{ "url": "https://www.betpawa.ug", "auditedAt": "2026-07-22T05:15:00.000Z", "mode": "report", "status": "completed", "statusDetail": "Atomic coverage complete across 58 checks and seven representative paths.", "page": { "appType": "spa", "framework": "Next.js", "notes": "Public sportsbook/casino PWA. No source was supplied. Account creation, money movement and wagering were not completed; unauthenticated surfaces and safe validation states were inspected." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "trace", "har", "discoverability", "headers", "cookies", "trackers", "secrets", "images", "heap-summary", "lighthouse", "curl robots/sitemap/service-worker", "Modern Web Guidance 0.0.172" ], "guidanceConsulted": [ "dark-mode", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "scrollytelling", "navigation-drawer", "declarative-dialog-popover-control", "size-aware-styling", "forms", "performance", "optimize-image-priority", "break-up-long-tasks", "improve-text-layout-and-legibility", "html", "security", "privacy", "passkeys", "stabilize-reactive-state", "translator", "coordinate-global-events", "validate-input-after-interaction", "autofill-sign-in-form", "deliver-optimized-decorative-images", "efficient-background-processing", "webmcp", "manage-recurring-intervals" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Homepage at the desktop audit viewport." }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Homepage at 360x800.", "condition": "viewport: 360x800", "findingIds": [ "F03" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "Mobile layout metrics and layout-shift/long-task observations.", "condition": "viewport: 360x800", "findingIds": [ "F03", "F05" ] }, { "type": "screenshot", "path": "evidence/home-light.png", "caption": "Homepage under the light color-scheme preference.", "condition": "prefers-color-scheme: light" }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "Homepage under the dark color-scheme preference.", "condition": "prefers-color-scheme: dark" }, { "type": "screenshot", "path": "evidence/home-contrast-more.png", "caption": "Homepage under increased contrast preference; essential UI remains visible.", "condition": "prefers-contrast: more" }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "Animation and reduced-motion CSS probe." }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "Focus, responsive-feature, overlay and service-worker probe.", "findingIds": [ "F01", "F02", "F03" ] }, { "type": "har", "path": "evidence/home.har", "caption": "Homepage network capture.", "condition": "8 second load", "findingIds": [ "F06", "F07", "F08", "F18", "F26", "F27" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "Compact HAR summary: 160 requests, 1.36 MB transferred, 1.05 MB JavaScript and 382 KB third-party.", "condition": "8 second load", "findingIds": [ "F06", "F07", "F08", "F18", "F26", "F27" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "DevTools performance trace.", "condition": "load", "findingIds": [ "F05", "F06" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "Trace summary: LCP 1.61s in this run, 4 long tasks and 241ms TBT.", "condition": "load", "findingIds": [ "F05", "F06" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-home.json", "caption": "Lighthouse home: performance 47, accessibility 79; simulated LCP 7.9s and TBT 1,680ms.", "condition": "mobile simulated", "findingIds": [ "F03", "F05", "F06", "F08", "F09", "F10", "F11", "F13" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-join.json", "caption": "Lighthouse registration: performance 49, accessibility 82, best practices 77.", "condition": "mobile simulated", "findingIds": [ "F09", "F10", "F11", "F13" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "Security-header inspection.", "findingIds": [ "F17" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Cookie attribute inspection.", "findingIds": [ "F17" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Third-party and tracker inspection.", "findingIds": [ "F18", "F27" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Client-secret pattern scan; observed Google key is treated as a public client key, not a leaked secret." }, { "type": "other", "path": "evidence/images.json", "caption": "Image audit: dimensions, loading, sizing, formats and alt.", "findingIds": [ "F09", "F12", "F26" ] }, { "type": "discoverability", "path": "evidence/discoverability", "caption": "Raw HTML vs rendered content comparison: 0% content coverage and JS shell.", "findingIds": [ "F14", "F20" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Rendered browser view with site content.", "findingIds": [ "F14", "F20" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "No-JavaScript crawler view contains only an enable-JavaScript notice.", "findingIds": [ "F14", "F20" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Rendered home DOM and CSS." }, { "type": "other", "path": "evidence/home-recon.json", "caption": "Navigation, forms, metadata, headings and route reconnaissance.", "findingIds": [ "F10", "F14", "F16", "F22" ] }, { "type": "screenshot", "path": "evidence/join-mobile.png", "caption": "Registration form at 360x800.", "condition": "viewport: 360x800", "findingIds": [ "F24", "F25" ] }, { "type": "dom", "path": "evidence/join-dom.json", "caption": "Registration DOM and computed form styles.", "findingIds": [ "F24", "F25" ] }, { "type": "other", "path": "evidence/join-probe.json", "caption": "Registration fields, labels and autocomplete probe.", "findingIds": [ "F25" ] }, { "type": "screenshot", "path": "evidence/join-invalid.png", "caption": "Registration form after attempted empty submission; no visible error appeared.", "condition": "empty submit", "findingIds": [ "F04", "F24" ] }, { "type": "other", "path": "evidence/join-invalid-probe.json", "caption": "Empty submit left an empty assertive live region and no visible error text.", "findingIds": [ "F04", "F24" ] }, { "type": "screenshot", "path": "evidence/event-mobile.png", "caption": "Representative event-detail and odds-selection page.", "condition": "viewport: 360x800" }, { "type": "dom", "path": "evidence/event-dom.json", "caption": "Representative event-detail DOM and CSS." }, { "type": "screenshot", "path": "evidence/casino-mobile.png", "caption": "Representative casino listing.", "condition": "viewport: 360x800", "findingIds": [ "F26" ] }, { "type": "dom", "path": "evidence/casino-dom.json", "caption": "Casino listing DOM and CSS." }, { "type": "screenshot", "path": "evidence/help-mobile.png", "caption": "Help and request-a-call journey.", "condition": "viewport: 360x800" }, { "type": "other", "path": "evidence/help-probe.json", "caption": "Help page headings, forms, labels and landmarks.", "findingIds": [ "F10", "F25" ] }, { "type": "screenshot", "path": "evidence/not-found-mobile.png", "caption": "Friendly visual not-found state.", "condition": "viewport: 360x800", "findingIds": [ "F15", "F21" ] }, { "type": "other", "path": "evidence/not-found-probe.json", "caption": "Unknown route received an indexable page and canonical URL despite HTTP 200.", "findingIds": [ "F15", "F21" ] }, { "type": "other", "path": "evidence/login-probe.json", "caption": "Login form uses current-password but no username autocomplete or passkey surface.", "findingIds": [ "F19", "F25" ] }, { "type": "other", "path": "evidence/metadata-probe.json", "caption": "Metadata, language/direction and agent-capability probe.", "findingIds": [ "F16", "F22" ] }, { "type": "other", "path": "evidence/manifest.json", "caption": "Installable web app manifest." }, { "type": "other", "path": "evidence/service-worker-probe.json", "caption": "Active service-worker registration." }, { "type": "other", "path": "evidence/service-worker.js", "caption": "Service worker source; network errors fall through without an offline document.", "findingIds": [ "F23" ] }, { "type": "heap", "path": "evidence/heap-baseline.json", "caption": "Baseline heap summary: 1,075,130 nodes and 53.85 MB self size.", "findingIds": [ "F28" ] }, { "type": "heap", "path": "evidence/heap-post-menu.json", "caption": "Post-interaction heap summary after 10 menu toggles: 1,077,239 nodes and 54.38 MB self size.", "findingIds": [ "F28" ] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots.txt explicitly permits public and named AI crawlers." }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "Public sitemap." }, { "type": "other", "path": "evidence/guidance-search.json", "caption": "Pinned Modern Web Guidance search result." }, { "type": "other", "path": "evidence/guidance-retrieved.md", "caption": "Pinned Modern Web Guidance guides retrieved before judgement." } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Light and dark screenshots visibly retint surfaces, cards and text; page startup reads prefers-color-scheme and applies data-theme.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-light.png", "evidence/home-dark.png" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Reduced-motion probe matched the preference, found no running animations and found a dedicated media rule disabling pulse/shimmer.", "pathIds": [ "home" ], "artifacts": [ "evidence/reduced-motion.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "The prefers-contrast: more screenshot retained visible text, controls, selected states and separators; Lighthouse normal-mode contrast passed on home.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-contrast-more.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Rendered CSS inspection found view-transition rules and the platform probe confirmed View Transition support is used by the stylesheet surface.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "DOM/CSS inspection found no scroll-linked animation effect and no scroll event-driven animation anti-pattern on the representative views.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-dom.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Mobile captures show native scrolling and horizontal content rails; CSS uses overscroll behavior rather than a custom pointermove-driven page gesture.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "The platform probe found no scroll timeline and the mobile captures show full top and bottom chrome remaining fixed while content space is constrained.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-mobile.png" ], "findingIds": [ "F01" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "CSS inspection found anchor positioning declarations; representative menus and account/navigation chrome remained attached within viewport edges.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-mobile.png" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Mobile screenshots show active destinations in green, a clear Back action on event detail, selected market tabs and strong state highlighting.", "pathIds": [ "home" ], "artifacts": [ "evidence/event-mobile.png", "evidence/casino-mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Fresh-load screenshots across home, event, casino, join and help show no modal, consent wall or viewport-blocking interruption.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/join-mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "DOM inspection found no active modal overlay requiring a custom dismiss mechanism in the audited unauthenticated flows; native select controls are used on registration.", "pathIds": [ "home" ], "artifacts": [ "evidence/join-dom.