{ "url": "https://m.easytrader.ir", "auditedAt": "2026-07-27T23:57:53.815Z", "mode": "report", "status": "partial", "statusDetail": "The public authentication, registration, and recovery surfaces were audited. Five checks are blocked because the primary trading and sensitive account flows require credentials and account state.", "page": { "appType": "hybrid", "framework": "Angular entry application redirecting to server-rendered identity pages", "notes": "The entry boots an app and redirects through OIDC to login.emofid.com. Authenticated trading routes were not accessible." }, "config": { "loaded": false }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "har", "trace", "heap-summary", "Lighthouse" ], "guidanceConsulted": [ "dark-mode", "accessibility", "fluid-scaling", "performance", "identify-heavy-scripts", "privacy", "security", "html", "accessible-error-announcement", "autofill-sign-in-form", "efficient-background-processing", "forms" ], "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 53, "blocked": 5, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": false }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F01.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F01" ], "artifacts": [ "evidence/dark.png", "evidence/preferences-focus.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "The reduced-motion probe reports zero active animations on the sign-in surface.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Lighthouse contrast checks pass and controls remain visually distinguishable; no custom scrollbar or forced-colour-hostile styling was observed.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Navigation links use ordinary document navigation; changes are predictable and no jarring custom state swap was observed.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "No scroll-linked animation is present, so no main-thread scroll-handler anti-pattern was observed.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "The forms use native scrolling and controls; no custom gesture implementation fights platform behavior.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "No affixed navigation chrome is present on these short form pages; scrolling remains unobstructed.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "No tooltip, popover, or menu surface appears on the accessible authentication pages.", "pathIds": [ "login", "register", "forgot" ], "status": "not-applicable", "reason": "No tooltip, popover, or menu surface appears on the accessible authentication pages." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Clear labels, primary buttons, and back links maintain orientation across the three accessible account pages.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Load screenshots show no popup, interstitial, or consent wall obscuring the forms.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "No overlay or disclosure component appears on the accessible authentication pages.", "pathIds": [ "login", "register", "forgot" ], "status": "not-applicable", "reason": "No overlay or disclosure component appears on the accessible authentication pages." }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Screenshots show a focused form with restrained decoration and security guidance.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Layout at 390x844 reports scrollWidth 390, clientWidth 390, and zero horizontal overflow.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Login, registration, and recovery forms reflow to the 390px viewport without clipping; responsive utility classes are present in rendered markup.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F02.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F02" ], "artifacts": [ "evidence/preferences-focus.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Each accessible page has a prominent Persian task title and one visually dominant submit action.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "confidence": "high", "method": "Attempted representative journey from the public entry URL", "evidence": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided.", "pathIds": [ "login", "register", "forgot" ], "status": "blocked", "reason": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided." }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Required-field messages appear after submit and forgot-password/back paths are visible, although announcement defects are recorded separately.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F04.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F04" ], "artifacts": [ "evidence/lighthouse.json", "evidence/performance-trace-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Layout observer measured CLS 0 and Lighthouse measured CLS 0.001.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F04.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F04" ], "artifacts": [ "evidence/lighthouse.json", "evidence/performance-trace-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F05.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F05" ], "artifacts": [ "evidence/network-summary.json", "evidence/lighthouse.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F05.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F05" ], "artifacts": [ "evidence/network-summary.json", "evidence/lighthouse.json" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F02.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F02" ], "artifacts": [ "evidence/preferences-focus.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Lighthouse color-contrast audit passed and the screenshots show legible foreground/background pairs.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F11, F02.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F11", "F02" ], "artifacts": [ "evidence/semantics.json", "evidence/mobile.png", "evidence/preferences-focus.json" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Persian labels and guidance are readable without clipping at 390px.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F03.