{ "url": "https://myim3.ioh.co.id", "auditedAt": "2026-07-27T14:12:30.553Z", "mode": "report", "status": "partial", "statusDetail": "The public login surface and adverse conditions were judged, but end-to-end account and commercial flows remain blocked by subscriber number and OTP authentication. No authorized test account was provided.", "page": { "appType": "spa", "framework": "Angular", "notes": "A hash-routed Angular PWA redirects the root to #/login. The public surface is a phone-number login template; account content is authentication-gated." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "discoverability", "trace", "har", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "lighthouse", "axe-core", "raw-http", "offline-cdp" ], "guidanceConsulted": [ "accessibility", "accessible-error-announcement", "adapt-scrollbar-to-contrast-preferences", "agentic-forms", "agentic-javascript-tools", "anchor-positioning-tab-underline", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "animated-select-picker", "apply-webgl-shaders", "autofill-address-form", "autofill-highlight-inputs", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "batch-analytics-events", "brand-consistent-forms", "branded-select-styling", "break-up-long-tasks", "calculate-event-differentials", "calculate-total-foreground-time", "calculate-with-intrinsic-sizes", "capture-location-agnostic-data", "carousel-slide-effects", "carousel-snap-highlights", "child-state-based-styling", "complex-shapes", "component-specific-light-dark-theme", "conditional-async-dependencies", "consistent-cross-document-transitions", "content-based-styling", "coordinate-global-events", "cross-document-transitions", "css", "css-layout", "custom-select-picker-layouts", "customize-scrollbar-color-and-thickness", "dark-mode", "declarative-dialog-popover-control", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "deliver-optimized-decorative-images", "deprioritize-background-fetches", "design-token-reactivity", "detect-initial-visibility-state", "directional-navigation-transitions", "dynamic-sibling-animations", "dynamic-sibling-styling", "efficient-background-processing", "export-html-media-from-canvas", "expose-canvas-content-to-browser-features", "faster-spa-view-transitions", "flicker-free-client-side-ab-testing", "fluid-scaling", "form-fields-automatically-fit-contents", "format-human-readable-durations", "forms", "full-session-analytics", "group-element-transitions", "highlight-text-ranges", "html", "identify-heavy-scripts", "identify-inp-causes", "improve-next-page-load-performance", "improve-text-layout-and-legibility", "individual-transform-properties", "interactions-in-complex-layouts", "interactive-content-in-3d-scenes", "interactive-content-reveal", "interest-triggered-action-previews", "interest-triggered-tooltips", "language-detection", "language-model", "light-dismiss-a-dialog", "manage-recurring-intervals", "model-partial-time-concepts", "move-dom-element-without-losing-state", "navigation-drawer", "optimize-image-priority", "optimize-preload-priority", "optimize-script-priority", "overflow-clipping-control", "parallax-scroll-effects", "passkey-authentication", "passkey-conditional-create", "passkey-management", "passkey-reauthentication", "passkey-registration", "passkeys", "performance", "persistent-app-tours", "persistent-toast-notifications", "persistent-top-layer-ui", "physics-based-easing", "platform-controls-dismiss-dialog", "position-aware-tooltips", "precise-text-alignment", "prevent-text-wrapping", "privacy", "pull-to-reveal", "reduce-style-repetition", "required-field-feedback", "resilient-context-menus-and-nested-dropdowns", "resolution-optimized-pseudo-elements", "rich-media-picker", "same-document-transitions", "schedule-tasks-by-priority", "scroll-entry-exit-effects", "scroll-position-aware-elements", "scroll-progress-indicator", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "scrollability-affordance-hints", "scrollytelling", "search-hidden-content", "security", "select-menu-interaction", "sequence-distributed-events", "shaped-cutouts", "shrinking-header-on-scroll", "size-aware-styling", "soft-edge-content-fade", "stabilize-reactive-state", "stack-drill-down", "style-parent-with-has", "summarizer", "support-global-calendar-systems", "swipe-to-remove", "translator", "validate-input-after-interaction", "visually-stable-font-fallbacks", "visually-stable-mixed-fonts", "visually-texture-content", "webmcp" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Rendered login page at desktop width", "condition": "viewport: 1440x1000", "findingIds": [ "F20" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Rendered login page at mobile width", "condition": "viewport: 360x800", "findingIds": [ "F01", "F04", "F10", "F12", "F24" ] }, { "type": "screenshot", "path": "evidence/home-dark-mobile.png", "caption": "Login page under requested dark color scheme; it remains light", "condition": "prefers-color-scheme: dark; viewport: 360x800", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-high-contrast-mobile.png", "caption": "Login page under increased contrast preference; rendering is unchanged", "condition": "prefers-contrast: more; viewport: 360x800" }, { "type": "other", "path": "evidence/structure.json", "caption": "Computed CSS feature probe for preference media queries, logical properties and transition APIs", "findingIds": [ "F01", "F03", "F04", "F09", "F11", "F13", "F17", "F18", "F20", "F24", "F25" ] }, { "type": "other", "path": "evidence/motion-modern-css.json", "caption": "Reduced-motion animation and CSS probe", "condition": "prefers-reduced-motion: reduce", "findingIds": [ "F03" ] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "Mobile layout metrics including overflow, CLS and long tasks", "condition": "viewport: 360x800", "findingIds": [ "F15" ] }, { "type": "layout", "path": "evidence/layout-desktop.json", "caption": "Desktop layout metrics including overflow, CLS and long tasks", "condition": "viewport: 1440x1000" }, { "type": "other", "path": "evidence/axe.json", "caption": "axe-core accessibility results", "findingIds": [ "F09", "F10", "F11", "F12", "F13" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "Lighthouse report for performance, accessibility, best practices and SEO", "findingIds": [ "F06", "F07", "F08", "F13", "F14", "F16" ] }, { "type": "trace", "path": "evidence/load-trace.json", "caption": "DevTools load performance trace" }, { "type": "trace-summary", "path": "evidence/load-trace-summary.json", "caption": "Compact performance trace summary", "findingIds": [ "F06" ] }, { "type": "har", "path": "evidence/network.har", "caption": "Network HAR for the login load", "findingIds": [ "F07" ] }, { "type": "har-summary", "path": "evidence/network-summary.json", "caption": "Compact network weight and delivery summary", "findingIds": [ "F07", "F08" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "Security response header audit", "findingIds": [ "F19", "F21" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Cookie security audit" }, { "type": "other", "path": "evidence/trackers.json", "caption": "Third-party and tracker audit" }, { "type": "other", "path": "evidence/secrets.json", "caption": "Client bundle credential scan with matches redacted", "findingIds": [ "F19" ] }, { "type": "other", "path": "evidence/secret-context-redacted.txt", "caption": "Redacted bundle context for detected client credentials", "findingIds": [ "F19" ] }, { "type": "other", "path": "evidence/images.json", "caption": "Rendered image sizing and format audit", "findingIds": [ "F09", "F15" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "Raw HTML versus rendered content comparison", "findingIds": [ "F22" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "Crawler view with JavaScript disabled", "condition": "JavaScript disabled", "findingIds": [ "F22" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Rendered browser view for crawler comparison", "condition": "JavaScript enabled", "findingIds": [ "F22" ] }, { "type": "other", "path": "evidence/invalid-state.json", "caption": "Invalid phone input state probe", "findingIds": [ "F05" ] }, { "type": "screenshot", "path": "evidence/invalid-mobile.png", "caption": "Short invalid phone input state on mobile", "condition": "viewport: 360x800", "findingIds": [ "F05" ] }, { "type": "other", "path": "evidence/manifest.json", "caption": "Web app manifest" }, { "type": "other", "path": "evidence/offline-state.json", "caption": "Offline reload state served by the service worker", "condition": "network offline after warm load" }, { "type": "screenshot", "path": "evidence/offline.png", "caption": "Offline reload screenshot", "condition": "network offline after warm load" }, { "type": "other", "path": "evidence/not-found-route.xml", "caption": "Unknown-route browser state", "findingIds": [ "F23" ] }, { "type": "other", "path": "evidence/not-found-status.txt", "caption": "Unknown-route HTTP status", "findingIds": [ "F23" ] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "Baseline heap summary before repeated input interaction" }, { "type": "heap", "path": "evidence/heap-post.heapsnapshot", "caption": "Heap summary after ten focus, edit and blur cycles" }, { "type": "other", "path": "evidence/memory-metrics.json", "caption": "DOM and JS heap metrics around repeated interaction" }, { "type": "dom", "path": "evidence/raw-home.html", "caption": "Raw server HTML", "findingIds": [ "F22" ] }, { "type": "other", "path": "evidence/raw-home-headers.txt", "caption": "Raw document response headers" }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots.txt response body", "findingIds": [ "F17", "F18" ] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "sitemap.xml response body", "findingIds": [ "F18" ] }, { "type": "other", "path": "evidence/lighthouse-summary.json", "caption": "Compact Lighthouse scores and selected audit details" }, { "type": "screenshot", "path": "evidence/home-en-mobile.png", "caption": "Language-control interaction capture at mobile width" }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Rendered DOM and stylesheet capture" }, { "type": "other", "path": "evidence/manifest.json.headers", "caption": "Manifest response headers" }, { "type": "other", "path": "evidence/recon.json", "caption": "Entry-page route, heading, link and form reconnaissance" }, { "type": "other", "path": "evidence/robots.txt.headers", "caption": "robots.txt response headers" }, { "type": "other", "path": "evidence/sitemap.xml.headers", "caption": "sitemap.xml response headers" }, { "type": "other", "path": "coverage-manifest.json", "caption": "Atomic 58-check coverage manifest and evidence plan" } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 56, "blocked": 2, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": false }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Emulated dark preference screenshot plus computed CSS inspection", "evidence": "The dark capture is identical to default; color-scheme is normal and no dark media rule exists", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/home-dark-mobile.png", "evidence/structure.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Emulated reduced-motion animation and CSS probe", "evidence": "No active animations were present, and the stylesheet contains explicit reduced-motion rules that disable transitions.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/motion-modern-css.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Forced-colors screenshot at 360x800 plus axe contrast probe in the normal color scheme", "evidence": "Under forced-colors: active, browser colors adapt and all text, the field border and the Continue control remain visible. Normal-scheme WCAG contrast failures are recorded separately under be-inclusive.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/home-high-contrast-mobile.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "medium", "method": "Language navigation attempt and CSS feature inspection", "evidence": "The language change navigated the document and no view-transition CSS or API use was found.