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Representative mobile views devote the central viewport to event odds, casino games, registration or help; persistent chrome is compact and consistent.", "pathIds": [ "home" ], "artifacts": [ "evidence/event-mobile.png", "evidence/help-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "360x800 layout metrics reported scrollWidth=clientWidth=360 and horizontalOverflowPx=0; all representative mobile screenshots fit the viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/home-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Rendered CSS inspection found no @container rule or non-normal container type across the representative templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Lighthouse found 24 target-size failures on home; mobile screenshot shows dense horizontally clipped card carousels and compact icon/navigation targets.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ], "findingIds": [ "F03" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Home, event, casino, registration and help screenshots each expose clear headings/content and prominent next actions such as JOIN NOW, odds, games or request support.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/help-mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "low", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Unauthenticated navigation reached event detail and registration without dead ends; event markets and the complete labelled account form are present. No real wager/account was submitted.", "pathIds": [ "home" ], "artifacts": [ "evidence/event-mobile.png", "evidence/join-mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "After an empty JOIN NOW submission, the page showed no visible field errors; the probe found only an empty aria-live=assertive paragraph.", "pathIds": [ "join" ], "artifacts": [ "evidence/join-invalid.png", "evidence/join-invalid-probe.json" ], "findingIds": [ "F04" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Lighthouse measured LCP 7.9s, TBT 1,680ms and performance 47. A separate trace was faster but still recorded 241ms TBT, so throttled-device risk is clear.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F05" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Mobile layout observer measured CLS 0.0006375 and Lighthouse measured 0.003, both in the good range.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/lighthouse-home.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Lighthouse measured 3.8s main-thread work and 2.7s JS execution; the trace recorded four long tasks, longest 233ms.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "HAR recorded 160 requests and 13 stylesheets; Lighthouse estimated 340ms render-blocking savings and flagged the network dependency tree.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "HAR transferred 1.05MB across 87 script requests. Lighthouse estimated 409KiB unused JavaScript and flagged 32KiB legacy code.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Lighthouse failed button-name, image-alt, link-name and visible-label/accessibility-name matching checks; image inspection found two images without alt.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-join.json", "evidence/images.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Lighthouse home color-contrast audit passed and dark/light/contrast screenshots retain legible text and controls; join has one isolated contrast failure covered through the broader inclusive findings.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-dark.png" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Lighthouse found no main landmark; home has no h1 and the rendered html element has no lang. Help has an h1 but skips through mixed h2/h3 structures.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-recon.json", "evidence/help-probe.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Home, event, casino, join and help screenshots use readable type sizes, clear grouping and no clipped body text at 360px.", "pathIds": [ "home" ], "artifacts": [ "evidence/event-mobile.png", "evidence/help-mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Lighthouse reported 24 target-size failures on home and 13 on registration, despite correct viewport scaling.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-join.json" ], "findingIds": [ "F11" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Lighthouse errors-in-console audit passed on both home and registration with no logged runtime exception.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-join.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Image inspection found 8 of 15 images without width/height, 8 oversized, and 9 in legacy formats.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json" ], "findingIds": [ "F12" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Lighthouse join best-practices scored 77 and reported missing source maps for large first-party JavaScript; home also ships legacy JS.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse-join.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Home and registration expose unique descriptive titles and meta descriptions; route DOM inspections show route-specific titles.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json", "evidence/join-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Discoverability capture returned 0% rendered-word coverage, isJsShell=true, and crawler view only says to enable JavaScript, despite robots explicitly permitting crawlers.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "findingIds": [ "F14" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "A deliberately nonexistent route returned HTTP 200, generated a canonical URL and had no noindex directive, although the visual page says it does not exist.", "pathIds": [ "not-found" ], "artifacts": [ "evidence/not-found-mobile.png", "evidence/not-found-probe.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Home provides Open Graph metadata but the recon found no JSON-LD for the organization, sporting events, games or articles.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json", "evidence/metadata-probe.