{ "url": "https://myaccount.google.com", "auditedAt": "2026-07-27T19:41:18.681Z", "mode": "report", "status": "completed", "statusDetail": "Coverage complete. Public unauthenticated account marketing, passkey, Sign in with Google, and authentication-entry templates were audited; authenticated account settings and credential submission were not covered.", "page": { "appType": "mpa", "framework": "Google marketing CMS / server-rendered account pages", "notes": "myaccount.google.com redirected unauthenticated Chrome to www.google.com/account/about/?hl=en-US. Authenticated account surfaces were unavailable without credentials." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "har", "discoverability", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "lighthouse", "axe-core", "curl raw HTML/robots/sitemap" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "dom", "path": "evidence/auth-probe.json", "caption": "auth probe" }, { "type": "screenshot", "path": "evidence/auth.png", "caption": "auth" }, { "type": "other", "path": "evidence/axe.json", "caption": "axe" }, { "type": "screenshot", "path": "evidence/contrast.png", "caption": "contrast" }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F006", "F007" ] }, { "type": "screenshot", "path": "evidence/dark.png", "caption": "dark", "findingIds": [ "F001" ] }, { "type": "screenshot", "path": "evidence/desktop.png", "caption": "desktop" }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [ "F008" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [ "F008" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [ "F008" ] }, { "type": "dom", "path": "evidence/dom.json", "caption": "dom", "findingIds": [ "F001" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F007" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "heap baseline", "findingIds": [ "F009" ] }, { "type": "heap", "path": "evidence/heap-post.json", "caption": "heap post" }, { "type": "other", "path": "evidence/images.json", "caption": "images" }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "layout mobile", "findingIds": [ "F004" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse", "findingIds": [ "F003", "F004" ] }, { "type": "screenshot", "path": "evidence/mobile.png", "caption": "mobile", "findingIds": [ "F002" ] }, { "type": "har-summary", "path": "evidence/network-summary.json", "caption": "network summary", "findingIds": [ "F005", "F006" ] }, { "type": "har", "path": "evidence/network.har", "caption": "network", "findingIds": [ "F005" ] }, { "type": "dom", "path": "evidence/passkeys-probe.json", "caption": "passkeys probe" }, { "type": "screenshot", "path": "evidence/passkeys.png", "caption": "passkeys" }, { "type": "trace-summary", "path": "evidence/perf-trace-summary.json", "caption": "perf trace summary", "findingIds": [ "F003" ] }, { "type": "trace", "path": "evidence/perf-trace.json", "caption": "perf trace" }, { "type": "dom", "path": "evidence/probe.json", "caption": "probe" }, { "type": "other", "path": "evidence/raw-headers.txt", "caption": "raw headers" }, { "type": "dom", "path": "evidence/raw.html", "caption": "raw" }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "reduced motion" }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots" }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets" }, { "type": "dom", "path": "evidence/sign-in-with-google-probe.json", "caption": "sign in with google probe" }, { "type": "screenshot", "path": "evidence/sign-in-with-google.png", "caption": "sign in with google" }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "sitemap" }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [ "F006" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Compared screenshots under default and prefers-color-scheme: dark.", "evidence": "The dark-emulated screenshot remains the same white surface and the DOM computed color-scheme is normal.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/dark.png", "evidence/dom.json" ], "findingIds": [ "F001" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Emulated prefers-reduced-motion: reduce and queried document animations.", "evidence": "Under prefers-reduced-motion: reduce, matchMedia was true and document.getAnimations() returned no active animations after load.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Emulated prefers-contrast: more; corroborated with Lighthouse and axe contrast audits.", "evidence": "Lighthouse accessibility scored 1.0, axe reported no violations, and increased-contrast rendering retained visible text and controls.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "pass", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "Public route changes are ordinary full navigations; each destination renders a coherent first state with no jarring in-page state swap observed.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "No scroll-linked animation or scrollytelling interaction exists on the representative pages.", "reason": "No scroll-linked animation or scrollytelling interaction exists on the representative pages." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "No gesture-driven control, carousel, swipe action, or scroll-snap surface exists on the audited public templates.", "reason": "No gesture-driven control, carousel, swipe action, or scroll-snap surface exists on the audited public templates." }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "Desktop navigation remains orienting and mobile collapses to a menu while the primary account action stays visible.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "No tooltip, popover, or edge-positioned menu was present on the audited states.", "reason": "No tooltip, popover, or edge-positioned menu was present on the audited states." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "Skip link, selected navigation state, headings, and prominent blue primary actions make destination and focus clear.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "At 360x800 the fixed cookie bar occupies about the bottom 194px and visibly covers the hero copy until consent.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/mobile.png" ], "findingIds": [ "F002" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "not-applicable", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "The only interruption is a simple non-modal cookie bar, not a disclosure, transient popover, or modal flow requiring these primitives.", "reason": "The only interruption is a simple non-modal cookie bar, not a disclosure, transient popover, or modal flow requiring these primitives." }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "Desktop and mobile screenshots show restrained navigation and large content-first areas.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Captured 360x800 screenshot and layout metrics.", "evidence": "Layout reported scrollWidth 360, clientWidth 360, and horizontalOverflowPx 0 at 360x800.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "medium", "method": "Reviewed screenshots, rendered DOM, representative paths, and relevant objective evidence.", "evidence": "The same header, hero, imagery and content columns recompose into a single-column 360px layout without clipping.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "Inspected target dimensions, skip link, labels, and Lighthouse accessibility results.", "evidence": "Primary buttons are 48-50px tall, a Jump to Content link exists, labels are present, and Lighthouse accessibility scored 1.0.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Reviewed first viewport on desktop/mobile and representative page headings/actions.", "evidence": "All three public templates have specific H1s and prominent actions such as Go to Google Account, Create a passkey, and Review your connections.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Walked from landing page to passkey, Sign in with Google, and identifier sign-in surfaces.", "evidence": "The unauthenticated journey reaches the labelled Google identifier form and passkey/account destinations without a dead end; credential submission was outside audit scope.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "high", "method": "Inspected cookie consent and sign-in entry states; did not submit credentials.", "evidence": "The public pages clearly distinguish marketing, consent, and sign-in states; browser back remains available and no context loss was observed before credential submission.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Ran Lighthouse mobile plus a CDP performance trace.", "evidence": "Mobile Lighthouse measured LCP 4.9s, TBT 850ms and CLS 0.175 (performance 0.40), outside good ranges; desktop trace LCP was 1.90s.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/lighthouse.json", "evidence/perf-trace-summary.json" ], "findingIds": [ "F003" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Ran layout shift observer at 360x800 and Lighthouse CLS.", "evidence": "The 360px layout observer recorded CLS 0.1493 at about 4.44s and Lighthouse recorded 0.175.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/layout-mobile.json", "evidence/lighthouse.json" ], "findingIds": [ "F004" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Read trace long tasks/TBT and Lighthouse TBT.", "evidence": "CDP trace found one 51.19ms long task and 1.19ms TBT on desktop, although Lighthouse mobile TBT was 850ms; mobile variability is covered by F003.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Read compact HAR summary and confirmed parser-inserted resources.", "evidence": "HAR recorded 295 requests and 3,388,173 transferred bytes, including 24 fonts/993,856 bytes, 43 fetches/1,861,554 bytes and six render-blocking candidates.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "findingIds": [ "F005" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Used Lighthouse performance diagnostics and HAR script/third-party transfer totals.", "evidence": "HAR recorded 434,569 script bytes plus 288,298 bytes from Tag Manager; Lighthouse performance was 0.40 on the content-light page.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/network-summary.json", "evidence/lighthouse.json" ], "findingIds": [ "F005" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "pass", "confidence": "high", "method": "Ran axe-core and Lighthouse accessibility; inspected headings, landmarks and auth labels.", "evidence": "axe found zero violations (48 passing rule groups), Lighthouse accessibility scored 1.0, images had alt text, and the identifier input had a visible label.