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "DOM, CSS and viewport review", "evidence": "The accessible login view has no scroll-linked animation, parallax, scrollytelling or reveal effect to implement declaratively.", "reason": "The accessible login view has no scroll-linked animation, parallax, scrollytelling or reveal effect to implement declaratively.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "DOM and interaction-surface review", "evidence": "The accessible login view has no swipe, pull, drag, carousel or other physical gesture surface.", "reason": "The accessible login view has no swipe, pull, drag, carousel or other physical gesture surface.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "high", "method": "Viewport screenshot and DOM review", "evidence": "The login page fits in one viewport and has no sticky or affixed scroll chrome.", "reason": "The login page fits in one viewport and has no sticky or affixed scroll chrome.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "DOM review for overlays, menus and tooltips", "evidence": "No tooltip, popover or menu is exposed on the accessible login view.", "reason": "No tooltip, popover or menu is exposed on the accessible login view.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "medium", "method": "First-viewport visual hierarchy and task walkthrough", "evidence": "The single login view keeps one heading, one field and one primary button in reading order, so the next step is visually unambiguous.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Initial desktop and mobile screenshots plus DOM review", "evidence": "No popup, interstitial, consent wall or banner obscures the login form on load.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "not-applicable", "confidence": "high", "method": "DOM inspection for dialog, popover, details and custom overlays", "evidence": "No overlay or disclosure control is present on the accessible login view.", "reason": "No overlay or disclosure control is present on the accessible login view.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Desktop and mobile screenshot review", "evidence": "The viewport is almost entirely task content with no application frame, side rail, decorative panel or competing chrome.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Layout metrics and screenshots at 360x800 and 1440x1000", "evidence": "Both viewports have zero horizontal overflow and the form fluidly changes width.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/layout-desktop.json", "evidence/home-mobile.png", "evidence/home-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "not-applicable", "confidence": "medium", "method": "DOM/CSS inspection for reused components and container rules", "evidence": "The accessible page exposes one fixed-context login form, not a component reused in materially different containers.", "reason": "The accessible page exposes one fixed-context login form, not a component reused in materially different containers.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Programmatic focus and target-size probe", "evidence": "Focus outlines are absent and language controls are far below 44x44 CSS pixels.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json" ], "findingIds": [ "F04" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "First-viewport screenshot and form structure review", "evidence": "The Indonesian heading states that an IM3 number is needed to log in, followed immediately by the labelled phone field and Continue action.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/home-mobile.png", "evidence/structure.json" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "blocked", "confidence": "high", "method": "Attempted login journey from phone entry", "evidence": "End-to-end completion requires a valid IM3 subscriber number and OTP. No test account or authorization was supplied, so proceeding could message a real subscriber.", "reason": "End-to-end completion requires a valid IM3 subscriber number and OTP. No test account or authorization was supplied, so proceeding could message a real subscriber.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Short invalid input interaction and state/ARIA inspection", "evidence": "A short invalid value leaves Continue disabled but produces no visible or announced reason or recovery instruction.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/invalid-state.json", "evidence/invalid-mobile.png" ], "findingIds": [ "F05" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Lighthouse plus raw CDP trace", "evidence": "Lighthouse LCP is 9.18 s and trace LCP is 4.02 s; both exceed the 2.5 s good threshold. CLS and blocking time are separately judged.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/lighthouse.json", "evidence/load-trace-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Layout-shift observers at mobile and desktop widths", "evidence": "Observed CLS was 0.0145 mobile and 0.0072 desktop, both comfortably below 0.1.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/layout-desktop.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Raw CDP trace and layout long-task observers", "evidence": "The trace recorded zero long tasks and zero blocking time; both layout captures also recorded no long tasks.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/load-trace-summary.json", "evidence/layout-mobile.json", "evidence/layout-desktop.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "HAR summary and Lighthouse delivery diagnostics", "evidence": "The login load transfers 1.93 MB, including 1.61 MB scripts and 211 KB fonts; major document and JavaScript resources are uncompressed.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/network-summary.json", "evidence/lighthouse.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Lighthouse code-coverage diagnostics and HAR weights", "evidence": "Lighthouse estimates about 1,042 KiB unused JS and 69 KiB unused CSS on the one-field login route.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/lighthouse.json", "evidence/network-summary.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "axe, image and DOM inspection", "evidence": "The form is labelled, but decorative images expose alt=\".\" rather than empty alternative text.