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Headers inspection found no HSTS or nosniff and CSP only defines frame-ancestors; bp_country is not Secure. Referrer-Policy and Permissions-Policy are absent.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "HAR transferred 382,504 third-party bytes; trackers found GTM, Sentry and Maze across six third-party origins, with GTM accounting for about 355KB.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Login probe found current-password but no WebAuthn/PublicKeyCredential/passkey surface; username/mobile field also lacks a username autocomplete token. No permission prompt fired on load.", "pathIds": [ "login" ], "artifacts": [ "evidence/login-probe.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Clickjacking protection is present through CSP frame-ancestors and X-Frame-Options, but missing HSTS/referrer/permissions policy is already recorded under secure transport and headers.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "The raw/crawler view contains only an enable-JavaScript notice while the rendered page has 5,006 characters; content coverage is 0%.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability", "evidence/discoverability-crawler.png" ], "findingIds": [ "F20" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Event, casino, registration and help loaded without cut-off overlays or broken async states; native selects and fixed navigation remained usable at viewport edges.", "pathIds": [ "home" ], "artifacts": [ "evidence/event-mobile.png", "evidence/casino-mobile.png" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "A manifest and active service worker exist, but service-worker source deletes caches on activation and falls through to a plain fetch when offline, with no offline document.", "pathIds": [ "home" ], "artifacts": [ "evidence/manifest.json", "evidence/service-worker-probe.json", "evidence/service-worker.js" ], "findingIds": [ "F23" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "The unknown route offers Browse Events, Home and Help, but the server responds 200 and canonicals the nonexistent URL, so clients and caches cannot distinguish failure.", "pathIds": [ "not-found" ], "artifacts": [ "evidence/not-found-mobile.png", "evidence/not-found-probe.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "DOM and Lighthouse both found html lang empty, even though the page declares en-UG hreflang and many country/language variants.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json", "evidence/lighthouse-home.json", "evidence/metadata-probe.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "The Uganda variant renders UGX/phone country context and localized English date/time labels consistently across home, event and registration.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/join-mobile.png" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "pass", "confidence": "low", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Displayed event times consistently include day/date context across listing and detail views; no contradictory or ambiguous timezone transition was observed in the representative routes.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/event-mobile.png" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Audited pages expose login/join choices, responsible-gambling and age/licence information, help, terms and privacy links; no forced continuity or disguised control appeared.", "pathIds": [ "home" ], "artifacts": [ "evidence/not-found-probe.json", "evidence/login-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "The empty-submit test produced no visible messages and only an empty assertive live region, leaving the user without a clear correction path.", "pathIds": [ "join" ], "artifacts": [ "evidence/join-invalid.png", "evidence/join-invalid-probe.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Join fields for phone, first name, last name and identification number have empty autocomplete; login username is also empty, while only password tokens are set.", "pathIds": [ "join" ], "artifacts": [ "evidence/join-probe.json", "evidence/login-probe.json", "evidence/help-probe.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Login offers recovery and remember-device choice; footer states licence, minimum age and gambling harm, and account creation does not preselect payment or subscription continuity.", "pathIds": [ "home" ], "artifacts": [ "evidence/login-probe.json", "evidence/not-found-probe.json" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Image audit found 8 oversized, 8 below-fold eager, 9 legacy-format and 8 dimensionless images; several 300-400px assets display at 99px.", "pathIds": [ "casino" ], "artifacts": [ "evidence/images.json", "evidence/casino-mobile.png" ], "findingIds": [ "F26" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Network/trace evidence shows the page settles after initial data loading with no autoplay media or persistent background animation; the principal waste is already isolated to bundle/third-party budgets.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-trace-summary.json", "evidence/home-summary.json" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Third parties transferred 382KB of a 1.36MB load; GTM alone transferred about 355KB across two script endpoints.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Reconnaissance and product-context applicability judgement.", "evidence": "WebMCP exposure is emerging and was not declared as a product goal; this audit treats it as an opportunity, not a failure.", "reason": "WebMCP exposure is emerging and was not declared as a product goal; this audit treats it as an opportunity, not a failure." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Reconnaissance and product-context applicability judgement.", "evidence": "No summarisation or generative task was identified where on-device inference is necessary for the core betting experience.", "reason": "No summarisation or generative task was identified where on-device inference is necessary for the core betting experience." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "After 10 representative menu toggles, heap changed only +2,109 nodes (+0.20%) and +528,802 bytes (+0.98%); constructor populations were broadly stable, so no unbounded growth was evidenced.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post-menu.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "high", "method": "Direct browser evidence and guidance-backed judgement.", "evidence": "Heap summary recorded 1,075,130 nodes and 53.85MB self size. After 10 menu toggles growth was modest (+2,109 nodes, +0.53MB), which does not indicate an obvious repeated-interaction leak but confirms a high baseline.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post-menu.json" ], "findingIds": [ "F28" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "low", "method": "Direct screenshot, DOM, probe, Lighthouse, network, trace or heap evidence as cited.", "evidence": "Neither heap summary surfaced Detached* constructors among retained-size leaders; repeated toggles produced only modest aggregate growth, giving low-confidence evidence against an accumulating listener/DOM leak.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post-menu.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "pass" }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "pass" }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F02", "F03" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F06", "F07", "F08" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10", "F11" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F14", "F15", "F16" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F17", "F18", "F19" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F20", "F23", "F21" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F22" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F24", "F25" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F26", "F27" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "The emerging agent-facing capabilities were judged outside this site audit scope; public crawlability is still judged under discoverability and resilience." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F28" ] } ], "paths": [ { "id": "home", "description": "Homepage and sportsbook listing: entry template, navigation, promotions, event lists and betslip shell.", "url": "https://www.betpawa.ug/", "conditions": [ "desktop", "viewport: 360x800", "prefers-color-scheme: light/dark", "prefers-reduced-motion: reduce", "prefers-contrast: more" ], "result": "issues" }, { "id": "event", "description": "Representative event detail and market-selection journey.", "url": "https://www.betpawa.ug/event/36685613?filter=all", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "casino", "description": "Casino listing/media-heavy template.", "url": "https://www.betpawa.ug/casino", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "join", "description": "Primary account-registration form and empty-submit recovery state.", "url": "https://www.betpawa.ug/join-now", "conditions": [ "viewport: 360x800", "empty form submission" ], "result": "issues" }, { "id": "login", "description": "Authentication and account-recovery surface inspected for field assistance and modern auth.", "url": "https://www.betpawa.ug/login", "conditions": [ "rendered DOM" ], "result": "issues" }, { "id": "help", "description": "Help/content template and request-a-call form.", "url": "https://www.betpawa.ug/help", "conditions": [ "viewport: 360x800" ], "result": "issues" }, { "id": "not-found", "description": "Unknown-route recovery and HTTP/indexing semantics.", "url": "https://www.betpawa.ug/definitely-not-a-real-route-atomic-audit", "conditions": [ "viewport: 360x800" ], "result": "issues" } ], "findings": [ { "id": "F01", "severity": "low", "confidence": "high", "summary": "Persistent chrome does not react to scroll state.", "evidence": "The platform probe found no scroll timeline and the mobile captures show full top and bottom chrome remaining fixed while content space is constrained.", "artifacts": [ "evidence/platform-probe.json", "evidence/home-mobile.png" ], "suggestedFix": "Use a CSS scroll-state container query or a compacting header pattern so persistent navigation yields space as users scroll.", "effort": "small", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "shrinking-header-on-scroll", "pathId": "home" }, { "id": "F02", "severity": "low", "confidence": "high", "summary": "Components rely on viewport breakpoints rather than container-level adaptation.", "evidence": "Rendered CSS inspection found no @container rule or non-normal container type across the representative templates.", "artifacts": [ "evidence/platform-probe.json" ], "suggestedFix": "Give reusable cards and panels a containment context and use size container queries where their layout changes independently of the viewport.", "effort": "medium", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "pathId": "home" }, { "id": "F03", "severity": "high", "confidence": "high", "summary": "Many mobile targets are too small or crowded.", "evidence": "Lighthouse found 24 target-size failures on home; mobile screenshot shows dense horizontally clipped card carousels and compact icon/navigation targets.