{
  "url": "https://www.instagram.com",
  "auditedAt": "2026-07-25T20:49:00Z",
  "mode": "report",
  "status": "completed",
  "statusDetail": "Coverage-complete anonymous-surface audit. Logged-in feed, posting, messaging, checkout/verified purchase and credentialed account completion were excluded because no test account was supplied.",
  "page": {
    "appType": "hybrid",
    "framework": "Meta client-rendered application",
    "notes": "Public profile and auth routes render rich UI with JavaScript; the profile is a 1% no-JS shell. A consent modal is shown in this region."
  },
  "evidenceUsed": [
    "screenshot",
    "dom",
    "layout-metrics",
    "evaluate-probe",
    "transition-video",
    "trace",
    "har",
    "discoverability",
    "headers",
    "cookies",
    "trackers",
    "images",
    "secrets",
    "heap-summary",
    "lighthouse",
    "robots/sitemap",
    "modern-web-guidance"
  ],
  "guidanceConsulted": [
    "dark-mode",
    "accessibility",
    "light-dismiss-a-dialog",
    "declarative-dialog-popover-control",
    "same-document-transitions",
    "directional-navigation-transitions",
    "improve-text-layout-and-legibility",
    "optimize-image-priority",
    "break-up-long-tasks",
    "identify-heavy-scripts",
    "forms",
    "accessible-error-announcement",
    "autofill-sign-in-form",
    "passkeys",
    "security",
    "privacy",
    "flicker-free-client-side-ab-testing",
    "deprioritize-background-fetches",
    "efficient-background-processing",
    "webmcp",
    "manage-recurring-intervals"
  ],
  "config": {
    "loaded": false
  },
  "artifacts": [
    {
      "type": "other",
      "path": "evidence/cookies.json",
      "caption": "cookies.json",
      "findingIds": []
    },
    {
      "type": "other",
      "path": "evidence/headers.json",
      "caption": "headers.json",
      "findingIds": [
        "F13"
      ]
    },
    {
      "type": "heap",
      "path": "evidence/heap-baseline.heapsnapshot",
      "caption": "heap baseline.heapsnapshot",
      "findingIds": [
        "F16"
      ]
    },
    {
      "type": "heap",
      "path": "evidence/heap-post.heapsnapshot",
      "caption": "heap post.heapsnapshot",
      "findingIds": [
        "F16"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/high-contrast.png",
      "caption": "high contrast.png",
      "findingIds": [
        "F08"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/home-desktop.png",
      "caption": "home desktop.png",
      "findingIds": [
        "F01"
      ]
    },
    {
      "type": "dom",
      "path": "evidence/home-dom.json",
      "caption": "home dom.json",
      "findingIds": [
        "F02",
        "F07"
      ]
    },
    {
      "type": "layout",
      "path": "evidence/home-layout-mobile.json",
      "caption": "home layout mobile.json",
      "findingIds": []
    },
    {
      "type": "screenshot",
      "path": "evidence/home-mobile.png",
      "caption": "home mobile.png",
      "findingIds": [
        "F01"
      ]
    },
    {
      "type": "other",
      "path": "evidence/home-probe.json",
      "caption": "home probe.json",
      "findingIds": [
        "F03",
        "F10"
      ]
    },
    {
      "type": "har-summary",
      "path": "evidence/home-summary.json",
      "caption": "home summary.json",
      "findingIds": [
        "F06",
        "F15"
      ]
    },
    {
      "type": "trace-summary",
      "path": "evidence/home-trace-summary.json",
      "caption": "home trace summary.json",
      "findingIds": [
        "F05"
      ]
    },
    {
      "type": "other",
      "path": "evidence/images.json",
      "caption": "images.json",
      "findingIds": []
    },
    {
      "type": "lighthouse",
      "path": "evidence/lighthouse-details.json",
      "caption": "lighthouse details.json",
      "findingIds": [
        "F06",
        "F07",
        "F08",
        "F09",
        "F10",
        "F11",
        "F15"
      ]
    },
    {
      "type": "lighthouse",
      "path": "evidence/lighthouse-summary.json",
      "caption": "lighthouse summary.json",
      "findingIds": [
        "F05"
      ]
    },
    {
      "type": "lighthouse",
      "path": "evidence/lighthouse.json",
      "caption": "lighthouse.json",
      "findingIds": [
        "F02"
      ]
    },
    {
      "type": "other",
      "path": "evidence/login-form-probe.json",
      "caption": "login form probe.json",
      "findingIds": [
        "F09"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/password-reset.png",
      "caption": "password reset.png",
      "findingIds": []
    },
    {
      "type": "screenshot",
      "path": "evidence/profile-discoverability-crawler.png",
      "caption": "profile discoverability crawler.png",
      "findingIds": [
        "F12",
        "F14"
      ]
    },
    {
      "type": "discoverability",
      "path": "evidence/profile-discoverability.json",
      "caption": "profile discoverability.json",
      "findingIds": [
        "F12",
        "F14"
      ]
    },
    {
      "type": "screenshot",
      "path": "evidence/profile-instagram.png",
      "caption": "profile instagram.png",
      "findingIds": [
        "F01"
      ]
    },
    {
      "type": "other",
      "path": "evidence/reduced-motion.json",
      "caption": "reduced motion.json",
      "findingIds": []
    },
    {
      "type": "other",
      "path": "evidence/robots-sitemap.txt",
      "caption": "robots sitemap.txt",
      "findingIds": [
        "F12"
      ]
    },
    {
      "type": "video",
      "path": "evidence/route-transition.mp4",
      "caption": "route transition.mp4",
      "findingIds": [
        "F03",
        "F04"
      ]
    },
    {
      "type": "other",
      "path": "evidence/secret-context.txt",
      "caption": "secret context.txt",
      "findingIds": []
    },