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Ran axe-core and Lighthouse contrast audits under normal and increased contrast.", "evidence": "axe found no contrast violation and Lighthouse accessibility scored 1.0; six axe contrast nodes required manual review and remained legible in screenshots.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "pass", "confidence": "high", "method": "Inspected landmarks/heading hierarchy/skip link and Lighthouse accessibility.", "evidence": "The DOM has header/nav/main/footer landmarks, one H1 followed by H2s, and a Jump to Content link; Lighthouse accessibility scored 1.0.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Visually reviewed desktop and 360px screenshots.", "evidence": "Desktop and mobile screenshots show unclipped, readable body text and clear heading hierarchy; reflow remains coherent.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "high", "method": "Inspected viewport policy, 360px reflow, targets, alt text and Lighthouse.", "evidence": "Viewport permits scaling to 5, mobile has no overflow, primary targets are at least 48px high, and the image audit found no missing alt/dimensions.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Read Lighthouse errors-in-console audit.", "evidence": "Lighthouse errors-in-console returned no items and best-practices scored 1.0.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "pass", "confidence": "high", "method": "Inspected doctype/viewport/DOM and ran image audit and Lighthouse.", "evidence": "DOCTYPE html and viewport are present; image audit found no missing dimensions, oversized images, missing srcset, legacy formats, or missing alt.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "Used Lighthouse best-practices and DOM probes for prompts/forms.", "evidence": "Lighthouse best-practices scored 1.0; no load-time permission prompt or paste-prevention behavior was observed.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Read title and meta description on three public templates.", "evidence": "Overview, passkeys, and Sign in with Google each expose a distinct descriptive title, meta description, and H1.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Inspected hrefs/viewport/robots and ran Lighthouse SEO plus discoverability.", "evidence": "Lighthouse SEO scored 0.92 and links/viewport were valid, but the non-JS crawler request received HTTP 429 and only 12% rendered-word overlap.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/lighthouse.json" ], "findingIds": [ "F008" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "Inspected canonical/robots/sitemap/status and Lighthouse SEO.", "evidence": "Browser navigation succeeded after two expected redirects; canonical, robots.txt, and sitemap signals exist and Lighthouse robots/crawlable audits passed.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "high", "method": "Inspected JSON-LD and Open Graph metadata against visible content.", "evidence": "Overview exposes one JSON-LD block and complete Open Graph title/url/description/image metadata aligned with visible content.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Ran headers, cookies, HAR and secrets primitives.", "evidence": "HTTPS, nosniff and a Secure/HttpOnly/SameSite=Lax cookie were present, but the final response audit found no CSP or HSTS.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F007" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Ran HAR, cookies and tracker inventory.", "evidence": "Tracker audit found Google Tag Manager and Google Analytics; HAR attributed 102 requests and 3,379,611 bytes to origins classed third-party relative to myaccount.google.com.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/trackers.json", "evidence/network-summary.json" ], "findingIds": [ "F006" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "pass", "confidence": "high", "method": "Inspected auth journey and passkey page; checked for load-time prompts.", "evidence": "No permission prompt fired on load; passkey education and Create a passkey actions are prominent, and sign-in uses username autocomplete.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Ran response-header and cookie audits.", "evidence": "Header audit found no CSP/frame protection, HSTS, Referrer-Policy, or Permissions-Policy on the inspected final page response.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/headers.json" ], "findingIds": [ "F007" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Compared rendered page with raw/non-JS crawler evidence and direct raw fetch.", "evidence": "The discoverability non-JS request received 429, exposed 12% word overlap, and lacked raw title/H1/description for the rendered marketing page.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/raw.html" ], "findingIds": [ "F008" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Reviewed load, mobile menu/chrome, cookie UI, and representative routes.", "evidence": "Representative pages and mobile chrome rendered coherently; no cut-off menu or blank runtime state was observed.