "artifacts": [ "evidence/lighthouse.json", "evidence/network-summary.json" ], "suggestedFix": "Remove unused code and load crypto/security dependencies once, only when needed.", "effort": "small" }, { "id": "F-14", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "severity": "critical", "confidence": "high", "summary": "Credential fields and images lack accessible names", "evidence": "Axe found both credential inputs unlabelled, 16 image-alt failures and unnamed image links; the image probe found 23/23 rendered images missing alt.", "artifacts": [ "evidence/axe.json", "evidence/images.json" ], "suggestedFix": "Associate labels with both fields and add meaningful alt or empty alt for decoration.", "effort": "large" }, { "id": "F-15", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "Essential text has insufficient contrast", "evidence": "Axe found seven contrast failures, including orange-on-white at 2.09:1.", "artifacts": [ "evidence/axe.json" ], "suggestedFix": "Adopt tested contrast-safe design tokens meeting at least WCAG AA.", "effort": "medium" }, { "id": "F-16", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "severity": "high", "confidence": "high", "summary": "Document landmarks and heading structure are missing", "evidence": "Axe found no main landmark or h1 and extensive content outside landmarks; carousel anchors are not real links.", "artifacts": [ "evidence/axe.json", "evidence/runtime-probe.json" ], "suggestedFix": "Use header/main/footer landmarks, a descriptive h1 and semantic carousel buttons.", "effort": "medium" }, { "id": "F-17", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-inclusive", "principleCheckId": "legible-text", "guidanceId": "improve-text-layout-and-legibility", "severity": "high", "confidence": "high", "summary": "Text is too small to read comfortably", "evidence": "The 360px screenshot shows the fixed desktop layout scaled to tiny text; CSS includes 9px and 10px text sizes.", "artifacts": [ "evidence/home-dark-reduced.png", "evidence/style.css" ], "suggestedFix": "Use responsive rem-based typography and remove the scaled fixed-width canvas.", "effort": "medium" }, { "id": "F-18", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "severity": "critical", "confidence": "high", "summary": "Viewport prevents zoom and reflow", "evidence": "Lighthouse fails meta-viewport because maximum-scale is below 5; the layout does not reflow at 360px.", "artifacts": [ "evidence/lighthouse.json", "evidence/layout-mobile.json" ], "suggestedFix": "Remove maximum-scale restrictions and support 320px reflow and user zoom.", "effort": "large" }, { "id": "F-19", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "Document and image foundations are unsound", "evidence": "The journey reaches a document with no parsed doctype and windows-1252, while the image audit reports 10 missing dimensions and one oversized image.", "artifacts": [ "evidence/cdp-probe.json", "evidence/images.json" ], "suggestedFix": "Serve standards-mode UTF-8 HTML and reserve correct image dimensions.", "effort": "small" }, { "id": "F-20", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "Browser platform hygiene warnings remain", "evidence": "CDP logs malformed viewport-meta parsing and a password field outside a form; multiple actions use javascript: URLs.", "artifacts": [ "evidence/cdp-probe.json", "evidence/login-raw.html" ], "suggestedFix": "Fix viewport syntax, place password fields in the form and replace javascript: links.", "effort": "small" }, { "id": "F-21", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "Search metadata is incomplete", "evidence": "The title is generic and both raw/rendered probes find no meta description.", "artifacts": [ "evidence/static-probe.json", "evidence/runtime-probe.json", "evidence/lighthouse.json" ], "suggestedFix": "Use a specific login title and concise meta description.", "effort": "small" }, { "id": "F-22", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "severity": "high", "confidence": "high", "summary": "Entry and links depend on JavaScript", "evidence": "The raw entry depends on JavaScript redirect, Full Site/Privacy actions use javascript: URLs, and robots.txt returns a branded 404 page.", "artifacts": [ "evidence/root-raw.html", "evidence/login-raw.html", "evidence/robots.txt", "evidence/discoverability.json" ], "suggestedFix": "Serve