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F03" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Lighthouse recorded no browser console errors.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F13.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F13" ], "artifacts": [ "evidence/lighthouse.json", "evidence/images.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F13.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F13" ], "artifacts": [ "evidence/lighthouse.json", "evidence/images.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F08.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F08" ], "artifacts": [ "evidence/discoverability.json", "evidence/lighthouse.json", "evidence/platform.json", "evidence/robots.txt", "evidence/sitemap.xml" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Visible links use real href values, viewport metadata exists, and link text is descriptive; zoom restriction is tracked under inclusion.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F08.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F08" ], "artifacts": [ "evidence/discoverability.json", "evidence/lighthouse.json", "evidence/platform.json", "evidence/robots.txt", "evidence/sitemap.xml" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "The authentication form is not an article, product, event, or other rich entity requiring schema.org data; basic sharing metadata is judged separately.", "pathIds": [ "login", "register", "forgot" ], "status": "not-applicable", "reason": "The authentication form is not an article, product, event, or other rich entity requiring schema.org data; basic sharing metadata is judged separately." }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F07, F06.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F07", "F06" ], "artifacts": [ "evidence/headers.json", "evidence/trackers.json", "evidence/cookies.json", "evidence/network-summary.json" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F06.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F06" ], "artifacts": [ "evidence/trackers.json", "evidence/cookies.json", "evidence/network-summary.json" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F10.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F10" ], "artifacts": [ "evidence/semantics.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F07.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F07" ], "artifacts": [ "evidence/headers.json" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F12.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F12" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "DOM, screenshot, Lighthouse, and targeted evaluate probes on the login, registration, and recovery surfaces.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "A regulated real-time trading service is intrinsically online; an installable/offline transaction flow is not appropriate, though failure recovery remains relevant.", "pathIds": [ "login", "register", "forgot" ], "status": "not-applicable", "reason": "A regulated real-time trading service is intrinsically online; an installable/offline transaction flow is not appropriate, though failure recovery remains relevant." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "confidence": "high", "method": "Attempted representative journey from the public entry URL", "evidence": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided.", "pathIds": [ "login", "register", "forgot" ], "status": "blocked", "reason": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided." }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "The rendered document declares lang=\"fa\" and body dir=\"rtl\"; Persian reading order is correct on all screenshots.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "confidence": "high", "method": "Attempted representative journey from the public entry URL", "evidence": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided.", "pathIds": [ "login", "register", "forgot" ], "status": "blocked", "reason": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided." }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "confidence": "high", "method": "Attempted representative journey from the public entry URL", "evidence": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided.", "pathIds": [ "login", "register", "forgot" ], "status": "blocked", "reason": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "No confirmshaming, forced continuity, consent nag, disguised advertising, or preselected commercial option appears on accessible account pages.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F09.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F09" ], "artifacts": [ "evidence/form-validation.json" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F10.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F10" ], "artifacts": [ "evidence/semantics.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "confidence": "high", "method": "Attempted representative journey from the public entry URL", "evidence": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided.", "pathIds": [ "login", "register", "forgot" ], "status": "blocked", "reason": "Authentication and a funded account are required to inspect the trading application or complete this sensitive journey; no credentials were provided." }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Only two small SVG logos are used; no oversized raster media was found.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/mobile.png" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F14.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F14" ], "artifacts": [ "evidence/network-summary.json", "evidence/trackers.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Direct evidence recorded in finding(s) F06, F14.", "pathIds": [ "login", "register", "forgot" ], "status": "issues", "findingIds": [ "F06", "F14" ], "artifacts": [ "evidence/trackers.json", "evidence/cookies.json", "evidence/network-summary.json" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "No declared agent-facing surface exists, and exposing trading/authentication actions to agents is not assumed safe or intended.", "pathIds": [ "login", "register", "forgot" ], "status": "not-applicable", "reason": "No declared agent-facing surface exists, and exposing trading/authentication actions to agents is not assumed safe or intended." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "confidence": "high", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "The sign-in and account-recovery surfaces have no inference use case where built-in AI would improve the task.", "pathIds": [ "login", "register", "forgot" ], "status": "not-applicable", "reason": "The sign-in and account-recovery surfaces have no inference use case where built-in AI would improve the task." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "confidence": "low", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "After 10 repeated password-visibility open/close cycles, the post heap was 9.14MB; growth is bounded and no continuing interaction-time accumulation was observed in this short test.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/heap.json", "evidence/heap-post.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "confidence": "low", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Baseline heap totals are 190,291 nodes and 8.57MB self size, proportionate to the loaded app/auth bootstrap.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/heap.json", "evidence/heap-post.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "confidence": "low", "method": "Multi-modal inspection of representative unauthenticated account surfaces", "evidence": "Heap summaries contain no Detached* constructor among reported populations after repeated password visibility toggles.", "pathIds": [ "login", "register", "forgot" ], "status": "pass", "artifacts": [ "evidence/heap.json", "evidence/heap-post.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "pass" }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "incomplete", "reason": "One or more checks require access to the authenticated trading or account journey." }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F02", "F11", "F03" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F08" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F06", "F10" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F12" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "incomplete", "reason": "One or more checks require access to the authenticated trading or account journey." }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F14", "F06" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "No agent-facing capability is intended for this sensitive authentication/trading surface." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "login", "description": "Public OIDC sign-in surface, the mandatory entry path for EasyTrader.", "url": "https://m.easytrader.ir", "conditions": [ "390x844", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "keyboard focus", "empty form submission" ], "result": "issues" }, { "id": "register", "description": "Registration archetype linked from sign-in.", "url": "https://login.emofid.com/Register", "conditions": [ "390x844" ], "result": "issues" }, { "id": "forgot", "description": "Password recovery archetype linked from sign-in.", "url": "https://login.emofid.com/ForgotPassword", "conditions": [ "390x844" ], "result": "issues" }, { "id": "authenticated-trading", "description": "Primary trading dashboard and transaction journey; not covered because credentials and funded account state were unavailable.", "url": "https://m.easytrader.ir", "conditions": [ "authenticated account required" ], "result": "skipped" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "summary": "The sign-in experience ignores the user’s dark-colour preference.", "evidence": "The dark-mode screenshot is pixel-identical to the light capture; the computed probe reports colorScheme \"normal\" and body background rgb(237, 240, 242) under prefers-color-scheme: dark.", "suggestedFix": "Declare color-scheme and provide preference-driven dark tokens with prefers-color-scheme or light-dark().", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "artifacts": [ "evidence/dark.png", "evidence/preferences-focus.json" ], "effort": "small", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F02", "severity": "high", "confidence": "high", "summary": "Keyboard access and focus treatment fail on security controls.", "evidence": "The focus probe reports a transparent 2px outline and no box shadow. Three 28x28 DIV controls with onclick handlers have tabIndex -1 and no role or accessible name.", "suggestedFix": "Use native buttons for password visibility and virtual-keyboard controls, provide accessible names, at least 44x44 hit areas, and a clearly visible :focus-visible treatment.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "artifacts": [ "evidence/preferences-focus.json" ], "effort": "small", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F03", "severity": "high", "confidence": "high", "summary": "Mobile zoom is explicitly disabled.", "evidence": "Lighthouse fails meta-viewport because the page sets user-scalable=no; this prevents users with low vision from zooming.", "suggestedFix": "Remove user-scalable=no and preserve reflow at 200% to 400% zoom.", "guidanceId": "fluid-scaling", "guidanceCategory": "user-experience", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "artifacts": [ "evidence/lighthouse.json" ], "effort": "trivial", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F04", "severity": "high", "confidence": "high", "summary": "The authentication entry is very slow to become useful.", "evidence": "Lighthouse measured FCP 11.1s, LCP 15.6s and TBT 300ms (performance score 0.49); the CDP trace corroborates a 6.01s LCP and a 143ms long task.", "suggestedFix": "Shorten the redirect/bootstrap critical path, prioritize the actual LCP, and defer nonessential scripts until after the login UI is usable.", "guidanceId": "performance", "guidanceCategory": "performance", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "artifacts": [ "evidence/lighthouse.json", "evidence/performance-trace-summary.json" ], "effort": "large", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F05", "severity": "high", "confidence": "high", "summary": "Script, cache, and render-blocking costs are disproportionate for a login form.", "evidence": "HAR records 2.98MB across 52 requests, including 2.63MB script; main-UZTPUCD5.js is 1.42MB with no cache header. Lighthouse estimates 209KiB unused JS and 82KiB unused CSS, and identifies parser-blocking classic scripts.", "suggestedFix": "Serve the login route without booting the full trading bundle, split route code, defer classic scripts, remove duplicate analytics loads, compress text, and apply immutable caching to fingerprinted assets.", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "artifacts": [ "evidence/network-summary.json", "evidence/lighthouse.json" ], "effort": "large", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F06", "severity": "high", "confidence": "high", "summary": "Analytics and cookie defaults expose more user data than necessary on a sensitive sign-in path.", "evidence": "Trackers evidence finds Google Tag Manager and Google Analytics; HAR attributes 1.31MB and 28 requests to third parties. Cookie audit finds three cookies without Secure and SameSite=None, including two 400-day GA cookies.", "suggestedFix": "Minimise analytics on authentication pages, eliminate duplicate tags, obtain appropriate consent, and set Secure plus an appropriate SameSite value on retained cookies.", "guidanceId": "privacy", "guidanceCategory": "privacy", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "artifacts": [ "evidence/trackers.json", "evidence/cookies.json", "evidence/network-summary.json" ], "effort": "medium", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F07", "severity": "high", "confidence": "high", "summary": "Browser security policy is incomplete and the CSP permits unsafe script execution.", "evidence": "Headers evidence shows a CSP containing unsafe-inline and unsafe-eval, while Referrer-Policy and Permissions-Policy are absent. HSTS, nosniff and frame-ancestors are present.", "suggestedFix": "Remove unsafe-eval, migrate inline scripts/styles to nonces or hashes, and add restrictive Referrer-Policy and Permissions-Policy headers.", "guidanceId": "security", "guidanceCategory": "security", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "artifacts": [ "evidence/headers.json" ], "effort": "medium", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F08", "severity": "medium", "confidence": "high", "summary": "The public authentication surface has weak crawler and sharing metadata.", "evidence": "Lighthouse reports no meta description. DOM/platform probes find no canonical, Open Graph metadata, JSON-LD, or heading; discoverability reports 0% word overlap and no raw title, while /robots.txt and /sitemap.xml both return the 15,897-byte app HTML rather than directives/XML.", "suggestedFix": "Serve correct robots.txt and sitemap responses; add a description, canonical, semantic heading, and accurate sharing metadata to the public authentication landing surface.", "guidanceId": "html", "guidanceCategory": "html", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "artifacts": [ "evidence/discoverability.json", "evidence/lighthouse.json", "evidence/platform.json", "evidence/robots.txt", "evidence/sitemap.xml" ], "effort": "small", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F09", "severity": "high", "confidence": "high", "summary": "Sign-in error feedback is not announced to assistive technology.", "evidence": "After empty submit, Persian error text appears in spans, but the probe finds no role, aria-live, or aria-invalid on either invalid input.", "suggestedFix": "Mark invalid fields with aria-invalid, connect messages via aria-describedby, and announce the error summary or field messages using an appropriate live region after submission.", "guidanceId": "accessible-error-announcement", "guidanceCategory": "forms", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "artifacts": [ "evidence/form-validation.json" ], "effort": "small", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F10", "severity": "high", "confidence": "high", "summary": "The sign-in form disables password-manager and autofill support.", "evidence": "The username input has no autocomplete token and the password field explicitly sets autocomplete=\"off\".", "suggestedFix": "Use autocomplete=\"username\" and autocomplete=\"current-password\"; allow password managers and offer passkey sign-in where the identity system supports it.", "guidanceId": "autofill-sign-in-form", "guidanceCategory": "forms", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "artifacts": [ "evidence/semantics.json" ], "effort": "trivial", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F11", "severity": "medium", "confidence": "high", "summary": "The document lacks semantic heading structure.", "evidence": "The DOM probe reports zero h1/h2/h3 elements, while the visual title “ورود به ایزی تریدر” is rendered with generic div/span markup.", "suggestedFix": "Mark the page title as h1 and preserve a logical heading/landmark hierarchy across sign-in, registration, and password recovery.", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "artifacts": [ "evidence/semantics.json", "evidence/mobile.png" ], "effort": "trivial", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F12", "severity": "medium", "confidence": "high", "summary": "The unauthenticated route does not progressively expose its purpose.", "evidence": "Discoverability found 0% overlap, no title in raw HTML, and a crawler screenshot that differs from the rendered login. The raw entry requires JavaScript and redirects before exposing the login content.", "suggestedFix": "Return meaningful server-rendered authentication content and links in the initial HTML, with enhancement for the OIDC flow rather than an opaque JS bootstrap.", "guidanceId": "html", "guidanceCategory": "html", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "effort": "large", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F13", "severity": "low", "confidence": "high", "summary": "Document and