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-mobile.png", "evidence/home-mobile-layout.json" ], "suggestedFix": "Increase interactive targets and spacing to at least WCAG target-size expectations, while preserving visible :focus-visible styling.", "effort": "medium", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "pathId": "home" }, { "id": "F04", "severity": "medium", "confidence": "high", "summary": "Registration errors are not visibly actionable after an empty submission.", "evidence": "After an empty JOIN NOW submission, the page showed no visible field errors; the probe found only an empty aria-live=assertive paragraph.", "artifacts": [ "evidence/join-invalid.png", "evidence/join-invalid-probe.json" ], "suggestedFix": "Validate after interaction, move focus to the first invalid field, show specific inline messages, set aria-invalid, and announce a concise error summary.", "effort": "medium", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "pathId": "join" }, { "id": "F05", "severity": "high", "confidence": "high", "summary": "Simulated mobile loading misses the Core Web Vitals performance bar.", "evidence": "Lighthouse measured LCP 7.9s, TBT 1,680ms and performance 47. A separate trace was faster but still recorded 241ms TBT, so throttled-device risk is clear.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json" ], "suggestedFix": "Prioritise the LCP content, reduce startup JavaScript, delay non-critical integrations, and retest on representative mobile/network conditions.", "effort": "large", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "pathId": "home" }, { "id": "F06", "severity": "high", "confidence": "high", "summary": "JavaScript blocks the main thread during startup.", "evidence": "Lighthouse measured 3.8s main-thread work and 2.7s JS execution; the trace recorded four long tasks, longest 233ms.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-summary.json" ], "suggestedFix": "Remove unnecessary startup work, split long tasks, schedule non-urgent work after interaction readiness, and move suitable computation off-thread.", "effort": "large", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "break-up-long-tasks", "pathId": "home" }, { "id": "F07", "severity": "medium", "confidence": "high", "summary": "The initial dependency chain is broad and includes avoidable blocking work.", "evidence": "HAR recorded 160 requests and 13 stylesheets; Lighthouse estimated 340ms render-blocking savings and flagged the network dependency tree.", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Inline only critical CSS, consolidate/defer route styles and scripts, and audit preloads so only truly critical resources receive early priority.", "effort": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "pathId": "home" }, { "id": "F08", "severity": "high", "confidence": "high", "summary": "The page ships a large amount of unused and legacy JavaScript.", "evidence": "HAR transferred 1.05MB across 87 script requests. Lighthouse estimated 409KiB unused JavaScript and flagged 32KiB legacy code.", "artifacts": [ "evidence/home-summary.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Route-split bundles, remove unconditional polyfills/dependencies, and load casino, analytics and other optional capabilities only when needed.", "effort": "large", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "pathId": "home" }, { "id": "F09", "severity": "high", "confidence": "high", "summary": "Accessible names are missing on multiple controls and images.", "evidence": "Lighthouse failed button-name, image-alt, link-name and visible-label/accessibility-name matching checks; image inspection found two images without alt.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-join.json", "evidence/images.json" ], "suggestedFix": "Give every icon-only control and link a programmatic name, make visible labels match accessible names, and provide meaningful or empty alt as appropriate.", "effort": "medium", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "pathId": "home" }, { "id": "F10", "severity": "high", "confidence": "high", "summary": "Landmark and heading structure is incomplete.", "evidence": "Lighthouse found no main landmark; home has no h1 and the rendered html element has no lang. Help has an h1 but skips through mixed h2/h3 structures.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-recon.json", "evidence/help-probe.json" ], "suggestedFix": "Add one main landmark, one descriptive page h1 per route, logical heading levels, and verify keyboard focus order and visible focus across all fixed chrome.", "effort": "medium", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "pathId": "home" }, { "id": "F11", "severity": "medium", "confidence": "high", "summary": "Touch target sizing prevents an inclusive mobile experience.", "evidence": "Lighthouse reported 24 target-size failures on home and 13 on registration, despite correct viewport scaling.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/lighthouse-join.json" ], "suggestedFix": "Increase hit areas and spacing without disabling zoom; retest at 200% zoom and 320 CSS px reflow.", "effort": "medium", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "pathId": "home" }, { "id": "F12", "severity": "medium", "confidence": "high", "summary": "Many images lack intrinsic dimensions and use inefficient sizing.", "evidence": "Image inspection found 8 of 15 images without width/height, 8 oversized, and 9 in legacy formats.", "artifacts": [ "evidence/images.json" ], "suggestedFix": "Emit width/height or aspect-ratio for every image and serve correctly sized modern sources through srcset/sizes.", "effort": "medium", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "pathId": "home" }, { "id": "F13", "severity": "medium", "confidence": "high", "summary": "Production diagnostics and browser delivery hygiene are incomplete.", "evidence": "Lighthouse join best-practices scored 77 and reported missing source maps for large first-party JavaScript; home also ships legacy JS.", "artifacts": [ "evidence/lighthouse-join.