the login directly and use real href/action URLs with a valid robots.txt.", "effort": "medium" }, { "id": "F-23", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "severity": "medium", "confidence": "high", "summary": "Canonical and indexing signals are absent", "evidence": "No canonical is present and both robots.txt and sitemap.xml return 404 content; no consistent indexing signals were found.", "artifacts": [ "evidence/static-probe.json", "evidence/robots.txt", "evidence/sitemap.xml" ], "suggestedFix": "Add a canonical and intentional robots/sitemap policy for the public login.", "effort": "small" }, { "id": "F-24", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "severity": "high", "confidence": "high", "summary": "Security policy and cookie gaps remain", "evidence": "HTTPS, HSTS, nosniff and SAMEORIGIN are present on m. responses, but CSP, Referrer-Policy and Permissions-Policy are absent; one 400-day cookie is not Secure.", "artifacts": [ "evidence/curl-headers.txt", "evidence/headers.json", "evidence/cookies.json" ], "suggestedFix": "Add a strict CSP and policy headers; make every cookie Secure with an appropriate SameSite value.", "effort": "medium" }, { "id": "F-25", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "severity": "high", "confidence": "high", "summary": "Defensive browser policies are incomplete", "evidence": "Clickjacking and HSTS defenses exist, but CSP/frame-ancestors, Referrer-Policy and Permissions-Policy are absent and all cookies report SameSite=None.", "artifacts": [ "evidence/headers.json", "evidence/curl-headers.txt", "evidence/cookies.json" ], "suggestedFix": "Deploy CSP frame-ancestors/Trusted Types as appropriate plus Referrer- and Permissions-Policy.", "effort": "medium" }, { "id": "F-26", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "stabilize-reactive-state", "severity": "critical", "confidence": "high", "summary": "Core entry is unavailable without JavaScript", "evidence": "Discoverability measured only 2% raw/rendered content overlap and isJsShell=true; without JS the page only says JavaScript is required.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/root-raw.html" ], "suggestedFix": "Return useful login content and a real navigation target in server HTML, then enhance with JS.", "effort": "large" }, { "id": "F-27", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-resilient", "principleCheckId": "resilient-runtime-behaviour", "guidanceId": "conditional-async-dependencies", "severity": "high", "confidence": "high", "summary": "Runtime routing is brittle and form-factor dependent", "evidence": "The same entry journey inconsistently transitions from m. login to fixed-width ibank desktop UI, and overlays/navigation rely on brittle javascript: handlers and absolute positioning.", "artifacts": [ "evidence/home-mobile.png", "evidence/runtime-probe.json", "evidence/login-raw.html" ], "suggestedFix": "Eliminate chained UA/JS redirects and serve one resilient responsive login.", "effort": "medium" }, { "id": "F-28", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "severity": "medium", "confidence": "high", "summary": "HTTP failure pages offer no recovery", "evidence": "Representative missing routes (/robots.txt and /sitemap.xml) return a bare legacy 404 with no navigation or recovery action.", "artifacts": [ "evidence/robots.txt", "evidence/sitemap.xml" ], "suggestedFix": "Provide branded 404/timeout/offline states with retry and home/login actions.", "effort": "small" }, { "id": "F-29", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "severity": "high", "confidence": "high", "summary": "Bilingual content has no language metadata", "evidence": "The bilingual Indonesian/English page has no html lang or dir; CSS uses no logical properties.", "artifacts": [ "evidence/axe.json", "evidence/static-probe.json" ], "suggestedFix": "Set document and phrase-level lang, dir support, and logical CSS properties.", "effort": "medium" }, { "id": "F-30", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "validate-input-after-interaction", "severity": "high", "confidence": "high", "summary": "Form errors rely on blocking alerts", "evidence": "Validation uses blocking alert() messages, focuses fields manually, and provides no inline aria-live/aria-invalid