{ "url": "https://betao.bet.br", "auditedAt": "2026-07-23T03:03:38.536Z", "mode": "report", "status": "completed", "statusDetail": "Atomic coverage complete across 58 checks and seven representative paths. Registration was inspected without submitting personal data.", "page": { "appType": "hybrid", "framework": "Next.js", "notes": "Public, server-rendered Brazilian gambling platform with casino, sportsbook, promotions, help, account modal and PWA manifest. Not covered: authenticated wagering, deposits/withdrawals, identity verification, payment execution and real-money game launch because they require an account, personal data and/or financial action." }, "evidenceUsed": [ "screenshot", "DOM snapshot", "evaluate probes", "layout metrics", "HAR + summary", "performance trace + summary", "Lighthouse", "discoverability browser/crawler comparison", "headers", "cookies", "trackers", "secrets scan", "images audit", "heap summaries" ], "guidanceConsulted": [ "dark-mode", "accessibility", "same-document-transitions", "light-dismiss-a-dialog", "declarative-dialog-popover-control", "overflow-clipping-control", "persistent-toast-notifications", "performance", "optimize-image-priority", "optimize-preload-priority", "identify-heavy-scripts", "fluid-scaling", "html", "security", "privacy", "passkeys", "stabilize-reactive-state", "forms", "autofill-sign-up-form", "deprioritize-background-fetches", "manage-recurring-intervals" ], "artifacts": [ { "type": "screenshot", "path": "evidence/casino-mobile.png", "caption": "casino mobile", "condition": "viewport 360x800", "findingIds": [ "F04" ] }, { "type": "screenshot", "path": "evidence/consent-preferences.png", "caption": "consent preferences", "findingIds": [] }, { "type": "other", "path": "evidence/consent-probe.json", "caption": "consent probe", "findingIds": [ "F22" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "cookies", "findingIds": [ "F18" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "discoverability crawler", "findingIds": [] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "discoverability rendered", "findingIds": [] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "discoverability", "findingIds": [] }, { "type": "other", "path": "evidence/focus-metadata.json", "caption": "focus metadata", "findingIds": [ "F14" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "headers", "findingIds": [ "F18" ] }, { "type": "screenshot", "path": "evidence/help-mobile.png", "caption": "help mobile", "condition": "viewport 360x800", "findingIds": [ "F04", "F14" ] }, { "type": "other", "path": "evidence/help-probe.json", "caption": "help probe", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F01" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [] }, { "type": "screenshot", "path": "evidence/home-forced-colors.png", "caption": "home forced colors", "condition": "forced-colors: active", "findingIds": [] }, { "type": "heap", "path": "evidence/home-heap-post.heapsnapshot", "caption": "home heap post", "findingIds": [] }, { "type": "heap", "path": "evidence/home-heap.heapsnapshot", "caption": "home heap", "findingIds": [ "F26" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "condition": "viewport 360x800", "findingIds": [ "F10" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "condition": "viewport 360x800", "findingIds": [ "F04", "F06", "F19", "F22" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F08", "F11", "F16", "F19", "F25" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F09" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "findingIds": [ "F09" ] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F11", "F19" ] }, { "type": "other", "path": "evidence/images.json", "caption": "images", "findingIds": [ "F10", "F17" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "lighthouse", "findingIds": [ "F09", "F12", "F13", "F14", "F16", "F17" ] }, { "type": "screenshot", "path": "evidence/login-modal.png", "caption": "login modal", "findingIds": [] }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "platform probe", "findingIds": [ "F03", "F05", "F07", "F15" ] }, { "type": "screenshot", "path": "evidence/promotions-mobile.png", "caption": "promotions mobile", "condition": "viewport 360x800", "findingIds": [ "F04" ] }, { "type": "other", "path": "evidence/promotions-probe.json", "caption": "promotions probe", "findingIds": [] }, { "type": "other", "path": "evidence/recon.json", "caption": "recon", "findingIds": [] }, { "type": "other", "path": "evidence/reduced-motion.json", "caption": "reduced motion", "findingIds": [ "F02" ] }, { "type": "other", "path": "evidence/register-flow.json", "caption": "register flow", "findingIds": [ "F05", "F20", "F23", "F24" ] }, { "type": "other", "path": "evidence/runtime-probe.json", "caption": "runtime probe", "findingIds": [ "F20", "F21", "F26" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "secrets", "findingIds": [] }, { "type": "other", "path": "evidence/site-files.json", "caption": "site files", "findingIds": [ "F21" ] }, { "type": "screenshot", "path": "evidence/sports-mobile.png", "caption": "sports mobile", "condition": "viewport 360x800", "findingIds": [ "F04", "F08" ] }, { "type": "other", "path": "evidence/sports-probe.json", "caption": "sports probe", "findingIds": [] }, { "type": "other", "path": "evidence/trackers.json", "caption": "trackers", "findingIds": [ "F19" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The normal and emulated-dark screenshots are visually identical, and the computed root color-scheme is not declared as a light/dark pair.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Under prefers-reduced-motion: reduce, 13 animations remained, including continuously running blink animations at 800 ms and 1000 ms and ten 350 ms row-slide animations.", "pathIds": [ "home" ], "artifacts": [ "evidence/reduced-motion.json" ], "findingIds": [ "F02" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Forced-colors screenshot preserves text, controls, outlines and content visibility.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-forced-colors.png" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The platform probe found browser support but no view-transition CSS or authored transition names across the representative Next.js UI.