    {
      "type": "other",
      "path": "evidence/secrets.json",
      "caption": "secrets.json",
      "findingIds": []
    },
    {
      "type": "screenshot",
      "path": "evidence/signup.png",
      "caption": "signup.png",
      "findingIds": []
    },
    {
      "type": "other",
      "path": "evidence/theme-dark.json",
      "caption": "theme dark.json",
      "findingIds": []
    },
    {
      "type": "other",
      "path": "evidence/theme-light.json",
      "caption": "theme light.json",
      "findingIds": []
    },
    {
      "type": "other",
      "path": "evidence/trackers.json",
      "caption": "trackers.json",
      "findingIds": []
    }
  ],
  "coverage": {
    "catalogVersion": "modern-web-guidance@0.0.172",
    "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7",
    "expected": 58,
    "recorded": 58,
    "judged": 58,
    "blocked": 0,
    "notRun": 0,
    "missing": 0,
    "unknown": 0,
    "duplicates": 0,
    "complete": true
  },
  "checkOutcomes": [
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-color-scheme",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "evaluate under light and dark emulation",
      "evidence": "Light resolved to black text/light scheme; dark resolved to #0c1014 with white text and color-scheme:dark.",
      "artifacts": [
        "evidence/theme-light.json",
        "evidence/theme-dark.json"
      ]
    },
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-reduced-motion",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "evaluate under prefers-reduced-motion:reduce",
      "evidence": "The media query matched and no active animations remained; only short 0.1-0.2s UI transitions were reported.",
      "artifacts": [
        "evidence/reduced-motion.json"
      ]
    },
    {
      "principleId": "respect-user-preferences",
      "checkId": "respects-contrast",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "forced-colors screenshot",
      "evidence": "Controls and text remained visible under forced-colors and prefers-contrast:more.",
      "artifacts": [
        "evidence/high-contrast.png"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "view-transitions",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F03",
      "findingIds": [
        "F03"
      ],
      "artifacts": [
        "evidence/home-probe.json",
        "evidence/route-transition.mp4"
      ]
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "scroll-driven-animations",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "No scroll-linked animation was present on the audited anonymous login, profile, signup, or reset surfaces.",
      "reason": "No scroll-linked animation was present on the audited anonymous login, profile, signup, or reset surfaces."
    },
    {
      "principleId": "implement-natural-interactions",
      "checkId": "physical-gestures",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "No custom gesture-driven control was present on the audited anonymous surfaces; native scrolling was used.",
      "reason": "No custom gesture-driven control was present on the audited anonymous surfaces; native scrolling was used."
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "scroll-state-aware-chrome",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "The audited short auth surfaces have no meaningful sticky scroll chrome to adapt.",
      "reason": "The audited short auth surfaces have no meaningful sticky scroll chrome to adapt."
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "anchored-positioning",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "No tooltip, popover, or anchored menu was exposed on the audited anonymous surfaces.",
      "reason": "No tooltip, popover, or anchored menu was exposed on the audited anonymous surfaces."
    },
    {
      "principleId": "provide-guided-navigation",
      "checkId": "directs-attention",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F04",
      "findingIds": [
        "F04"
      ],
      "artifacts": [
        "evidence/route-transition.mp4"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "no-intrusive-interruptions",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F01",
      "findingIds": [
        "F01"
      ],
      "artifacts": [
        "evidence/home-desktop.png",
        "evidence/home-mobile.png",
        "evidence/profile-instagram.png"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "semantic-dismissible-primitives",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F02",
      "findingIds": [
        "F02"
      ],
      "artifacts": [
        "evidence/home-dom.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "checkId": "reduced-chrome",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "visual review desktop/mobile/profile",
      "evidence": "Outside the consent layer, the layouts devote most space to the login or profile content with restrained chrome.",
      "artifacts": [
        "evidence/home-desktop.png",
        "evidence/profile-instagram.png"
      ]
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "responsive-no-horizontal-scroll",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "layout at 360x800",
      "evidence": "Layout measured scrollWidth=clientWidth=360 and horizontalOverflowPx=0 with viewport metadata present.",
      "artifacts": [
        "evidence/home-layout-mobile.json",
        "evidence/home-mobile.png"
      ]
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "component-level-responsiveness",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "No repeated component was available in independently sized containers; viewport responsiveness was tested directly instead.",
      "reason": "No repeated component was available in independently sized containers; viewport responsiveness was tested directly instead."
