{ "url": "https://www.bpexch.live", "auditedAt": "2026-07-27T17:08:23.950Z", "mode": "report", "status": "partial", "statusDetail": "The public login surface and unauthenticated error boundary were inspected. Three checks remain blocked because no valid account was supplied, so authenticated exchange, account, commercial, and post-login transition flows could not be exercised.", "page": { "appType": "mpa", "framework": "ASP.NET server-rendered login with jQuery/Bootstrap-era assets", "notes": "The root redirects to /Users/Login. Navigation exposes no public content routes; sitemap.xml and manifest.json return 404. Coverage includes the public login and a 404 boundary, and excludes authenticated exchange/account templates." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "axe-core", "trace", "har", "lighthouse", "headers", "cookies", "trackers", "secrets", "images", "discoverability", "heap-summary", "raw-http", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home/desktop.png", "caption": "Initial desktop login", "condition": "default desktop", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home/mobile.png", "caption": "Responsive login at 360×800", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home/dark.png", "caption": "Login under dark preference", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home/contrast.png", "caption": "Login under increased contrast preference", "condition": "prefers-contrast: more", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home/focus.png", "caption": "Username focused; no visible focus ring", "condition": "keyboard focus", "findingIds": [ "F02" ] }, { "type": "screenshot", "path": "evidence/home/invalid.png", "caption": "Blank native validation attempt", "condition": "required validation", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home/404.png", "caption": "Bare browser 404 with no site recovery", "condition": "unknown route", "findingIds": [ "F08" ] }, { "type": "screenshot", "path": "evidence/home/discoverability-rendered.png", "caption": "Rendered browser view", "condition": "JavaScript enabled", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home/discoverability-crawler.png", "caption": "Crawler/no-JS view", "condition": "JavaScript disabled", "findingIds": [] }, { "type": "dom", "path": "evidence/home/dom.json", "caption": "Rendered DOM and page styles", "condition": "default", "findingIds": [ "F01", "F03", "F05" ] }, { "type": "other", "path": "evidence/home/probe.json", "caption": "Document, form, landmark, focusable, and metadata probe", "condition": "default", "findingIds": [ "F02", "F03", "F05" ] }, { "type": "other", "path": "evidence/home/axe.json", "caption": "axe-core accessibility results", "condition": "default", "findingIds": [ "F03" ] }, { "type": "other", "path": "evidence/home/focus-state.json", "caption": "Computed focused-control state", "condition": "username focused", "findingIds": [ "F02" ] }, { "type": "other", "path": "evidence/home/invalid-state.json", "caption": "Native required-validation state", "condition": "blank submit", "findingIds": [] }, { "type": "layout", "path": "evidence/home/layout-desktop.json", "caption": "Desktop overflow, CLS, and long-task observation", "condition": "780x493", "findingIds": [ "F07" ] }, { "type": "layout", "path": "evidence/home/layout-mobile.json", "caption": "Mobile overflow and CLS observation", "condition": "360x800", "findingIds": [] }, { "type": "trace", "path": "evidence/home/perf", "caption": "Raw DevTools performance trace", "condition": "default", "findingIds": [ "F06" ] }, { "type": "trace-summary", "path": "evidence/home/perf-summary.json", "caption": "Trace timing and main-thread summary", "condition": "default", "findingIds": [ "F06" ] }, { "type": "har", "path": "evidence/home/network", "caption": "Raw HAR 1.2 capture", "condition": "default", "findingIds": [ "F06" ] }, { "type": "har-summary", "path": "evidence/home/network-summary.json", "caption": "Request weight, third parties, blocking candidates, and hygiene", "condition": "default", "findingIds": [ "F06", "F09" ] }, { "type": "lighthouse", "path": "evidence/home/lighthouse.json", "caption": "Full Lighthouse report", "condition": "mobile throttling", "findingIds": [ "F03", "F06", "F07" ] }, { "type": "other", "path": "evidence/home/lighthouse-summary.json", "caption": "Compact Lighthouse scores and selected audits", "condition": "mobile throttling", "findingIds": [ "F03", "F06", "F07" ] }, { "type": "other", "path": "evidence/home/headers.json", "caption": "Security response-header audit", "condition": "default", "findingIds": [ "F04" ] }, { "type": "other", "path": "evidence/home/cookies.json", "caption": "Cookie security audit", "condition": "default", "findingIds": [ "F04", "F09" ] }, { "type": "other", "path": "evidence/home/trackers.json", "caption": "Third-party and tracker origin audit", "condition": "default", "findingIds": [ "F09" ] }, { "type": "other", "path": "evidence/home/secrets.json", "caption": "Client-exposed secret scan", "condition": "default", "findingIds": [] }, { "type": "other", "path": "evidence/home/images.json", "caption": "Image sizing, format, responsive source, and alt audit", "condition": "default", "findingIds": [ "F07" ] }, { "type": "discoverability", "path": "evidence/home/discoverability.json", "caption": "Raw HTML vs rendered discoverability result", "condition": "crawler vs browser", "findingIds": [] }, { "type": "heap", "path": "evidence/home/heap-baseline", "caption": "Baseline heap summary", "condition": "before interaction", "findingIds": [] }, { "type": "heap", "path": "evidence/home/heap-post", "caption": "Heap after 10 input/focus cycles", "condition": "after repeated interaction", "findingIds": [] }, { "type": "other", "path": "evidence/home/http-probes.txt", "caption": "HTTP status/header probes for robots, sitemap, manifest, login, and 404", "condition": "raw HTTP", "findingIds": [ "F04", "F08" ] }, { "type": "other", "path": "evidence/home/reduced-motion.json", "caption": "Animation inventory under reduced motion", "condition": "prefers-reduced-motion: reduce", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 55, "blocked": 3, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": false }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "Default and prefers-color-scheme: dark screenshots are byte-identical and the rendered CSS exposes no color-scheme preference adaptation.