feedback.", "artifacts": [ "evidence/login-raw.html" ], "suggestedFix": "Validate after interaction with inline, visible and aria-live feedback.", "effort": "medium" }, { "id": "F-31", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "severity": "high", "confidence": "high", "summary": "Credential autofill is disabled", "evidence": "Both User ID and password/PIN inputs explicitly set autocomplete=\"off\" instead of appropriate username/current-password tokens.", "artifacts": [ "evidence/static-probe.json", "evidence/runtime-probe.json" ], "suggestedFix": "Use autocomplete=username and current-password (or an appropriate PIN strategy) without blocking paste.", "effort": "medium" }, { "id": "F-32", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "optimize-image-priority", "severity": "medium", "confidence": "high", "summary": "Login images are not resource-efficient", "evidence": "Image audit reports 23 legacy GIF/PNG/JPG images, no modern formats, 10 missing dimensions, five missing srcset and one oversized asset.", "artifacts": [ "evidence/images.json" ], "suggestedFix": "Convert eligible assets to AVIF/WebP/SVG, provide dimensions/srcset and load only the active banner.", "effort": "small" }, { "id": "F-33", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "deprioritize-background-fetches", "severity": "medium", "confidence": "high", "summary": "The page performs avoidable network work", "evidence": "The login fetches all eight banner images and 12 scripts during the entry journey, including duplicate libraries across redirects.", "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "suggestedFix": "Avoid loading both mobile and desktop documents and fetch promotional slides on demand.", "effort": "small" }, { "id": "F-34", "pathId": "public-entry", "url": "https://m.klikbca.com", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "efficient-background-processing", "severity": "medium", "confidence": "high", "summary": "Page weight is disproportionate to the login task", "evidence": "The lightweight login transfers 1.30MB; 1.19MB is attributed to the ibank subdomain and includes eight promotional banners plus large scripts.", "artifacts": [ "evidence/network-summary.json" ], "suggestedFix": "Set a login weight budget and defer promotional media and nonessential scripts.", "effort": "small" } ], "taskList": [ { "id": "T-01", "title": "Rebuild the login as one responsive, zoomable, progressively enhanced document", "priority": 1, "findingIds": [ "F-08", "F-09", "F-18", "F-22", "F-26", "F-27" ], "guidanceId": "fluid-scaling", "status": "open" }, { "id": "T-02", "title": "Make credential entry and page structure accessible", "priority": 2, "findingIds": [ "F-14", "F-15", "F-16", "F-17", "F-29" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T-03", "title": "Harden headers and cookie policy", "priority": 3, "findingIds": [ "F-24", "F-25" ], "guidanceId": "security", "status": "open" }, { "id": "T-04", "title": "Replace alerts and enable safe autofill", "priority": 4, "findingIds": [ "F-10", "F-30", "F-31" ], "guidanceId": "validate-input-after-interaction", "status": "open" }, { "id": "T-05", "title": "Remove redirect duplication and reduce entry payload", "priority": 5, "findingIds": [ "F-11", "F-12", "F-13", "F-33", "F-34" ], "guidanceId": "optimize-script-priority", "status": "open" }, { "id": "T-06", "title": "Respect color, motion and contrast preferences", "priority": 6, "findingIds": [ "F-01", "F-02", "F-03" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T-07", "title": "Modernise document, controls and carousel semantics", "priority": 7, "findingIds": [ "F-04", "F-05", "F-06", "F-19", "F-20" ], "guidanceId": "html", "status": "open" }, { "id": "T-08", "title": "Optimise and defer promotional images", "priority": 8, "findingIds": [ "F-32" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T-09", "title": "Add intentional metadata and crawler endpoints", "priority": 9, "findingIds": [ "F-21", "F-23" ], "guidanceId": "html", "status": "open" }, { "id": "T-10", "title": "Provide recoverable HTTP failure states", "priority": 10, "findingIds": [ "F-28" ], "guidanceId": "persistent-toast-notifications", "status": "open" } ], "budget": { "pathCount": 5, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-27T13-34-36-823Z" }