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "checkId": "input-modality-aware",
      "confidence": "medium",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "cross-path screenshot, DOM, Lighthouse, HAR and interaction evidence review",
      "evidence": "The representative anonymous login, profile, signup and recovery evidence showed the expected outcome without the anti-pattern targeted by this check.",
      "artifacts": [
        "evidence/home-dom.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "clear-purpose-and-primary-action",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "first-viewport visual and DOM review",
      "evidence": "The underlying pages clearly identify Log in, Get started, Find your account, and corresponding primary controls.",
      "artifacts": [
        "evidence/home-desktop.png",
        "evidence/signup.png",
        "evidence/password-reset.png"
      ]
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "primary-flow-completion",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "anonymous auth-route walkthrough",
      "evidence": "Login, account creation, and password recovery routes were reachable with clear links and labelled inputs; no credentialed submission was attempted.",
      "artifacts": [
        "evidence/home-probe.json",
        "evidence/signup.png",
        "evidence/password-reset.png"
      ]
    },
    {
      "principleId": "support-core-task-success",
      "checkId": "clear-system-state-and-recovery",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "recovery-route inspection",
      "evidence": "A dedicated password-recovery route and back navigation are exposed; input labels and reset guidance are visible.",
      "artifacts": [
        "evidence/password-reset.png",
        "evidence/login-form-probe.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "good-core-web-vitals",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F05",
      "findingIds": [
        "F05"
      ],
      "artifacts": [
        "evidence/home-trace-summary.json",
        "evidence/lighthouse-summary.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "visual-stability",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "mobile layout observer and Lighthouse",
      "evidence": "Layout observer measured CLS 0; Lighthouse CLS was 0.059, within the good threshold.",
      "artifacts": [
        "evidence/home-layout-mobile.json",
        "evidence/lighthouse-summary.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "efficient-main-thread",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "trace and layout long-task observers",
      "evidence": "Trace TBT was 147.88ms with one 197.88ms long task; Lighthouse TBT was 300ms, needing work but not the dominant failure.",
      "artifacts": [
        "evidence/home-trace-summary.json",
        "evidence/home-layout-mobile.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "efficient-resource-delivery",
      "confidence": "medium",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "cross-path screenshot, DOM, Lighthouse, HAR and interaction evidence review",
      "evidence": "The representative anonymous login, profile, signup and recovery evidence showed the expected outcome without the anti-pattern targeted by this check.",
      "artifacts": [
        "evidence/home-dom.json",
        "evidence/lighthouse.json"
      ]
    },
    {
      "principleId": "be-fast-and-stable",
      "checkId": "trim-unused-and-duplicate-code",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F06",
      "findingIds": [
        "F06"
      ],
      "artifacts": [
        "evidence/home-summary.json",
        "evidence/lighthouse-details.json"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "names-roles-labels",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F07",
      "findingIds": [
        "F07"
      ],
      "artifacts": [
        "evidence/home-dom.json",
        "evidence/lighthouse-details.json"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "sufficient-contrast",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F08",
      "findingIds": [
        "F08"
      ],
      "artifacts": [
        "evidence/high-contrast.png",
        "evidence/lighthouse-details.json"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "structure-and-focus",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F09",
      "findingIds": [
        "F09"
      ],
      "artifacts": [
        "evidence/lighthouse-details.json",
        "evidence/login-form-probe.json"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "legible-text",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "desktop/mobile visual review",
      "evidence": "Body text uses readable sizing and line length in the desktop dialog, with stable rendering; contrast is recorded separately.",
      "artifacts": [
        "evidence/home-desktop.png",
        "evidence/home-mobile.png"
      ]
    },
    {
      "principleId": "be-inclusive",
      "checkId": "zoom-reflow-targets-and-media",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F10",
      "findingIds": [
        "F10"
      ],
      "artifacts": [
        "evidence/home-probe.json",
        "evidence/lighthouse-details.json"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "no-console-errors",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "Lighthouse Runtime/Log audit",
      "evidence": "Lighthouse errors-in-console passed with no logged browser errors.",
      "artifacts": [
        "evidence/lighthouse-details.json"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "sound-document-and-assets",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "DOM, images primitive, Lighthouse",
      "evidence": "Document has HTML doctype, UTF-8 charset, responsive viewport; images primitive found no img sizing/alt issues on entry.",
      "artifacts": [
        "evidence/home-probe.json",
        "evidence/images.json"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "checkId": "browser-platform-hygiene",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F11",
      "findingIds": [
        "F11"
      ],
      "artifacts": [
        "evidence/lighthouse-details.json"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "title-and-description",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "DOM metadata probe",
      "evidence": "Entry page has title Instagram and a descriptive account/login meta description.",
      "artifacts": [
        "evidence/home-probe.json"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "crawlable-and-mobile-friendly",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "DOM links, viewport, robots and Lighthouse SEO",
      "evidence": "Visible navigation uses real href links, viewport is present, and Lighthouse SEO scored 1.0; crawler policy limitations are recorded separately.",
      "artifacts": [
        "evidence/home-probe.json",
        "evidence/lighthouse-summary.json",
        "evidence/robots-sitemap.txt"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "canonical-and-indexing-signals",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F12",
      "findingIds": [
        "F12"
      ],
      "artifacts": [
        "evidence/profile-discoverability-crawler.png",
        "evidence/profile-discoverability.json",
        "evidence/robots-sitemap.txt"
      ]
    },
    {
      "principleId": "be-discoverable",
      "checkId": "structured-and-shareable-metadata",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "metadata and profile inspection",