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/desktop.png", "evidence/home/dark.png", "evidence/home/dom.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Under prefers-reduced-motion: reduce, matchMedia is true and document.getAnimations() returns an empty list.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/reduced-motion.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "The prefers-contrast: more capture retains visible text, icons, controls, and boundaries; Lighthouse contrast passes.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/contrast.png", "evidence/home/lighthouse-summary.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "blocked", "confidence": "high", "method": "Attempted public-path walkthrough and route discovery; authentication boundary encountered.", "evidence": "Authentication was attempted only to the public validation boundary; no valid account was supplied, so the post-login route/state transition could not be exercised.", "reason": "Authentication was attempted only to the public validation boundary; no valid account was supplied, so the post-login route/state transition could not be exercised.", "pathIds": [ "login" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "DOM and runtime probes find no scroll-linked animation or running animation on this static login.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/dom.json", "evidence/home/probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "The reachable login uses native text entry and button activation, with no custom pointer/gesture handlers or scroll manipulation.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "The public login is a single short view with no meaningful content scroll or sticky chrome.", "reason": "The public login is a single short view with no meaningful content scroll or sticky chrome.", "pathIds": [ "login" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "The public login contains no tooltip, popover, menu, or other anchored overlay.", "reason": "The public login contains no tooltip, popover, menu, or other anchored overlay.", "pathIds": [ "login" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "After programmatically focusing #user_Username, computed outline is none, box-shadow is none, border is none, and the focused screenshot is visually unchanged.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/focus.png", "evidence/home/focus-state.json", "evidence/home/probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Initial desktop and mobile captures show the login directly with no popup, consent wall, banner, or obscuring interstitial.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/desktop.png", "evidence/home/mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "DOM/runtime probes find no overlay or rich custom control requiring dialog, popover, details, or dismiss handling.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/dom.json", "evidence/home/probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "The first viewport gives nearly all functional chrome to a compact sign-in panel with no competing navigation, ads, or banners.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "At 360×800, layout reports scrollWidth=clientWidth=360 and 0 px horizontal overflow; the form remains usable.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/mobile.png", "evidence/home/layout-mobile.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "The reachable page has one fixed-context login panel and no reused component shown in differently sized containers.", "reason": "The reachable page has one fixed-context login panel and no reused component shown in differently sized containers.", "pathIds": [ "login" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "After programmatically focusing #user_Username, computed outline is none, box-shadow is none, border is none, and the focused screenshot is visually unchanged.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/focus.png", "evidence/home/focus-state.json", "evidence/home/probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "The first viewport presents two credentials fields and one clearly labelled Login action with no competing CTA.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "blocked", "confidence": "high", "method": "Attempted public-path walkthrough and route discovery; authentication boundary encountered.", "evidence": "The primary exchange journey requires valid credentials; no account was supplied, so end-to-end task completion was attempted but blocked at authentication.", "reason": "The primary exchange journey requires valid credentials; no account was supplied, so end-to-end task completion was attempted but blocked at authentication.", "pathIds": [ "login" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "The HTTP probe returns 404 and the captured route shows Chrome’s generic “page can’t be found” screen, with no BpExch navigation, sign-in link, support route, or recovery context.