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "CSS inspection found authored scroll-timeline/animation-timeline rules and the trace showed no scroll-handler test failure.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-trace-summary.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Representative carousels and navigation use native links/buttons and scroll surfaces; mobile screenshots show platform scrolling rather than a custom pointer-only interaction.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/platform-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Persistent top and bottom chrome stays position-aware across long pages, and CSS inspection found scroll-timeline support.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/platform-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judged from route and interaction recon.", "evidence": "No tooltip, popover or edge-positioned menu requiring anchored positioning appeared on the five representative unauthenticated routes.", "reason": "No tooltip, popover or edge-positioned menu requiring anchored positioning appeared on the five representative unauthenticated routes.", "pathIds": [ "home" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "The persistent bottom navigation, selected tabs and section headers visibly preserve location and next actions across sampled routes.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/promotions-mobile.png", "evidence/sports-mobile.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Mobile screenshots of home, promotions, casino, sports and help show the same large fixed consent panel covering roughly the lower quarter to third of the viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/promotions-mobile.png", "evidence/casino-mobile.png", "evidence/sports-mobile.png", "evidence/help-mobile.png" ], "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The platform probe found zero dialog and zero popover elements; the registration overlay is a div with role=dialog and the consent surface has no dialog semantics.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/register-flow.json" ], "findingIds": [ "F05" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The mobile homepage shows header, hero, paid-today carousel, bettor ranking, search, content tabs, bottom navigation and consent at once, leaving little stable task space.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png" ], "findingIds": [ "F06" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "At 360x800, layout metrics report scrollWidth=clientWidth=360 and zero horizontal overflow; all five mobile screenshots reflow.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/home-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "CSS inspection found container-query rules, and reused navigation/card components visibly adapt between desktop and mobile.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json", "evidence/home-desktop.png", "evidence/home-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The platform probe measured the visible Cadastre-se control at 34 px high and Entrar at 38 px high, below a comfortable 44 px target.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F07" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Homepage and route screenshots expose clear Entrar/Cadastre-se plus labeled casino, sports, promotions and help actions.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Registration opens predictably into a labeled CPF, email and password form; inspection stopped before submitting personal data.", "pathIds": [ "home" ], "artifacts": [ "evidence/register-flow.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "HAR evidence records repeated 403/ERR_FAILED responses from prod20562.fssb.io while the sports page says “Nenhum evento encontrado” and offers no retry or failure explanation.", "pathIds": [ "register" ], "artifacts": [ "evidence/home-summary.json", "evidence/sports-mobile.png" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse measured LCP 12.0 s, FCP 4.7 s, TBT 710 ms, CLS 0.155 and a performance score of 0.36; the raw-CDP trace corroborated LCP 2.79 s and 98.69 ms blocking time in a less-throttled run.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The 360 px layout observer measured CLS 0.131, dominated by a 0.1308 shift at about 5.3 s; the image audit found 16 images without explicit dimensions.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/images.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse measured LCP 12.0 s, FCP 4.7 s, TBT 710 ms, CLS 0.155 and a performance score of 0.36; the raw-CDP trace corroborated LCP 2.79 s and 98.69 ms blocking time in a less-throttled run.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace.json", "evidence/home-trace-summary.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The HAR contains 295 requests and 4.09 MB transferred, including 29 stylesheets and 1.35 MB of fonts; numerous parser-inserted stylesheets are VeryHigh-priority render-blocking candidates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home.har", "evidence/home-summary.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse estimates 330 KiB unused JavaScript and 144 KiB unused CSS; FontAwesome all.css is 99.9% unused and analytics bundles dominate several waste entries.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Lighthouse passed image-alt, label, button-name and link-name audits on the homepage.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse found 19 contrast failures, including white Cadastre-se text on #ff9400 at 2.21:1 and ranking labels at 3.17:1.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse failed heading-order; DOM recon shows early H3 headings before the page H1, and the help route renders two H1 elements.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/focus-metadata.json", "evidence/help-mobile.png" ], "findingIds": [ "F14" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Representative desktop/mobile screenshots show unclipped body copy and route content with usable line lengths.