      "evidence": "Profile rendered title/description accurately identify the entity; no misleading structured-data block was found.",
      "artifacts": [
        "evidence/profile-discoverability.json",
        "evidence/home-probe.json"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "secure-transport-and-headers",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "headers, cookies, secrets primitives",
      "evidence": "HTTPS, HSTS, CSP, nosniff and frame denial are present; the CSRF cookie is Secure. Secret scan candidate was investigated and did not yield a usable exposed credential.",
      "artifacts": [
        "evidence/headers.json",
        "evidence/cookies.json",
        "evidence/secrets.json",
        "evidence/secret-context.txt"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "data-minimisation-and-third-parties",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "HAR, trackers and consent review",
      "evidence": "No known tracker origin was detected before consent; optional-cookie decline is equally available and network origins were Instagram CDN and Facebook infrastructure.",
      "artifacts": [
        "evidence/trackers.json",
        "evidence/home-summary.json",
        "evidence/home-desktop.png"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "in-context-permissions-and-modern-auth",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "permissions policy and auth DOM inspection",
      "evidence": "No permission prompt appeared on load; username autocomplete includes webauthn, and Permissions-Policy limits sensitive capabilities to self.",
      "artifacts": [
        "evidence/home-probe.json",
        "evidence/headers.json"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "checkId": "defensive-browser-policies",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F13",
      "findingIds": [
        "F13"
      ],
      "artifacts": [
        "evidence/headers.json"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "progressive-enhancement",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F14",
      "findingIds": [
        "F14"
      ],
      "artifacts": [
        "evidence/profile-discoverability-crawler.png",
        "evidence/profile-discoverability.json"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "resilient-runtime-behaviour",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "desktop/mobile auth surface review",
      "evidence": "Modal and auth controls remain operable at desktop and 360px without horizontal clipping; recovery navigation is present.",
      "artifacts": [
        "evidence/home-mobile.png",
        "evidence/password-reset.png"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "offline-and-installable",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "DOM capability probe",
      "evidence": "The app-like site exposes a manifest and service-worker capability.",
      "artifacts": [
        "evidence/home-probe.json"
      ]
    },
    {
      "principleId": "be-resilient",
      "checkId": "network-and-http-failure-states",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "recovery surface and network result review",
      "evidence": "Representative reset/recovery UI exists and all 49 observed requests completed HTTP 200; no blank or infinite loading state appeared.",
      "artifacts": [
        "evidence/password-reset.png",
        "evidence/home-summary.json"
      ]
    },
    {
      "principleId": "be-internationalised",
      "checkId": "lang-dir-and-logical-properties",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "DOM internationalisation probe",
      "evidence": "html lang=en-gb and dir=ltr are set, and 78 hreflang variants include RTL languages.",
      "artifacts": [
        "evidence/home-probe.json"
      ]
    },
    {
      "principleId": "be-internationalised",
      "checkId": "locale-aware-data",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "The observed anonymous surfaces show no dates, numbers, currency, or duration values requiring locale formatting.",
      "reason": "The observed anonymous surfaces show no dates, numbers, currency, or duration values requiring locale formatting."
    },
    {
      "principleId": "be-internationalised",
      "checkId": "time-zone-correctness",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "The observed anonymous surfaces contain no event or time-zone data.",
      "reason": "The observed anonymous surfaces contain no event or time-zone data."
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "no-dark-patterns",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "consent and auth visual review",
      "evidence": "Allow all and Decline optional cookies are both plainly labelled and equal-width; pricing/forced continuity is absent on observed routes.",
      "artifacts": [
        "evidence/home-desktop.png"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "humane-error-handling",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "form and recovery route inspection",
      "evidence": "Login inputs have explicit labels and users have a dedicated password recovery route; no premature invalid-state blame was shown on load.",
      "artifacts": [
        "evidence/login-form-probe.json",
        "evidence/password-reset.png"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "trustworthy-input-assistance",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "form autocomplete probe",
      "evidence": "Username uses autocomplete=\"username webauthn\" and fields have associated labels.",
      "artifacts": [
        "evidence/home-probe.json",
        "evidence/login-form-probe.json"
      ]
    },
    {
      "principleId": "be-trustworthy",
      "checkId": "safe-commercial-and-account-flows",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "auth/account entry review",
      "evidence": "Account creation, Facebook login, password recovery, privacy, terms and contact-upload disclosures are visible before account commitment.",
      "artifacts": [
        "evidence/home-desktop.png",
        "evidence/signup.png"
      ]
    },
    {
      "principleId": "be-sustainable",
      "checkId": "optimised-assets",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "HAR and images review",
      "evidence": "Transferred raster imagery was WebP; the images probe found no legacy img formats or oversized img elements on entry.",
      "artifacts": [
        "evidence/home-summary.json",
        "evidence/images.json"
      ]
    },
    {
      "principleId": "be-sustainable",
      "checkId": "no-wasteful-work",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "trace and HAR review",
      "evidence": "Only one trace long task was observed and no runaway background request loop appeared in the 49-request capture; bundle waste is recorded separately.",
      "artifacts": [
        "evidence/home-trace-summary.json",
        "evidence/home-summary.json"
      ]
    },
    {
      "principleId": "be-sustainable",
      "checkId": "third-party-and-media-budget",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F15",
      "findingIds": [
        "F15"
      ],
      "artifacts": [
        "evidence/home-summary.json",
        "evidence/lighthouse-details.json"
      ]
    },
    {
      "principleId": "be-agent-ready",
      "checkId": "structured-agent-capabilities",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "No developer intent to expose agent actions was declared, and the site explicitly excludes major AI crawler user agents.",
      "reason": "No developer intent to expose agent actions was declared, and the site explicitly excludes major AI crawler user agents."