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Publish secured production source maps for diagnostics and remove avoidable legacy bundles using an explicit Baseline support policy.", "effort": "medium", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "pathId": "home" }, { "id": "F14", "severity": "high", "confidence": "high", "summary": "Public content is invisible to crawlers that do not execute JavaScript.", "evidence": "Discoverability capture returned 0% rendered-word coverage, isJsShell=true, and crawler view only says to enable JavaScript, despite robots explicitly permitting crawlers.", "artifacts": [ "evidence/discoverability", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "suggestedFix": "Server-render or statically generate public sports, help, promotion and editorial content, including title, h1 and description in raw HTML.", "effort": "large", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "search-hidden-content", "pathId": "home" }, { "id": "F15", "severity": "medium", "confidence": "high", "summary": "Unknown routes return HTTP 200 with self-canonical URLs.", "evidence": "A deliberately nonexistent route returned HTTP 200, generated a canonical URL and had no noindex directive, although the visual page says it does not exist.", "artifacts": [ "evidence/not-found-mobile.png", "evidence/not-found-probe.json" ], "suggestedFix": "Return an actual 404 status and either omit canonical metadata or use a suitable noindex policy on not-found responses.", "effort": "small", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "search-hidden-content", "pathId": "not-found" }, { "id": "F16", "severity": "low", "confidence": "high", "summary": "Rich public entities lack structured data.", "evidence": "Home provides Open Graph metadata but the recon found no JSON-LD for the organization, sporting events, games or articles.", "artifacts": [ "evidence/home-recon.json", "evidence/metadata-probe.json" ], "suggestedFix": "Add accurate schema.org JSON-LD for Organization and relevant visible entity templates, while retaining the existing social metadata.", "effort": "medium", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "search-hidden-content", "pathId": "home" }, { "id": "F17", "severity": "high", "confidence": "high", "summary": "Transport protections and cookie policy are incomplete.", "evidence": "Headers inspection found no HSTS or nosniff and CSP only defines frame-ancestors; bp_country is not Secure. Referrer-Policy and Permissions-Policy are absent.", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "suggestedFix": "Deploy HSTS, nosniff, a restrictive script/style/connect CSP, Referrer-Policy and Permissions-Policy; mark all HTTPS cookies Secure.", "effort": "medium", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "pathId": "home" }, { "id": "F18", "severity": "medium", "confidence": "high", "summary": "Analytics and research integrations create a sizeable third-party footprint.", "evidence": "HAR transferred 382,504 third-party bytes; trackers found GTM, Sentry and Maze across six third-party origins, with GTM accounting for about 355KB.", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "suggestedFix": "Inventory each third party, load non-essential analytics only after appropriate consent/context, minimise payloads, and self-host or remove integrations where practical.", "effort": "medium", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "security", "pathId": "home" }, { "id": "F19", "severity": "medium", "confidence": "high", "summary": "A sensitive account flow relies on passwords without passkey support.", "evidence": "Login probe found current-password but no WebAuthn/PublicKeyCredential/passkey surface; username/mobile field also lacks a username autocomplete token. No permission prompt fired on load.", "artifacts": [ "evidence/login-probe.json" ], "suggestedFix": "Offer passkey sign-in and reauthentication alongside recovery-safe fallback, and add correct username autocomplete semantics.", "effort": "large", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "security", "pathId": "login" }, { "id": "F20", "severity": "high", "confidence": "high", "summary": "Core public content does not survive without JavaScript.", "evidence": "The raw/crawler view contains only an enable-JavaScript notice while the rendered page has 5,006 characters; content coverage is 0%.", "artifacts": [ "evidence/discoverability", "evidence/discoverability-crawler.png" ], "suggestedFix": "Render core navigation, current event/listing content, help and legal information in HTML, then hydrate betting interactions as an enhancement.", "effort": "large", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "stabilize-reactive-state", "pathId": "home" }, { "id": "F21", "severity": "medium", "confidence": "high", "summary": "The visual 404 recovery is helpful but the HTTP state is misleading.", "evidence": "The unknown route offers Browse Events, Home and Help, but the server responds 200 and canonicals the nonexistent URL, so clients and caches cannot distinguish failure.", "artifacts": [ "evidence/not-found-mobile.png", "evidence/not-found-probe.json" ], "suggestedFix": "Keep the useful recovery UI while returning the correct status and explicit error state to browsers, agents and intermediaries.", "effort": "small", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "stabilize-reactive-state", "pathId": "not-found" }, { "id": "F22", "severity": "high", "confidence": "high", "summary": "The document language is missing across localized pages.", "evidence": "DOM and Lighthouse both found html lang empty, even though the page declares en-UG hreflang and many country/language variants.", "artifacts": [ "evidence/home-recon.json", "evidence/lighthouse-home.json", "evidence/metadata-probe.json" ], "suggestedFix": "Set html lang=en-UG (and dir where appropriate) on the server for this locale; ensure every regional variant sets its own BCP 47 language tag.", "effort": "small", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "pathId": "home" }, { "id": "F23", "severity": "medium", "confidence": "high", "summary": "The installable app has no offline