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/404.png", "evidence/home/http-probes.txt" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/network", "evidence/home/network-summary.json", "evidence/home/lighthouse.json", "evidence/home/lighthouse-summary.json", "evidence/home/perf-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Layout and Lighthouse both measure negligible CLS (about 0.002), with no visible shift in the captured load.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/layout-desktop.json", "evidence/home/lighthouse-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Trace reports zero long tasks and 0 ms total blocking time over the load.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/perf-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/network", "evidence/home/network-summary.json", "evidence/home/lighthouse.json", "evidence/home/lighthouse-summary.json", "evidence/home/perf-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/network", "evidence/home/network-summary.json", "evidence/home/lighthouse.json", "evidence/home/lighthouse-summary.json", "evidence/home/perf-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "axe reports a logo image without alt, two links without discernible text, no main landmark, no h1, and content outside landmarks; the two inputs use placeholders but no explicit labels.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/axe.json", "evidence/home/dom.json", "evidence/home/probe.json", "evidence/home/lighthouse-summary.json" ], "findingIds": [ "F03" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Lighthouse color-contrast passes and the default/contrast screenshots keep essential content legible.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/lighthouse-summary.json", "evidence/home/contrast.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "After programmatically focusing #user_Username, computed outline is none, box-shadow is none, border is none, and the focused screenshot is visually unchanged. axe reports a logo image without alt, two links without discernible text, no main landmark, no h1, and content outside landmarks; the two inputs use placeholders but no explicit labels.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/focus.png", "evidence/home/focus-state.json", "evidence/home/probe.json", "evidence/home/axe.json", "evidence/home/dom.json", "evidence/home/lighthouse-summary.json" ], "findingIds": [ "F02", "F03" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Desktop and mobile captures show unclipped, comfortably sized field text and CTA text.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/desktop.png", "evidence/home/mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Viewport permits scaling, mobile has no overflow, fields are 290×45 and button 120×50; no media requires captions.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/probe.json", "evidence/home/layout-mobile.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Lighthouse errors-in-console audit passes.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/lighthouse-summary.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "The images primitive reports one JPG with no width, height, srcset, or alt. Lighthouse also flags the unsized image; measured CLS remains low at 0.002.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/images.json", "evidence/home/lighthouse-summary.json", "evidence/home/layout-desktop.json" ], "findingIds": [ "F07" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Lighthouse reports no console/deprecation blocker and BFCache eligibility passes; no permission prompt appears on load.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/lighthouse-summary.json", "evidence/home/desktop.png" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "DOM has descriptive title “BpExch Login” and meta description “BpExch - Web Exchange”.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/dom.json", "evidence/home/probe.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Viewport meta is present, robots.txt is valid, and Lighthouse crawlable-anchor/indexing audits pass for the public boundary.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/probe.json", "evidence/home/http-probes.txt", "evidence/home/lighthouse-summary.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "The reachable surface is an authentication boundary rather than public content intended for search indexing.", "reason": "The reachable surface is an authentication boundary rather than public content intended for search indexing.", "pathIds": [ "login" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "A private sign-in form is not a rich public entity and does not need schema.org or social-preview metadata.", "reason": "A private sign-in form is not a rich public entity and does not need schema.org or social-preview metadata.", "pathIds": [ "login" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "Headers evidence finds no CSP, HSTS, nosniff, Referrer-Policy, or Permissions-Policy. The AntiForgery.WebExchange cookie is HttpOnly/SameSite=Strict but Secure=false.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/headers.json", "evidence/home/cookies.json", "evidence/home/http-probes.txt" ], "findingIds": [ "F04" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "Tracker and HAR evidence records three requests to wurfl.io and one Cloudflare Insights request, transferring 15,378 bytes; no known advertising tracker or third-party cookie was observed.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/trackers.json", "evidence/home/network-summary.json", "evidence/home/cookies.