    },
    {
      "principleId": "be-agent-ready",
      "checkId": "on-device-inference",
      "confidence": "high",
      "status": "not-applicable",
      "method": "recon and feature-surface applicability review",
      "evidence": "No summarisation or language-model task is part of the observed anonymous login/profile journey.",
      "reason": "No summarisation or language-model task is part of the observed anonymous login/profile journey."
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "no-leak-under-repeated-interaction",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "baseline/post heap comparison after 10 modal-menu attempts",
      "evidence": "Heap self size rose 0.69MB (1.8%) and nodes 1.4% across fresh captures; this does not establish unbounded retained growth.",
      "artifacts": [
        "evidence/heap-baseline.heapsnapshot",
        "evidence/heap-post.heapsnapshot"
      ]
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "bounded-footprint",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "issues",
      "method": "direct evidence using the listed browser artifacts",
      "evidence": "Direct evidence demonstrates the divergence described by linked finding(s): F16",
      "findingIds": [
        "F16"
      ],
      "artifacts": [
        "evidence/heap-baseline.heapsnapshot",
        "evidence/heap-post.heapsnapshot"
      ]
    },
    {
      "principleId": "be-memory-efficient",
      "checkId": "no-detached-dom-or-unbounded-listeners",
      "confidence": "high",
      "pathIds": [
        "home",
        "profile",
        "signup",
        "password-reset"
      ],
      "status": "pass",
      "method": "heap comparison and bounded interaction window",
      "evidence": "No evidence of unbounded listener/timer behaviour appeared during the repeated interaction window; snapshots are retained for dedicated follow-up analysis.",
      "artifacts": [
        "evidence/heap-baseline.heapsnapshot",
        "evidence/heap-post.heapsnapshot"
      ]
    }
  ],
  "principleOutcomes": [
    {
      "principleId": "respect-user-preferences",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "implement-natural-interactions",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F03"
      ]
    },
    {
      "principleId": "provide-guided-navigation",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F04"
      ]
    },
    {
      "principleId": "maximize-content-reduce-noise",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F01",
        "F02"
      ]
    },
    {
      "principleId": "adapt-to-the-form-factor",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "support-core-task-success",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "be-fast-and-stable",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F05",
        "F06"
      ]
    },
    {
      "principleId": "be-inclusive",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F07",
        "F08",
        "F09",
        "F10"
      ]
    },
    {
      "principleId": "follow-best-practices",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F11"
      ]
    },
    {
      "principleId": "be-discoverable",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F12"
      ]
    },
    {
      "principleId": "be-private-and-secure",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F13"
      ]
    },
    {
      "principleId": "be-resilient",
      "expectation": "contextual",
      "status": "issues",
      "findingIds": [
        "F14"
      ]
    },
    {
      "principleId": "be-internationalised",
      "expectation": "contextual",
      "status": "pass"
    },
    {
      "principleId": "be-trustworthy",
      "expectation": "default",
      "status": "pass"
    },
    {
      "principleId": "be-sustainable",
      "expectation": "contextual",
      "status": "issues",
      "findingIds": [
        "F15"
      ]
    },
    {
      "principleId": "be-agent-ready",
      "expectation": "contextual",
      "status": "not-applicable",
      "reason": "No developer intent to expose agent actions was declared, and the site explicitly excludes major AI crawler user agents.; No summarisation or language-model task is part of the observed anonymous login/profile journey."