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Checked manifest/service-worker signals and site purpose.", "evidence": "This public account marketing/sign-in entry is intrinsically online and is not presented as an installable app.", "reason": "This public account marketing/sign-in entry is intrinsically online and is not presented as an installable app." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Observed crawler HTTP 429 response and the rendered recovery outcome.", "evidence": "The crawler-facing HTTP 429 response provides a generic error payload rather than the intended account content or a useful recovery route.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/discoverability.json" ], "findingIds": [ "F008" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Inspected html lang/dir and localized route output.", "evidence": "The overview reports lang=en-US and dir=ltr, and Google serves localized URL/content variants; layout survived mobile reflow.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Reviewed the representative pages for locale-sensitive values.", "evidence": "The audited public templates contain no dates, currencies, quantities, or other locale-sensitive data.", "reason": "The audited public templates contain no dates, currencies, quantities, or other locale-sensitive data." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Reviewed the representative pages for time/date concepts.", "evidence": "The audited public templates expose no dates, events, schedules, or time-zone-sensitive concepts.", "reason": "The audited public templates expose no dates, events, schedules, or time-zone-sensitive concepts." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Reviewed cookie, sign-in, passkey and account action presentation.", "evidence": "Cookie consent has neutral Learn more and OK, got it choices; account/passkey actions state their destinations without confirmshaming or disguised ads.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "medium", "method": "Inspected sign-in form entry state without submitting personal credentials.", "evidence": "The credential form begins with a clearly labelled Email or phone field and a predictable Next action; no invalid submission was made to avoid sending test credentials.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "pass", "confidence": "high", "method": "Inspected sign-in input labels and autocomplete tokens.", "evidence": "Identifier input is visibly labelled Email or phone and uses autocomplete=username.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "Walked public account/passkey/sign-in entry points and inspected action clarity.", "evidence": "Passkey and account-management entry actions are plainly labelled, and sensitive continuation redirects to Google reauthentication.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "pass", "confidence": "high", "method": "Ran image audit and read HAR resource breakdown.", "evidence": "Image audit found dimensions, srcset, modern served formats and no oversized raster images; three below-fold images were not lazy but are only 160px assets.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Read trace, HAR, tracker inventory and baseline heap summary.", "evidence": "A content-light landing page transfers 3.39MB over 295 requests, including 204 image/Lottie requests and 43 fetches.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/network-summary.json", "evidence/perf-trace-summary.json" ], "findingIds": [ "F005" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Read HAR third-party/font/media totals and inspected page media.", "evidence": "HAR reports 3.38MB classed third-party, 994KB of fonts and 288KB Tag Manager; the page uses many decorative Lottie assets.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/network-summary.json", "evidence/trackers.json" ], "findingIds": [ "F005", "F006" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Inspected DOM/metadata and considered the high-risk account context.", "evidence": "Agent actions are not appropriate on a sensitive unauthenticated account and credential entry surface without an explicit safe capability model.", "reason": "Agent actions are not appropriate on a sensitive unauthenticated account and credential entry surface without an explicit safe capability model." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Inspected page capabilities and considered whether inference fits the page purpose.", "evidence": "No summarisation, generation, translation, or inference task is part of these account entry pages.", "reason": "No summarisation, generation, translation, or inference task is part of these account entry pages." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "not-applicable", "confidence": "high", "method": "Assessed whether the unauthenticated marketing page has a representative repeatable interaction.", "evidence": "The unauthenticated marketing page has no representative stateful interaction to repeat; scrolling was not fabricated as a leak test.", "reason": "The unauthenticated marketing page has no representative stateful interaction to repeat; scrolling was not fabricated as a leak test." }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "high", "method": "Captured and read a baseline heap summary.", "evidence": "Baseline heap summary measured 539,263 nodes and 25,562,930 self-size bytes on a static marketing page, with 17,464 Float32Arrays and 17,468 ArrayBuffers.