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "The only public authentication controls are username and password; both have an empty autocomplete attribute, and the DOM has no WebAuthn/passkey affordance.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/dom.json", "evidence/home/probe.json" ], "findingIds": [ "F05" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "Headers evidence finds no CSP, HSTS, nosniff, Referrer-Policy, or Permissions-Policy. The AntiForgery.WebExchange cookie is HttpOnly/SameSite=Strict but Secure=false.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/headers.json", "evidence/home/cookies.json", "evidence/home/http-probes.txt" ], "findingIds": [ "F04" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Raw server HTML is a complete ASP.NET sign-in form rather than an empty JS shell; title and description survive without JS.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/dom.json", "evidence/home/discoverability.json", "evidence/home/discoverability-crawler.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "The simple public form has no overlays or async UI that clip or lose state; native required validation focuses the missing field.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/invalid-state.json", "evidence/home/dom.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "A live exchange/authentication service is intrinsically online; installability and offline transaction support are not appropriate for this public boundary.", "reason": "A live exchange/authentication service is intrinsically online; installability and offline transaction support are not appropriate for this public boundary.", "pathIds": [ "login" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "The HTTP probe returns 404 and the captured route shows Chrome’s generic “page can’t be found” screen, with no BpExch navigation, sign-in link, support route, or recovery context.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/404.png", "evidence/home/http-probes.txt" ], "findingIds": [ "F08" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "The rendered document declares html lang=\"en\"; no bidirectional or translated content is exposed on this single-locale form.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/probe.json", "evidence/home/dom.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "The reachable sign-in form renders no dates, numbers, currencies, durations, or calendars.", "reason": "The reachable sign-in form renders no dates, numbers, currencies, durations, or calendars.", "pathIds": [ "login" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "The reachable sign-in form exposes no time or event data.", "reason": "The reachable sign-in form exposes no time or event data.", "pathIds": [ "login" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "The public boundary shows one direct sign-in action with no upsell, consent manipulation, pricing, disguised advertising, or forced continuity.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/desktop.png", "evidence/home/dom.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Blank submission is prevented by native required validation, focuses username, and provides “Please fill in this field.” without premature errors.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/invalid-state.json", "evidence/home/invalid.png" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "The only public authentication controls are username and password; both have an empty autocomplete attribute, and the DOM has no WebAuthn/passkey affordance.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/dom.json", "evidence/home/probe.json" ], "findingIds": [ "F05" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "blocked", "confidence": "high", "method": "Attempted public-path walkthrough and route discovery; authentication boundary encountered.", "evidence": "Checkout, betting, account, cancellation, and sensitive-action flows are behind authentication; no valid account was supplied.", "reason": "Checkout, betting, account, cancellation, and sensitive-action flows are behind authentication; no valid account was supplied.", "pathIds": [ "login" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "The images primitive reports one JPG with no width, height, srcset, or alt. Lighthouse also flags the unsized image; measured CLS remains low at 0.002.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/images.json", "evidence/home/lighthouse-summary.json", "evidence/home/layout-desktop.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/network", "evidence/home/network-summary.json", "evidence/home/lighthouse.json", "evidence/home/lighthouse-summary.json", "evidence/home/perf-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Targeted screenshot/DOM/evaluate plus corroborating automated evidence.", "evidence": "HAR records 38 requests and 808,051 transferred bytes, including 11 parser-blocking stylesheets, 15 scripts, two jQuery copies, and 328 KB of fonts. Lighthouse estimates 129 KiB unused JS and 60 KiB unused CSS, with throttled LCP 3.8 s.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/network", "evidence/home/network-summary.json", "evidence/home/lighthouse.json", "evidence/home/lighthouse-summary.json", "evidence/home/perf-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "This authenticated exchange exposes no declared agent-facing intent; emerging WebMCP capability is therefore out of scope.", "reason": "This authenticated exchange exposes no declared agent-facing intent; emerging WebMCP capability is therefore out of scope.", "pathIds": [ "login" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from reachable-surface recon.", "evidence": "The simple sign-in task has no appropriate summarisation, translation, or language-model use case.", "reason": "The simple sign-in task has no appropriate summarisation, translation, or language-model use case.", "pathIds": [ "login" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "After 10 representative focus/input/clear cycles, the independent post snapshot is 9.05 MB, only ~118 KB above baseline; no unbounded growth signal is visible.