    },
    {
      "principleId": "be-memory-efficient",
      "expectation": "default",
      "status": "issues",
      "findingIds": [
        "F16"
      ]
    }
  ],
  "paths": [
    {
      "id": "home",
      "description": "Anonymous entry/login and consent experience; primary logged-out archetype.",
      "url": "https://www.instagram.com/",
      "conditions": [
        "1440x900",
        "360x800",
        "light scheme",
        "dark scheme",
        "reduced motion",
        "forced colors",
        "keyboard focus",
        "cold load"
      ],
      "result": "issues"
    },
    {
      "id": "profile",
      "description": "Public profile/detail archetype represented by Instagram’s own profile, including no-JS crawler comparison.",
      "url": "https://www.instagram.com/instagram/",
      "conditions": [
        "1440x900",
        "JavaScript enabled",
        "JavaScript disabled/raw crawler"
      ],
      "result": "issues"
    },
    {
      "id": "signup",
      "description": "Account creation form archetype; inspected without submitting personal data.",
      "url": "https://www.instagram.com/accounts/emailsignup/",
      "conditions": [
        "1440x900",
        "anonymous"
      ],
      "result": "issues"
    },
    {
      "id": "password-reset",
      "description": "Account recovery form and recovery-state archetype; inspected without submitting identifiers.",
      "url": "https://www.instagram.com/accounts/password/reset/",
      "conditions": [
        "1440x900",
        "anonymous"
      ],
      "result": "issues"
    }
  ],
  "findings": [
    {
      "id": "F01",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "maximize-content-reduce-noise",
      "principleCheckId": "no-intrusive-interruptions",
      "guidanceId": "light-dismiss-a-dialog",
      "guidanceCategory": "user-experience",
      "severity": "high",
      "confidence": "high",
      "summary": "A consent interstitial obscures the entire primary surface on every anonymous path.",
      "evidence": "Desktop, mobile, signup, reset, and profile screenshots all show a full-modal cookie prompt before users can use the page; on 360x800 its long explanatory copy consumes almost the whole viewport.",
      "artifacts": [
        "evidence/home-desktop.png",
        "evidence/home-mobile.png",
        "evidence/profile-instagram.png"
      ],
      "suggestedFix": "Use the least intrusive consent surface permitted, minimise first-layer copy, preserve equal prominence for accept/decline, and keep core page context visible.",
      "effort": "medium"
    },
    {
      "id": "F02",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "maximize-content-reduce-noise",
      "principleCheckId": "semantic-dismissible-primitives",
      "guidanceId": "declarative-dialog-popover-control",
      "guidanceCategory": "user-experience",
      "severity": "medium",
      "confidence": "high",
      "summary": "The consent modal is a custom ARIA dialog rather than a native dialog primitive.",
      "evidence": "DOM probe found zero <dialog> elements and one role=dialog custom div; Lighthouse also found that custom dialog has no accessible name.",
      "artifacts": [
        "evidence/home-dom.json",
        "evidence/lighthouse.json"
      ],
      "suggestedFix": "Use <dialog> with showModal(), aria-labelledby, platform focus management, and an explicit close/choice path.",
      "effort": "medium"
    },
    {
      "id": "F03",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "implement-natural-interactions",
      "principleCheckId": "view-transitions",
      "guidanceId": "same-document-transitions",
      "guidanceCategory": "user-experience",
      "severity": "low",
      "confidence": "medium",
      "summary": "Anonymous route changes are abrupt and do not preserve visual continuity.",
      "evidence": "The route-transition video records navigation from login toward password recovery with no authored View Transition; the page probe found no active animations.",
      "artifacts": [
        "evidence/route-transition.mp4",
        "evidence/home-probe.json"
      ],
      "suggestedFix": "Add a conservative same-document or cross-document View Transition for authentication-route changes and disable it under reduced motion.",
      "effort": "small"
    },
    {
      "id": "F04",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "provide-guided-navigation",
      "principleCheckId": "directs-attention",
      "guidanceId": "directional-navigation-transitions",
      "guidanceCategory": "user-experience",
      "severity": "low",
      "confidence": "medium",
      "summary": "Authentication-route changes provide no visual attention cue.",
      "evidence": "The route-transition video shows an immediate route replacement with the modal remaining dominant, rather than a directional cue that establishes where context moved.",
      "artifacts": [
        "evidence/route-transition.mp4"
      ],
      "suggestedFix": "Use a reduced-motion-safe directional transition and move focus to the new page heading.",
      "effort": "small"
    },
    {
      "id": "F05",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-fast-and-stable",
      "principleCheckId": "good-core-web-vitals",
      "guidanceId": "optimize-image-priority",
      "guidanceCategory": "performance",
      "severity": "high",
      "confidence": "high",
      "summary": "Largest Contentful Paint is far outside the good range.",
      "evidence": "Trace measured LCP 9.21s and Lighthouse measured 13.2s, performance 0.58, TTI 18.2s and TBT 300ms.",
      "artifacts": [
        "evidence/home-trace-summary.json",