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ], "artifacts": [ "evidence/heap-baseline.json" ], "findingIds": [ "F009" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Read baseline heap constructors for Detached populations.", "evidence": "The baseline heap constructor summary contained no Detached* constructor population; no repeated stateful interaction exists to test accumulation.", "pathIds": [ "overview", "passkeys", "sign-in-with-google", "auth-entry" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F001" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "pass" }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F002" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "pass" }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F003", "F004", "F005" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "pass" }, { "principleId": "follow-best-practices", "expectation": "default", "status": "pass" }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F008" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F007", "F006" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F008" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F005", "F006" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "Agent actions are not appropriate on a sensitive unauthenticated account and credential entry surface without an explicit safe capability model. No summarisation, generation, translation, or inference task is part of these account entry pages." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F009" ] } ], "paths": [ { "id": "overview", "description": "Unauthenticated overview marketing template and primary account entry; tested desktop, mobile, dark, increased contrast, reduced motion, network, performance, no-JS and memory conditions.", "url": "https://myaccount.google.com", "conditions": [ "1440x900", "360x800", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "non-JavaScript crawler" ], "result": "issues" }, { "id": "passkeys", "description": "Passkey education/detail template and Create a passkey action.", "url": "https://www.google.com/account/about/passkeys/", "conditions": [ "1440x900", "unauthenticated" ], "result": "pass" }, { "id": "sign-in-with-google", "description": "Sign in with Google detail template and account connection actions.", "url": "https://www.google.com/account/about/sign-in-with-google/", "conditions": [ "1440x900", "unauthenticated" ], "result": "pass" }, { "id": "auth-entry", "description": "Google Account authentication entry through the labelled identifier step; no credentials submitted.", "url": "https://accounts.google.com/ServiceLogin?service=accountsettings&continue=https://myaccount.google.com", "conditions": [ "1440x900", "unauthenticated", "credential submission excluded" ], "result": "pass" } ], "findings": [ { "id": "F001", "pathId": "overview", "url": "https://www.google.com/account/about/?hl=en-US", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "css", "severity": "medium", "confidence": "high", "summary": "The public Google Account pages do not honor the user’s dark color-scheme preference.", "evidence": "The prefers-color-scheme: dark screenshot remains white and computed color-scheme is normal.", "artifacts": [ "evidence/dark.png", "evidence/dom.json" ], "suggestedFix": "Declare color-scheme and use preference-driven light/dark surface and text tokens, preserving brand contrast.", "effort": "medium" }, { "id": "F002", "pathId": "overview", "url": "https://www.google.com/account/about/?hl=en-US", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "severity": "high", "confidence": "high", "summary": "The fixed cookie notice obscures a substantial part of the mobile hero.", "evidence": "At 360x800, the notice covers roughly the bottom 194px and overlaps hero copy until accepted.", "artifacts": [ "evidence/mobile.png" ], "suggestedFix": "Use a compact, non-overlapping consent treatment with a clear choice and persist the decision; avoid covering primary content.", "effort": "small" }, { "id": "F003", "pathId": "overview", "url": "https://www.google.com/account/about/?hl=en-US", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "Mobile load performance is outside good Core Web Vitals ranges.", "evidence": "Lighthouse measured LCP 4.9s, TBT 850ms, CLS 0.175 and performance 0.40; desktop trace LCP was 1.90s, showing condition sensitivity.", "artifacts": [ "evidence/lighthouse.json", "evidence/perf-trace-summary.json" ], "suggestedFix": "Prioritize the LCP content, reduce startup JavaScript and animation work, and defer non-critical third-party/decorative resources.", "effort": "large" }, { "id": "F004", "pathId": "overview", "url": "https://www.google.com/account/about/?hl=en-US", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "visually-stable-font-fallbacks", "guidanceCategory": "performance", "severity": "medium", "confidence": "high", "summary": "The mobile page shifts