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/heap-baseline", "evidence/home/heap-post" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Direct targeted inspection of the public login surface.", "evidence": "Baseline heap is 8.94 MB self size / 165,479 nodes, proportionate though somewhat library-heavy for a simple page.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/heap-baseline", "evidence/home/network-summary.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Direct targeted inspection of the public login surface.", "evidence": "Neither heap summary exposes Detached* among retained constructors; 10 input cycles add only 12 closures and 9 arrays. Confidence is medium because raw retaining paths were not analysed.", "pathIds": [ "login" ], "artifacts": [ "evidence/home/heap-baseline", "evidence/home/heap-post" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "incomplete", "reason": "Authentication was attempted only to the public validation boundary; no valid account was supplied, so the post-login route/state transition could not be exercised." }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F06" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F03", "F02" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F07" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "pass" }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F09", "F05" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F08" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F05" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F07", "F06" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "This authenticated exchange exposes no declared agent-facing intent; emerging WebMCP capability is therefore out of scope. The simple sign-in task has no appropriate summarisation, translation, or language-model use case." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "login", "description": "Public authentication boundary and its validation states; represents all reachable first-party UI.", "url": "https://www.bpexch.live/Users/Login", "conditions": [ "desktop", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "keyboard focus", "blank required-field submission" ], "result": "issues" }, { "id": "login-performance", "description": "Cold-load performance, network, image, and resource-delivery profile of the login template.", "url": "https://www.bpexch.live/Users/Login", "conditions": [ "Lighthouse mobile throttling", "trace", "HAR" ], "result": "issues" }, { "id": "login-security", "description": "Transport headers, cookies, secrets, third parties, and public authentication affordances.", "url": "https://www.bpexch.live/Users/Login", "conditions": [ "cold unauthenticated load" ], "result": "issues" }, { "id": "not-found", "description": "Unknown-route failure and recovery state.", "url": "https://www.bpexch.live/definitely-not-a-real-route-404", "conditions": [ "HTTP 404" ], "result": "issues" }, { "id": "authenticated-exchange", "description": "Post-login exchange, account, commercial, and long-lived navigation templates were not covered because no valid credentials were supplied.", "url": "https://www.bpexch.live", "conditions": [ "authentication required" ], "result": "skipped" } ], "findings": [ { "id": "F01", "pathId": "login", "url": "https://www.bpexch.live/Users/Login", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "The login has one hard-coded dark appearance rather than responding to the user’s color-scheme preference.", "evidence": "Default and prefers-color-scheme: dark screenshots are byte-identical and the rendered CSS exposes no color-scheme preference adaptation.", "artifacts": [ "evidence/home/desktop.png", "evidence/home/dark.png", "evidence/home/dom.json" ], "suggestedFix": "Declare color-scheme and move surface, text, control, and browser-chrome colors into light/dark tokens selected with prefers-color-scheme or light-dark().", "effort": "small" }, { "id": "F02", "pathId": "login", "url": "https://www.bpexch.live/Users/Login", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Keyboard focus is not visibly exposed on the login controls.", "evidence": "After programmatically focusing #user_Username, computed outline is none, box-shadow is none, border is none, and the focused screenshot is visually unchanged.", "artifacts": [ "evidence/home/focus.png", "evidence/home/focus-state.json", "evidence/home/probe.json" ], "suggestedFix": "Add a high-contrast :focus-visible treatment to links, inputs, and the submit button without suppressing the browser outline unless it is replaced.", "effort": "small" }, { "id": "F03", "pathId": "login", "url": "https://www.bpexch.live/Users/Login", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "The login omits important accessible names and document structure.", "evidence": "axe reports a logo image without alt, two links without discernible text, no main landmark, no h1, and content outside landmarks; the two inputs use placeholders but no explicit labels.", "artifacts": [ "evidence/home/axe.json", "evidence/home/dom.json", "evidence/home/probe.json", "evidence/home/lighthouse-summary.json" ], "suggestedFix": "Add persistent