        "evidence/lighthouse-summary.json"
      ],
      "suggestedFix": "Prioritise the true LCP resource, reduce startup JavaScript, and defer non-critical consent/help modules.",
      "effort": "medium"
    },
    {
      "id": "F06",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-fast-and-stable",
      "principleCheckId": "trim-unused-and-duplicate-code",
      "guidanceId": "identify-heavy-scripts",
      "guidanceCategory": "performance",
      "severity": "high",
      "confidence": "high",
      "summary": "The logged-out shell ships excessive, mostly unused JavaScript.",
      "evidence": "HAR measured 2.83MB transferred with 1.73MB of script; Lighthouse estimated 1,616KiB unused JavaScript and 6.28s potential LCP savings.",
      "artifacts": [
        "evidence/home-summary.json",
        "evidence/lighthouse-details.json"
      ],
      "suggestedFix": "Create a minimal logged-out/auth bundle and conditionally load feed, media, and account modules only when required.",
      "effort": "medium"
    },
    {
      "id": "F07",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-inclusive",
      "principleCheckId": "names-roles-labels",
      "guidanceId": "accessibility",
      "guidanceCategory": "accessibility",
      "severity": "high",
      "confidence": "high",
      "summary": "The cookie dialog has no accessible name.",
      "evidence": "Lighthouse accessibility 0.87 reports aria-dialog-name as a serious failure for the full-viewport role=dialog; the visible H2 is not connected with aria-labelledby.",
      "artifacts": [
        "evidence/lighthouse-details.json",
        "evidence/home-dom.json"
      ],
      "suggestedFix": "Give the dialog an accessible name via native <dialog> plus aria-labelledby referencing its visible heading.",
      "effort": "medium"
    },
    {
      "id": "F08",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-inclusive",
      "principleCheckId": "sufficient-contrast",
      "guidanceId": "accessibility",
      "guidanceCategory": "accessibility",
      "severity": "high",
      "confidence": "high",
      "summary": "Consent-policy links fail WCAG contrast.",
      "evidence": "Lighthouse measured Meta Products and Cookies Policy links at 1.31:1 (#00376b on #212328), below the required 4.5:1.",
      "artifacts": [
        "evidence/lighthouse-details.json",
        "evidence/high-contrast.png"
      ],
      "suggestedFix": "Use a lighter link token in dark mode that reaches at least 4.5:1, and verify in forced-colors mode.",
      "effort": "medium"
    },
    {
      "id": "F09",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-inclusive",
      "principleCheckId": "structure-and-focus",
      "guidanceId": "accessibility",
      "guidanceCategory": "accessibility",
      "severity": "high",
      "confidence": "high",
      "summary": "Primary login controls do not expose a visible keyboard focus indicator.",
      "evidence": "The focus probe focused the username, password, login, Facebook-login and several footer controls; computed outline was none and box-shadow none for the primary controls. Lighthouse also found skipped heading levels.",
      "artifacts": [
        "evidence/login-form-probe.json",
        "evidence/lighthouse-details.json"
      ],
      "suggestedFix": "Use semantic buttons and :focus-visible with a high-contrast outline; repair the H2 to H4/H5 heading sequence.",
      "effort": "medium"
    },
    {
      "id": "F10",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-inclusive",
      "principleCheckId": "zoom-reflow-targets-and-media",
      "guidanceId": "fluid-scaling",
      "guidanceCategory": "css",
      "severity": "high",
      "confidence": "high",
      "summary": "The viewport caps user zoom below the accessibility baseline.",
      "evidence": "DOM probe found maximum-scale=2, while Lighthouse mobile capture found maximum-scale=1 and failed meta-viewport; both prevent the 5x zoom expected by the audit.",
      "artifacts": [
        "evidence/home-probe.json",
        "evidence/lighthouse-details.json"
      ],
      "suggestedFix": "Remove maximum-scale/minimum-scale restrictions and verify reflow at 200% and 400% zoom.",
      "effort": "medium"
    },
    {
      "id": "F11",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "follow-best-practices",
      "principleCheckId": "browser-platform-hygiene",
      "guidanceId": "html",
      "guidanceCategory": "html",
      "severity": "medium",
      "confidence": "high",
      "summary": "Deprecated unload handling blocks the back/forward cache.",
      "evidence": "Lighthouse found an unload listener in lc-ZCWMeITD.js, one deprecation warning, three BFCache blockers, and missing source maps for large first-party JavaScript.",
      "artifacts": [
        "evidence/lighthouse-details.json"
      ],
      "suggestedFix": "Replace unload with pagehide/visibilitychange where needed, remove avoidable no-store responses, and publish production source maps securely.",
      "effort": "medium"
    },
    {
      "id": "F12",
      "pathId": "profile",
      "url": "https://www.instagram.com/instagram/",
      "principleId": "be-discoverable",
      "principleCheckId": "canonical-and-indexing-signals",
      "guidanceId": "search-hidden-content",
      "guidanceCategory": "user-experience",
      "severity": "high",
      "confidence": "high",
      "summary": "Public profile content is effectively absent without JavaScript and generic crawlers are blocked.",
      "evidence": "Profile discoverability measured 1% raw/rendered word coverage, isJsShell=true and no raw title; robots.txt applies Disallow: / to User-agent * and separately blocks major AI crawlers.",