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/images.json", "evidence/structure.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "axe color-contrast analysis", "evidence": "Four visible text elements fail 4.5:1, with measured ratios from 3.49:1 to 4.31:1.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/axe.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "axe structure audit and programmatic focus probe", "evidence": "There is no main landmark or h1, heading order skips levels, and focused controls have no visible outline or shadow.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/axe.json", "evidence/structure.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "issues", "confidence": "high", "method": "Mobile screenshot and axe review", "evidence": "Small gray helper copy is only 12px and 3.49:1 against white, reducing reading comfort.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/home-mobile.png", "evidence/axe.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Viewport metadata inspection plus axe and Lighthouse", "evidence": "user-scalable=no and maximum-scale=1 disable zoom, and language controls are undersized.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json", "evidence/axe.json" ], "findingIds": [ "F13", "F04" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Lighthouse runtime error collection", "evidence": "The page throws ReferenceError: Swiper is not defined from the production scripts bundle.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F14" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "DOM, image and layout inspection", "evidence": "Doctype and charset are valid, but the rendered phone-prefix image has no intrinsic width/height.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/images.json", "evidence/layout-mobile.json" ], "findingIds": [ "F15" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Lighthouse platform diagnostics", "evidence": "The large first-party vendor bundle has no valid source map; no deprecation or BFCache failures were observed.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Rendered and raw head inspection", "evidence": "The raw and rendered documents include title “myIM3” and a descriptive Indonesian meta description.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json", "evidence/raw-home.html" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Anchor, viewport and robots inspection", "evidence": "Language anchors use javascript:void(), and robots.txt returns a NoSuchKey storage error; mobile layout itself reflows.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json", "evidence/robots.txt", "evidence/layout-mobile.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Head, response, robots and sitemap inspection", "evidence": "The document is HTTP 200 but has no canonical or hreflang, while robots.txt and sitemap.xml are missing.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json", "evidence/robots.txt", "evidence/sitemap.xml", "evidence/raw-home-headers.txt" ], "findingIds": [ "F18" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "not-applicable", "confidence": "medium", "method": "Visible entity and metadata inspection", "evidence": "This private account login screen does not present an article, product, event or rich public entity requiring schema.org or social-preview data.", "reason": "This private account login screen does not present an article, product, event or rich public entity requiring schema.org or social-preview data.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Header, cookie and redacted client-secret inspection", "evidence": "HTTPS, HSTS and secure cookie posture pass, but CSP is absent and a reusable hdrAuthorization value is embedded in public JavaScript.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json", "evidence/secret-context-redacted.txt" ], "findingIds": [ "F19" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "pass", "confidence": "high", "method": "HAR, tracker and cookie inspection plus visible purpose text", "evidence": "The login load makes only first-party requests, sets no cookies, loads no known trackers, and explains that the phone number is needed for verification.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/trackers.json", "evidence/cookies.json", "evidence/network-summary.json", "evidence/home-mobile.png" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "medium", "method": "Login UI and platform permission/auth inspection", "evidence": "No permission is requested on load, but the accessible account entry exposes phone OTP only and no passkey/WebAuthn option.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Security response-header inspection", "evidence": "HSTS, nosniff and SAMEORIGIN are present; CSP, Referrer-Policy and Permissions-Policy are absent.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Raw HTML comparison and browser/crawler screenshots", "evidence": "Without JavaScript, the login form disappears and only an enable-JavaScript message remains; content coverage is 6%.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/discoverability-rendered.png" ], "findingIds": [ "F22" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "medium", "method": "Runtime, layout and repeated form interaction probes", "evidence": "The accessible form remains stable through focus/edit/blur cycles, has no clipped overlays, no long tasks and no DOM growth.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/memory-metrics.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "pass", "confidence": "high", "method": "Manifest, service-worker registration and offline warm reload", "evidence": "A manifest and active service worker are present, and an offline reload continues to render the login shell.