platform hygiene have avoidable defects.", "evidence": "Lighthouse reports a deprecated unload listener and an unsized logo; the images primitive confirms both logos lack complete width/height dimensions.", "suggestedFix": "Remove unload listeners, use pagehide/visibilitychange where needed, and set both width and height (or aspect-ratio) on logos.", "guidanceId": "html", "guidanceCategory": "html", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "artifacts": [ "evidence/lighthouse.json", "evidence/images.json" ], "effort": "small", "pathId": "login", "url": "https://m.easytrader.ir" }, { "id": "F14", "severity": "medium", "confidence": "high", "summary": "The page performs substantial nonessential background and third-party work.", "evidence": "HAR records 31 script requests and 1.31MB third-party transfer for a small login form; duplicate GTM/gtag resources dominate several top transfer entries.", "suggestedFix": "Load a single minimal analytics path only after it is justified, batch events, and avoid booting unrelated app code on the login route.", "guidanceId": "efficient-background-processing", "guidanceCategory": "performance", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "artifacts": [ "evidence/network-summary.json", "evidence/trackers.json" ], "effort": "medium", "pathId": "login", "url": "https://m.easytrader.ir" } ], "taskList": [ { "id": "T01", "title": "Strip the unauthenticated route to a fast, cached login payload", "priority": 1, "findingIds": [ "F04", "F05", "F14" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T02", "title": "Restore native keyboard, focus, zoom, and semantic control accessibility", "priority": 2, "findingIds": [ "F02", "F03", "F11" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T03", "title": "Harden analytics, cookies, CSP, and browser policies on authentication pages", "priority": 3, "findingIds": [ "F06", "F07" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Make sign-in validation and password-manager behavior humane", "priority": 4, "findingIds": [ "F09", "F10" ], "guidanceId": "autofill-sign-in-form", "status": "open" }, { "id": "T05", "title": "Serve meaningful crawler HTML and correct indexing files", "priority": 5, "findingIds": [ "F08", "F12" ], "guidanceId": "html", "status": "open" }, { "id": "T06", "title": "Add preference-driven dark theming", "priority": 6, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T07", "title": "Remove deprecated unload handling and size logo assets", "priority": 7, "findingIds": [ "F13" ], "guidanceId": "html", "status": "open" } ], "artifacts": [ { "type": "screenshot", "path": "evidence/mobile.png", "caption": "Audit evidence: mobile.png", "condition": "viewport: 390x844", "findingIds": [ "F11" ] }, { "type": "screenshot", "path": "evidence/dark.png", "caption": "Audit evidence: dark.png", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/register.png", "caption": "Audit evidence: register.png", "findingIds": [] }, { "type": "screenshot", "path": "evidence/forgot.png", "caption": "Audit evidence: forgot.png", "findingIds": [] }, { "type": "screenshot", "path": "evidence/invalid-submit.png", "caption": "Audit evidence: invalid-submit.png", "findingIds": [] }, { "type": "dom", "path": "evidence/dom.json", "caption": "Audit evidence: dom.json", "findingIds": [] }, { "type": "dom", "path": "evidence/semantics.json", "caption": "Audit evidence: semantics.json", "findingIds": [ "F10", "F11" ] }, { "type": "other", "path": "evidence/preferences-focus.json", "caption": "Audit evidence: preferences-focus.json", "findingIds": [ "F01", "F02" ] }, { "type": "other", "path": "evidence/form-validation.json", "caption": "Audit evidence: form-validation.json", "findingIds": [ "F09" ] }, { "type": "other", "path": "evidence/platform.json", "caption": "Audit evidence: platform.json", "findingIds": [ "F08" ] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "Audit evidence: layout-mobile.json", "condition": "viewport: 390x844", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "Audit evidence: discoverability.json", "findingIds": [ "F08", "F12" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Audit evidence: discoverability-rendered.png", "findingIds": [ "F12" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "Audit evidence: discoverability-crawler.png", "findingIds": [ "F12" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "Audit evidence: headers.json", "findingIds": [ "F07" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Audit evidence: cookies.json", "findingIds": [ "F06" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Audit evidence: trackers.json", "findingIds": [ "F06", "F14" ] }, { "type": "other", "path": "evidence/images.json", "caption": "Audit evidence: images.json", "findingIds": [ "F13" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Audit evidence: secrets.json", "findingIds": [] }, { "type": "har", "path": "evidence/network.har", "caption": "Audit evidence: network.har", "findingIds": [] }, { "type": "har-summary", "path": "evidence/network-summary.json", "caption": "Audit evidence: network-summary.json", "findingIds": [ "F05", "F06", "F14" ] }, { "type": "trace", "path": "evidence/performance-trace.json", "caption": "Audit evidence: performance-trace.json", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/performance-trace-summary.json", "caption": "Audit evidence: performance-trace-summary.json", "findingIds": [ "F04" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "Audit evidence: lighthouse.json", "findingIds": [ "F03", "F04", "F05", "F08", "F13" ] }, { "type": "heap", "path": "evidence/heap.json", "caption": "Audit evidence: heap.json", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post.json", "caption": "Audit evidence: heap-post.json", "findingIds": [] }, { "type": "other", "path": "evidence/robots.txt", "caption": "Audit evidence: robots.txt", "findingIds": [ "F08" ] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "Audit evidence: sitemap.xml", "findingIds": [ "F08" ] } ], "budget": { "pathCount": 4, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-27T23-57-53-815Z" }