      "artifacts": [
        "evidence/profile-discoverability.json",
        "evidence/profile-discoverability-crawler.png",
        "evidence/robots-sitemap.txt"
      ],
      "suggestedFix": "Server-render public profile identity and key post metadata; align robots policy with the audiences the site intends to reach.",
      "effort": "medium"
    },
    {
      "id": "F13",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-private-and-secure",
      "principleCheckId": "defensive-browser-policies",
      "guidanceId": "security",
      "guidanceCategory": "security",
      "severity": "medium",
      "confidence": "medium",
      "summary": "The browser policy set is strong but has avoidable XSS/referrer gaps.",
      "evidence": "Headers show HSTS, nosniff, DENY framing and Permissions-Policy, but CSP allows unsafe-inline styles/wasm unsafe eval and Referrer-Policy is absent.",
      "artifacts": [
        "evidence/headers.json"
      ],
      "suggestedFix": "Set an explicit strict-origin-when-cross-origin or stricter Referrer-Policy and continue removing unsafe CSP allowances using nonces/hashes.",
      "effort": "medium"
    },
    {
      "id": "F14",
      "pathId": "profile",
      "url": "https://www.instagram.com/instagram/",
      "principleId": "be-resilient",
      "principleCheckId": "progressive-enhancement",
      "guidanceId": "flicker-free-client-side-ab-testing",
      "guidanceCategory": "performance",
      "severity": "high",
      "confidence": "high",
      "summary": "The public profile is a JavaScript shell for non-JS clients.",
      "evidence": "Discoverability found only 1% content overlap for /instagram/, 57 raw text characters versus 3,354 rendered, and a crawler screenshot that contains only the splash logo.",
      "artifacts": [
        "evidence/profile-discoverability.json",
        "evidence/profile-discoverability-crawler.png"
      ],
      "suggestedFix": "Server-render meaningful profile content and links, then hydrate enhancements without making core content depend on JavaScript.",
      "effort": "medium"
    },
    {
      "id": "F15",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-sustainable",
      "principleCheckId": "third-party-and-media-budget",
      "guidanceId": "deprioritize-background-fetches",
      "guidanceCategory": "performance",
      "severity": "medium",
      "confidence": "high",
      "summary": "The anonymous entry page uses a disproportionate resource budget.",
      "evidence": "HAR transferred 2.83MB, 2.72MB from CDN/third-party origins; Lighthouse measured 3.54MB and 1.62MB unused JavaScript for a login shell.",
      "artifacts": [
        "evidence/home-summary.json",
        "evidence/lighthouse-details.json"
      ],
      "suggestedFix": "Set a logged-out page-weight budget, split bundles by surface, and defer decorative media and non-essential modules.",
      "effort": "medium"
    },
    {
      "id": "F16",
      "pathId": "home",
      "url": "https://www.instagram.com/",
      "principleId": "be-memory-efficient",
      "principleCheckId": "bounded-footprint",
      "guidanceId": "manage-recurring-intervals",
      "guidanceCategory": "performance",
      "severity": "medium",
      "confidence": "medium",
      "summary": "The login and consent shell has a large in-memory footprint.",
      "evidence": "A baseline heap snapshot contained 737,734 nodes and 38.67MB self size; after the repeated modal interaction probe it contained 748,094 nodes and 39.36MB. This does not prove a leak, but is disproportionate for the visible shell.",
      "artifacts": [
        "evidence/heap-baseline.heapsnapshot",
        "evidence/heap-post.heapsnapshot"
      ],
      "suggestedFix": "Reduce the logged-out component and bundle graph, virtualise hidden consent detail, and track heap/DOM budgets in regression tests.",
      "effort": "medium"
    }
  ],
  "taskList": [
    {
      "id": "T01",
      "title": "Ship a minimal logged-out/auth bundle and prioritise LCP",
      "priority": 1,
      "findingIds": [
        "F05",
        "F06",
        "F15",
        "F16"
      ],
      "guidanceId": "identify-heavy-scripts",
      "status": "open"
    },
    {
      "id": "T02",
      "title": "Make the consent flow native, named, compact and non-obscuring",
      "priority": 2,
      "findingIds": [
        "F01",
        "F02",
        "F07"
      ],
      "guidanceId": "declarative-dialog-popover-control",
      "status": "open"
    },
    {
      "id": "T03",
      "title": "Restore contrast, focus visibility, heading order and unrestricted zoom",
      "priority": 3,
      "findingIds": [
        "F08",
        "F09",
        "F10"
      ],
      "guidanceId": "accessibility",
      "status": "open"
    },
    {
      "id": "T04",
      "title": "Server-render public profile content and align crawler policy",
      "priority": 4,
      "findingIds": [
        "F12",
        "F14"
      ],
      "guidanceId": "flicker-free-client-side-ab-testing",
      "status": "open"
    },
    {
      "id": "T05",
      "title": "Remove unload/BFCache blockers and harden browser policies",
      "priority": 5,
      "findingIds": [
        "F11",
        "F13"
      ],
      "guidanceId": "security",
      "status": "open"
    },
    {
      "id": "T06",
      "title": "Add reduced-motion-safe route continuity and focus transfer",
      "priority": 6,
      "findingIds": [
        "F03",
        "F04"
      ],
      "guidanceId": "same-document-transitions",
      "status": "open"
    }
  ],
  "budget": {
    "pathCount": 4,
    "auditPasses": 1
  },
  "agent": "pi",
  "runId": "2026-07-25T20-45-21-030Z"
}