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/manifest.json", "evidence/structure.json", "evidence/offline-state.json", "evidence/offline.png" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Unknown-route HTTP and rendered-state inspection", "evidence": "An unknown path produces a raw NoSuchKey XML error without navigation or recovery.", "pathIds": [ "unknown-route" ], "artifacts": [ "evidence/not-found-route.xml", "evidence/not-found-status.txt" ], "findingIds": [ "F23" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "DOM language and computed stylesheet inspection", "evidence": "Visible selected content is Indonesian while html lang is en; CSS has extensive physical left/right declarations and zero logical property matches.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Rendered content and form-data review", "evidence": "The accessible login view displays no dates, numbers, currencies, durations or calendars requiring locale formatting.", "reason": "The accessible login view displays no dates, numbers, currencies, durations or calendars requiring locale formatting.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Rendered content and flow review", "evidence": "The accessible login view handles no events, schedules, dates or times.", "reason": "The accessible login view handles no events, schedules, dates or times.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "medium", "method": "Login screenshot and visible consent/commitment review", "evidence": "The accessible entry asks only for the phone number needed for verification, explains why, and shows no preselected upsell, nagging consent or disguised action.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/home-mobile.png", "evidence/structure.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Invalid short input interaction and accessibility state inspection", "evidence": "After user interaction the invalid field provides no specific visible or announced feedback.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/invalid-state.json", "evidence/invalid-mobile.png" ], "findingIds": [ "F05" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Form autocomplete inspection", "evidence": "The sign-in telephone field explicitly sets autocomplete=off.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/structure.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "blocked", "confidence": "high", "method": "Attempted account login coverage", "evidence": "Pricing, cancellation, sensitive account actions and reauthentication exist behind a valid subscriber number and OTP; no authorized test account was supplied.", "reason": "Pricing, cancellation, sensitive account actions and reauthentication exist behind a valid subscriber number and OTP; no authorized test account was supplied.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "pass", "confidence": "high", "method": "Image and HAR asset inspection", "evidence": "The visible imagery is tiny, not oversized, and totals about 25 KB; the main visual prefix is SVG.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/images.json", "evidence/network-summary.json" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Lighthouse code coverage and HAR transfer analysis", "evidence": "The route downloads over 1 MiB of unused JavaScript plus unused CSS for a one-field login view.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/lighthouse.json", "evidence/network-summary.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "pass", "confidence": "high", "method": "HAR, tracker and media-element inspection", "evidence": "There are no third-party requests, trackers, video or audio, and only three small image requests.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/trackers.json", "evidence/network-summary.json", "evidence/structure.json" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Site intent and exposed capability inspection", "evidence": "This sensitive subscriber account portal declares no agent-facing intent, and exposing account actions to agents is not assumed appropriate.", "reason": "This sensitive subscriber account portal declares no agent-facing intent, and exposing account actions to agents is not assumed appropriate.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Task and platform-use inspection", "evidence": "The accessible login task has no summarisation, generation or inference use case that would improve completion.", "reason": "The accessible login task has no summarisation, generation or inference use case that would improve completion.", "pathIds": [ "login-mobile" ], "artifacts": [] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Baseline and post-interaction heap summaries after ten input cycles", "evidence": "Across independent baseline/post captures, ten real focus/edit/blur cycles increased snapshot self size from 11,843,582 to 12,078,902 bytes (2.0%); in-page JS heap rose about 0.54 MB while DOM stayed at 73 nodes, bounded warm-up rather than evidence of unbounded retention.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot", "evidence/memory-metrics.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Heap summary and DOM/JS metrics", "evidence": "The login view uses about 12 MB JS heap, a 11.8 MB heap-snapshot self-size baseline and 73 rendered DOM elements, proportionate to this Angular login screen.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/memory-metrics.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Before/after constructor and DOM-count comparison", "evidence": "DOM count stayed exactly 73 through ten focus/edit/blur cycles and the bounded heap delta gives no evidence of accumulating DOM/listener state under the exercised interaction.", "pathIds": [ "login-mobile" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot", "evidence/memory-metrics.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F05" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07", "F08" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10", "F11", "F12", "F13", "F04" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F17", "F18" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F19", "F20", "F21" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F22", "F23" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F24" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F25" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F08" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "All checks were judged not applicable to the exposed surface." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "login-desktop", "description": "Root redirect and public login template at desktop width; represents the only unauthenticated entry surface.", "url": "https://myim3.ioh.co.id/#/login", "conditions": [ "viewport: 1440x1000" ], "result": "issues" }, { "id": "login-mobile", "description": "Public login template at a narrow mobile viewport; covers reflow, touch, focus, preferences and visual hierarchy.", "url": "https://myim3.ioh.co.id/#/login", "conditions": [ "viewport: 360x800", "prefers-color-scheme: dark", "forced-colors: active", "prefers-reduced-motion: reduce", "keyboard focus" ], "result": "issues" }, { "id": "invalid-phone", "description": "Short phone-number entry and blur; covers validation, error recovery and input assistance before OTP.", "url": "https://myim3.ioh.co.id/#/login", "conditions": [ "value: 123", "focus/edit/blur" ], "result": "issues" }, { "id": "language-state", "description": "Language selector navigation; covers state continuity, crawlability and locale metadata.", "url": "https://myim3.ioh.co.id/#/login", "conditions": [ "activate EN link from Indonesian state" ], "result": "issues" }, { "id": "no-js", "description": "Raw server HTML and JavaScript-disabled crawler view; covers discoverability and progressive enhancement.", "url": "https://myim3.ioh.co.id/", "conditions": [ "JavaScript disabled" ], "result": "issues" }, { "id": "offline", "description": "Warm-load then offline reload; covers manifest, service worker and offline fallback.", "url": "https://myim3.ioh.co.id/#/login", "conditions": [ "network offline after warm load" ], "result": "pass" }, { "id": "unknown-route", "description": "Direct unknown path; covers HTTP/network failure recovery.", "url": "https://myim3.ioh.co.id/this-route-does-not-exist", "conditions": [ "HTTP 404" ], "result": "issues" }, { "id": "authenticated-account", "description": "Authenticated account, pricing, cancellation and sensitive actions were not exercised because they require a real IM3 number and OTP; no authorized test account was supplied.", "url": "https://myim3.ioh.co.id/", "conditions": [ "authentication required" ], "result": "skipped" } ], "findings": [ { "id": "F01", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "The login experience ignores the requested dark color scheme.", "evidence": "The default and prefers-color-scheme: dark PNGs have the same 29,984-byte rendering, and the CSS probe found no color-scheme, prefers-color-scheme or light-dark() support.", "artifacts": [ "evidence/home-mobile.png", "evidence/home-dark-mobile.png", "evidence/structure.json" ], "suggestedFix": "Declare color-scheme: light dark and map surfaces, text, controls and browser chrome to preference-aware tokens using prefers-color-scheme or light-dark().", "effort": "medium" }, { "id": "F03", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "severity": "low", "confidence": "medium", "summary": "The language/state navigation has no declared transition treatment.", "evidence": "Activating the language link triggered a document navigation that closed the inspected target; the CSS probe found no View Transition rules or API usage, so there is no continuity treatment.", "artifacts": [ "evidence/structure.json", "evidence/motion-modern-css.json" ], "suggestedFix": "Progressively enhance language and route changes with same-document or cross-document View Transitions, while preserving the reduced-motion behavior already present.", "effort": "small" }, { "id": "F04", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Keyboard focus is invisible and language targets are too small.", "evidence": "The live focus probe found outline-style none and no box shadow on the phone field. EN and ID measure only 18x21 and 15x21 CSS pixels, below the 44x44 target guidance.", "artifacts": [ "evidence/structure.json", "evidence/home-mobile.png" ], "suggestedFix": "Add a high-contrast :focus-visible indicator and enlarge the clickable language controls to at least 44x44 CSS pixels without shrinking their visible labels.", "effort": "small" }, { "id": "F05", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Invalid phone input gives no actionable state or accessible error.", "evidence": "After entering and blurring “123”, native validity still reported valid, Continue remained disabled, no role=alert or visible error appeared, and aria-invalid was absent.", "artifacts": [ "evidence/invalid-state.json", "evidence/invalid-mobile.png" ], "suggestedFix": "Validate after interaction, show a specific correction message, set aria-invalid, associate the message with aria-describedby, and announce it in a live region.", "effort": "small" }, { "id": "F06", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "optimize-preload-priority", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "The throttled Largest Contentful Paint is far outside the good range.", "evidence": "Lighthouse measured LCP at 9.18 seconds with performance score 0.74. The raw trace measured LCP at 4.02 seconds, so both miss the 2.5-second good threshold.", "artifacts": [ "evidence/lighthouse.json", "evidence/load-trace-summary.json" ], "suggestedFix": "Profile the LCP element and its dependency chain, prioritize only its required resources, and defer non-critical application code until after the login form is visible.", "effort": "medium" }, { "id": "F07", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "The small login screen downloads a heavy, inefficient application payload.", "evidence": "The HAR recorded 1.93 MB over 17 requests, including 1.61 MB of scripts and 211 KB of fonts. The 1.18 MB vendor bundle dominates the load, and large document/JS responses are uncompressed.", "artifacts": [ "evidence/network.har", "evidence/network-summary.json", "evidence/lighthouse.json" ], "suggestedFix": "Enable Brotli compression, use immutable long-lived caching for hashed assets, subset and preload only the needed font, and split the authentication route from the main application dependency graph.", "effort": "medium" }, { "id": "F08", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Most JavaScript and CSS shipped to the login route is unused.", "evidence": "Lighthouse estimated 1,042 KiB unused JavaScript and 69 KiB unused CSS; vendor is 63% unused, main 79%, and scripts 85%.", "artifacts": [ "evidence/lighthouse.json", "evidence/network-summary.json" ], "suggestedFix": "Route-split the login experience, remove duplicate legacy or unconditional dependencies, tree-shake production bundles, and load account-only features conditionally after authentication.", "effort": "large" }, { "id": "F09", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "medium", "confidence": "high", "summary": "Decorative images expose punctuation as alternative text.", "evidence": "The image audit and rendered DOM show both the 1x1 pixel and phone-prefix SVG use alt=\".