fallback.", "evidence": "A manifest and active service worker exist, but service-worker source deletes caches on activation and falls through to a plain fetch when offline, with no offline document.", "artifacts": [ "evidence/manifest.json", "evidence/service-worker-probe.json", "evidence/service-worker.js" ], "suggestedFix": "Precache a minimal offline shell/help page and provide explicit offline/retry states for network-dependent sports data.", "effort": "medium", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "guidanceId": "stabilize-reactive-state", "pathId": "home" }, { "id": "F24", "severity": "medium", "confidence": "high", "summary": "Registration validation does not provide clear feedback after submission.", "evidence": "The empty-submit test produced no visible messages and only an empty assertive live region, leaving the user without a clear correction path.", "artifacts": [ "evidence/join-invalid.png", "evidence/join-invalid-probe.json" ], "suggestedFix": "Use interaction-timed validation with explicit field messages, aria-invalid/aria-describedby, an announced summary, and focus on the first error.", "effort": "medium", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "forms", "pathId": "join" }, { "id": "F25", "severity": "medium", "confidence": "high", "summary": "Account and support forms omit important autocomplete tokens.", "evidence": "Join fields for phone, first name, last name and identification number have empty autocomplete; login username is also empty, while only password tokens are set.", "artifacts": [ "evidence/join-probe.json", "evidence/login-probe.json", "evidence/help-probe.json" ], "suggestedFix": "Apply appropriate autocomplete tokens such as username, tel-national, given-name, family-name and current/new-password, avoiding tokens for fields that must not be retained.", "effort": "small", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "forms", "pathId": "join" }, { "id": "F26", "severity": "medium", "confidence": "high", "summary": "Casino imagery is oversized, eager and often legacy-formatted.", "evidence": "Image audit found 8 oversized, 8 below-fold eager, 9 legacy-format and 8 dimensionless images; several 300-400px assets display at 99px.", "artifacts": [ "evidence/images.json", "evidence/casino-mobile.png" ], "suggestedFix": "Generate responsive AVIF/WebP sources, reserve dimensions and lazy-load below-fold tiles while keeping only true LCP imagery eager.", "effort": "medium", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "optimize-image-priority", "pathId": "casino" }, { "id": "F27", "severity": "medium", "confidence": "high", "summary": "Third-party scripts consume a disproportionate part of the page budget.", "evidence": "Third parties transferred 382KB of a 1.36MB load; GTM alone transferred about 355KB across two script endpoints.", "artifacts": [ "evidence/home-summary.json", "evidence/trackers.json" ], "suggestedFix": "Set a third-party byte/request budget, defer analytics until idle/consent, and remove duplicate or low-value tags.", "effort": "medium", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "optimize-image-priority", "pathId": "home" }, { "id": "F28", "severity": "medium", "confidence": "high", "summary": "The initial JavaScript heap is heavy for a listing page.", "evidence": "Heap summary recorded 1,075,130 nodes and 53.85MB self size. After 10 menu toggles growth was modest (+2,109 nodes, +0.53MB), which does not indicate an obvious repeated-interaction leak but confirms a high baseline.", "artifacts": [ "evidence/heap-baseline.json", "evidence/heap-post-menu.json" ], "suggestedFix": "Reduce always-loaded application state and bundles, virtualise large lists, and profile retained objects on long sportsbook/casino sessions.", "effort": "large", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "manage-recurring-intervals", "pathId": "home" } ], "taskList": [ { "id": "T01", "title": "Server-render public content and return correct HTTP status for unknown routes", "priority": 1, "findingIds": [ "F14", "F15", "F20", "F21" ], "guidanceId": "stabilize-reactive-state", "status": "open" }, { "id": "T02", "title": "Cut startup JavaScript, main-thread work and third-party load", "priority": 2, "findingIds": [ "F05", "F06", "F07", "F08", "F18", "F27", "F28" ], "guidanceId": "break-up-long-tasks", "status": "open" }, { "id": "T03", "title": "Repair accessible names, landmarks, headings and mobile target sizes", "priority": 3, "findingIds": [ "F03", "F09", "F10", "F11" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T04", "title": "Harden headers, cookie attributes and authentication", "priority": 4, "findingIds": [ "F17", "F19" ], "guidanceId": "security", "status": "open" }, { "id": "T05", "title": "Make registration validation visible, announced and autofill-friendly", "priority": 5, "findingIds": [ "F04", "F24", "F25" ], "guidanceId": "forms", "status": "open" }, { "id": "T06", "title": "Optimise and correctly size responsive game imagery", "priority": 6, "findingIds": [ "F12", "F26" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T07", "title": "Set locale metadata and add structured entity metadata", "priority": 7, "findingIds": [ "F16", "F22" ], "guidanceId": "translator", "status": "open" }, { "id": "T08", "title": "Add a useful offline fallback and explicit network recovery", "priority": 8, "findingIds": [ "F23" ], "guidanceId": "stabilize-reactive-state", "status": "open" }, { "id": "T09", "title": "Adopt container- and scroll-state-aware responsive chrome", "priority": 9, "findingIds": [ "F01", "F02" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T10", "title": "Publish production diagnostics and remove legacy delivery", "priority": 10, "findingIds": [ "F13" ], "guidanceId": "html", "status": "open" } ], "budget": { "pathCount": 7, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-22T04-59-15-863Z" }