visibly after initial layout.", "evidence": "CDP layout observer recorded CLS 0.1493 at 4.44s; Lighthouse recorded CLS 0.175.", "artifacts": [ "evidence/layout-mobile.json", "evidence/lighthouse.json" ], "suggestedFix": "Identify the late shifting element, reserve its final space, and use metric-compatible font fallbacks and stable consent placement.", "effort": "medium" }, { "id": "F005", "pathId": "overview", "url": "https://www.google.com/account/about/?hl=en-US", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-preload-priority", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "The content-light landing page ships an excessive request, font, fetch, and decorative-animation payload.", "evidence": "HAR captured 295 requests/3.39MB, including 24 fonts/994KB, 43 fetches/1.86MB, 204 image/Lottie requests and six render-blocking candidates.", "artifacts": [ "evidence/network.har", "evidence/network-summary.json" ], "suggestedFix": "Subset and consolidate fonts, defer below-fold Lottie/assets, remove unused bundles, and ensure only true critical resources block rendering.", "effort": "large" }, { "id": "F006", "pathId": "overview", "url": "https://www.google.com/account/about/?hl=en-US", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "severity": "medium", "confidence": "high", "summary": "The unauthenticated account landing page loads a large analytics and cross-origin footprint.", "evidence": "Tracker inventory found Tag Manager and Analytics; HAR classed 102 requests/3.38MB as third-party relative to myaccount.google.com, and a Google cookie lasts 396 days.", "artifacts": [ "evidence/trackers.json", "evidence/network-summary.json", "evidence/cookies.json" ], "suggestedFix": "Minimize pre-consent analytics and cross-origin requests, shorten non-essential retention, and load analytics only after an applicable consent signal.", "effort": "large" }, { "id": "F007", "pathId": "overview", "url": "https://www.google.com/account/about/?hl=en-US", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "Several baseline browser-enforced response defenses are absent on the inspected final page.", "evidence": "Header audit found no CSP, HSTS, frame protection, Referrer-Policy, or Permissions-Policy; nosniff was present and the cookie was Secure/HttpOnly/Lax.", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "suggestedFix": "Add a restrictive CSP including frame-ancestors, HSTS, Referrer-Policy and a least-privilege Permissions-Policy on the final marketing response.", "effort": "medium" }, { "id": "F008", "pathId": "overview", "url": "https://myaccount.google.com", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "The non-JavaScript crawler path is rate-limited and does not expose the intended marketing content.", "evidence": "Discoverability fetch returned HTTP 429, only 12% rendered-word overlap, and no matching raw title/H1/description; Lighthouse’s browser SEO score was 0.92.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/discoverability-rendered.png" ], "suggestedFix": "Serve stable semantic HTML and metadata to legitimate non-JS crawlers, and return an actionable Retry-After/recovery response when rate limiting is necessary.", "effort": "medium" }, { "id": "F009", "pathId": "overview", "url": "https://www.google.com/account/about/?hl=en-US", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "defer-rendering-heavy-content", "guidanceCategory": "performance", "severity": "medium", "confidence": "medium", "summary": "The static marketing page starts with a disproportionately large object and graphics footprint.", "evidence": "Baseline heap summary measured 539,263 nodes and 25.56MB self size, including about 17.5k Float32Arrays and ArrayBuffers, consistent with many Lottie assets.", "artifacts": [ "evidence/heap-baseline.json" ], "suggestedFix": "Instantiate decorative animations only near the viewport, release animation buffers after completion, and prefer static assets where motion adds little value.", "effort": "medium" } ], "taskList": [ { "id": "T001", "title": "Cut mobile startup work and stabilize the initial viewport", "priority": 1, "findingIds": [ "F003", "F004", "F005", "F009" ], "guidanceId": "performance", "status": "open" }, { "id": "T002", "title": "Add missing browser-enforced security policies", "priority": 2, "findingIds": [ "F007" ], "guidanceId": "security", "status": "open" }, { "id": "T003", "title": "Replace the content-obscuring mobile cookie bar", "priority": 3, "findingIds": [ "F002" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" }, { "id": "T004", "title": "Minimize analytics, third-party requests, fonts and decorative Lottie payload", "priority": 4, "findingIds": [ "F005", "F006", "F009" ], "guidanceId": "defer-rendering-heavy-content", "status": "open" }, { "id": "T005", "title": "Honor the system color scheme", "priority": 5, "findingIds": [ "F001" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T006", "title": "Serve stable semantic content or actionable throttling to non-JS crawlers", "priority": 6, "findingIds": [ "F008" ], "guidanceId": "html", "status": "open" } ], "budget": { "pathCount": 4, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-27T19-41-18-681Z" }