\". Screen readers may announce meaningless punctuation.", "artifacts": [ "evidence/images.json", "evidence/structure.json", "evidence/axe.json" ], "suggestedFix": "Use alt=\"\" for decorative images and keep meaningful icon information in a concise accessible name on the associated control.", "effort": "trivial" }, { "id": "F10", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Four visible text elements fail WCAG AA contrast.", "evidence": "axe measured four visible text failures: language/sign-up text at 4.31:1 and the phone label/helper at 3.49:1 against white.", "artifacts": [ "evidence/axe.json", "evidence/home-mobile.png" ], "suggestedFix": "Darken the gray and red text tokens to reach at least 4.5:1 against white in all states, then re-run automated and visual contrast checks.", "effort": "trivial" }, { "id": "F11", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "The login document lacks semantic structure and visible focus.", "evidence": "axe found no main landmark, no h1, invalid h2-to-h5 order and content outside landmarks; the focus probe found no visible outline or shadow.", "artifacts": [ "evidence/axe.json", "evidence/structure.json" ], "suggestedFix": "Wrap the primary form in main, use one descriptive h1 with sequential headings, and add a persistent high-contrast :focus-visible style.", "effort": "small" }, { "id": "F12", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-inclusive", "principleCheckId": "legible-text", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "Supporting text is visually weak at small sizes.", "evidence": "The mobile screenshot shows 12px gray verification copy; axe measured it at only 3.49:1 against white.", "artifacts": [ "evidence/home-mobile.png", "evidence/axe.json" ], "suggestedFix": "Use a legible minimum body/helper size with comfortable line height, stronger contrast and wrapping that remains readable at narrow widths.", "effort": "small" }, { "id": "F13", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "critical", "confidence": "high", "summary": "The viewport explicitly prevents user zoom.", "evidence": "The live viewport meta contains user-scalable=no and maximum-scale=1.0. axe classifies this as a critical accessibility failure.", "artifacts": [ "evidence/structure.json", "evidence/axe.json", "evidence/lighthouse.json" ], "suggestedFix": "Remove user-scalable=no and maximum-scale=1.0, retain width=device-width and initial-scale=1, and verify reflow at 200% to 400% zoom.", "effort": "trivial" }, { "id": "F14", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "conditional-async-dependencies", "guidanceCategory": "performance", "severity": "medium", "confidence": "high", "summary": "A production script throws an uncaught Swiper reference error.", "evidence": "Current Lighthouse console capture reports ReferenceError: Swiper is not defined at scripts.e33c1cecaaf7f13ff778.js:2:166840.", "artifacts": [ "evidence/lighthouse.json" ], "suggestedFix": "Remove the stale initializer or conditionally load and initialize Swiper only after its dependency is available.", "effort": "small" }, { "id": "F15", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "html", "severity": "low", "confidence": "high", "summary": "An inline SVG image has no intrinsic dimensions.", "evidence": "The images primitive found the phone-prefix SVG renders at 28x35 without width/height attributes; layout captures show small non-zero CLS.", "artifacts": [ "evidence/images.json", "evidence/layout-mobile.json" ], "suggestedFix": "Add width and height attributes, or an aspect-ratio, matching the rendered prefix icon dimensions so space is reserved before it loads.", "effort": "trivial" }, { "id": "F16", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Large production JavaScript has no source map.", "evidence": "Current Lighthouse reports that the 1.18 MB first-party vendor bundle has no valid source map.", "artifacts": [ "evidence/lighthouse.json" ], "suggestedFix": "Publish protected production source maps to the error-monitoring pipeline or serve valid maps where policy allows, and keep release artifacts aligned.", "effort": "small" }, { "id": "F17", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Navigation controls are not crawlable links and robots.txt is missing.", "evidence": "The only anchors, EN and ID, use href=\"javascript:void()\". /robots.txt returns HTTP storage NoSuchKey XML rather than a robots policy.", "artifacts": [ "evidence/structure.json", "evidence/robots.txt" ], "suggestedFix": "Use real URLs for language variants and serve a valid robots.txt that explicitly states crawl policy and points to the sitemap.", "effort": "small" }, { "id": "F18", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Public indexing signals are incomplete.", "evidence": "The HTTP 200 login document has no canonical or hreflang links; robots.txt and sitemap.xml return NoSuchKey XML responses.", "artifacts": [ "evidence/structure.json", "evidence/robots.txt", "evidence/sitemap.xml" ], "suggestedFix": "Add an absolute canonical URL, hreflang links for Indonesian and English variants, and a sitemap consistent with robots policy.", "effort": "small" }, { "id": "F19", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "The authentication client lacks CSP and embeds a reusable authorization value in its public bundle.", "evidence": "The header audit found no Content-Security-Policy. The redacted bundle context contains static SERVICEKEY and hdrAuthorization values; the Google API key is public client configuration, but API authorization must not rely on reusable values shipped to every browser.", "artifacts": [ "evidence/headers.json", "evidence/secrets.json", "evidence/secret-context-redacted.txt" ], "suggestedFix": "Add a nonce- or hash-based CSP and remove trust in static client credentials. Enforce authorization at the server with short-lived, user-bound tokens and rotate the exposed value if it grants access.", "effort": "medium" }, { "id": "F20", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkey-authentication", "guidanceCategory": "passkeys", "severity": "medium", "confidence": "medium", "summary": "The account entry offers phone OTP only, with no phishing-resistant option.", "evidence": "The public login form requests a phone number for OTP and no permission prompt appears on load. No passkey or WebAuthn affordance is exposed on this entry path.", "artifacts": [ "evidence/home-desktop.png", "evidence/structure.json" ], "suggestedFix": "Offer passkey sign-in and registration alongside the existing recovery path, with conditional mediation where supported.", "effort": "large" }, { "id": "F21", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "severity": "medium", "confidence": "high", "summary": "Several browser-enforced defensive policies are absent.", "evidence": "HSTS, nosniff and SAMEORIGIN are present; CSP, Referrer-Policy and Permissions-Policy are absent.", "artifacts": [ "evidence/headers.json" ], "suggestedFix": "Deploy a restrictive CSP with frame-ancestors, a privacy-preserving Referrer-Policy and a least-privilege Permissions-Policy.", "effort": "small" }, { "id": "F22", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "html", "guidanceCategory": "html", "severity": "high", "confidence": "high", "summary": "The login flow is unusable without JavaScript.", "evidence": "The JavaScript-disabled screenshot shows only “Please enable JavaScript to continue using this application.” Raw-to-rendered content coverage is 6%.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/discoverability-rendered.png", "evidence/raw-home.html" ], "suggestedFix": "Server-render the login form and essential instructions, use a real form action for the core step, then enhance validation and transitions with JavaScript.", "effort": "large" }, { "id": "F23", "pathId": "unknown-route", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "Unknown paths expose a raw storage error with no recovery.", "evidence": "Requesting /this-route-does-not-exist returns HTTP 404 with raw NoSuchKey XML and no navigation, retry or link back to login.", "artifacts": [ "evidence/not-found-route.xml", "evidence/not-found-status.txt" ], "suggestedFix": "Serve an intentional 404 page with a clear explanation and link back to the login or help path; use the same recoverable pattern for API and timeout errors.", "effort": "small" }, { "id": "F24", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "guidanceCategory": "built-in-ai", "severity": "medium", "confidence": "high", "summary": "Language metadata and CSS do not match the visible locale or support bidirectional layout.", "evidence": "The selected visible content is Indonesian while html lang remains en. The CSS probe found zero logical-property matches and roughly 900 physical left/right declarations.", "artifacts": [ "evidence/structure.json", "evidence/home-mobile.png" ], "suggestedFix": "Set html lang dynamically to id or en, declare direction where needed, and migrate layout declarations to logical properties so translated and RTL content can reflow.", "effort": "medium" }, { "id": "F25", "pathId": "login-mobile", "url": "https://myim3.ioh.co.id/#/login", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "guidanceCategory": "forms", "severity": "medium", "confidence": "high", "summary": "The phone field disables useful browser input assistance.", "evidence": "The live sign-in telephone input explicitly sets autocomplete=\"off\".", "artifacts": [ "evidence/structure.json" ], "suggestedFix": "Use the appropriate tel autocomplete token and inputmode so users can safely reuse stored contact/sign-in information rather than retyping it.", "effort": "trivial" } ], "taskList": [ { "id": "T01", "title": "Restore zoom, focus visibility, semantic structure and contrast", "priority": 1, "findingIds": [ "F13", "F04", "F10", "F11", "F09", "F12" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T02", "title": "Split and compress the login route payload, then fix LCP", "priority": 2, "findingIds": [ "F06", "F07", "F08" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T03", "title": "Remove exposed client authorization trust and deploy browser security policies", "priority": 3, "findingIds": [ "F19", "F21" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Make the login form progressively enhanced and recoverable", "priority": 4, "findingIds": [ "F22", "F05", "F23" ], "guidanceId": "accessible-error-announcement", "status": "open" }, { "id": "T05", "title": "Fix locale metadata, language URLs and indexing signals", "priority": 5, "findingIds": [ "F17", "F18", "F24" ], "guidanceId": "translator", "status": "open" }, { "id": "T06", "title": "Add a preference-aware dark theme", "priority": 6, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T07", "title": "Repair production hygiene and intrinsic asset sizing", "priority": 7, "findingIds": [ "F14", "F15", "F16" ], "guidanceId": "conditional-async-dependencies", "status": "open" }, { "id": "T08", "title": "Enable safe input assistance and consider passkey authentication", "priority": 8, "findingIds": [ "F20", "F25" ], "guidanceId": "passkey-authentication", "status": "open" }, { "id": "T09", "title": "Add continuity to language and route state changes", "priority": 9, "findingIds": [ "F03" ], "guidanceId": "same-document-transitions", "status": "open" } ], "budget": { "wallClockSeconds": 900, "pathCount": 8, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-25T19-26-11-398Z" }