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/help-mobile.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The rendered viewport meta includes maximum-scale=1 even though the narrow layout itself has no horizontal overflow.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ], "findingIds": [ "F15" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse reports 13 console-error items and a failed errors-in-console audit; HAR also records failed/aborted requests.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ], "findingIds": [ "F16" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse found 8 distorted image instances, while the image primitive found 16 missing-dimension and 15 oversized images.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/images.json" ], "findingIds": [ "F17" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse reports 13 console-error items and a failed errors-in-console audit; HAR also records failed/aborted requests.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Homepage and sampled routes have descriptive unique titles and meta descriptions.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/site-files.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Lighthouse SEO scored 1.0; anchors are crawlable, viewport exists, robots allows public routes and a sitemap is declared.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/site-files.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Homepage returns 200 with canonical URL; robots and sitemap are consistent, while the synthetic missing route correctly returns 404/noindex.", "pathIds": [ "home" ], "artifacts": [ "evidence/site-files.json", "evidence/focus-metadata.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "DOM probe found Organization/WebSite/MobileApplication JSON-LD plus complete Open Graph and Twitter preview metadata.", "pathIds": [ "home" ], "artifacts": [ "evidence/focus-metadata.json" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "CSP is limited to frame-ancestors, with no script-src/object-src; nosniff, Referrer-Policy and Permissions-Policy are absent. The cookie audit found 11 cookies with issues, including analytics cookies lacking Secure.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The initial HAR includes 87 third-party requests and 1.08 MB; the tracker probe found 16 third-party origins and DoubleClick, Facebook and Google Ads trackers while the consent panel was still shown.", "pathIds": [ "home" ], "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/trackers.json", "evidence/home-mobile.png" ], "findingIds": [ "F19" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The registration form requests a password and the runtime/source probe found no PublicKeyCredential or navigator.credentials integration; no permission prompt fired on load.", "pathIds": [ "home" ], "artifacts": [ "evidence/register-flow.json", "evidence/runtime-probe.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "CSP is limited to frame-ancestors, with no script-src/object-src; nosniff, Referrer-Policy and Permissions-Policy are absent. The cookie audit found 11 cookies with issues, including analytics cookies lacking Secure.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Discoverability measured 100% raw-HTML content coverage with status 200 and no empty SPA mount.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-crawler.png", "evidence/discoverability-rendered.png" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Sampled navigation, help disclosures and registration overlay rendered within mobile bounds; the missing route returned an intentional 404/noindex response.", "pathIds": [ "home" ], "artifacts": [ "evidence/register-flow.json", "evidence/site-files.json" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The manifest declares standalone display and start_url, but navigator.serviceWorker.getRegistrations() returned an empty list, so no offline fallback is available.", "pathIds": [ "home" ], "artifacts": [ "evidence/site-files.json", "evidence/runtime-probe.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "HAR evidence records repeated 403/ERR_FAILED responses from prod20562.fssb.io while the sports page says “Nenhum evento encontrado” and offers no retry or failure explanation.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/sports-mobile.png" ], "findingIds": [ "F08" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "The document declares lang=pt-BR and the responsive page preserves Portuguese reading order.", "pathIds": [ "home" ], "artifacts": [ "evidence/platform-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "Rendered amounts use Brazilian Real and pt-BR separators (for example R$ 101.645.796,28), and dates/countdowns use Portuguese labels.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judged from route and interaction recon.", "evidence": "The sampled public surfaces show relative countdown durations rather than editable or absolute cross-time-zone appointments, so time-zone conversion was not applicable.", "reason": "The sampled public surfaces show relative countdown durations rather than editable or absolute cross-time-zone appointments, so time-zone conversion was not applicable.", "pathIds": [ "home" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The first layer offers Personalizar and a brightly emphasized Aceitar tudo. After Personalizar, visible actions are Salvar preferências and Aceitar tudo, still with no reject-all control.", "pathIds": [ "register" ], "artifacts": [ "evidence/home-mobile.png", "evidence/consent-probe.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "HAR evidence records repeated 403/ERR_FAILED responses from prod20562.fssb.io while the sports page says “Nenhum evento encontrado” and offers no retry or failure explanation.", "pathIds": [ "register" ], "artifacts": [ "evidence/home-summary.json", "evidence/sports-mobile.png" ], "findingIds": [ "F08" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The email field uses autocomplete=off and the CPF field has no autocomplete token; only the password field has new-password.", "pathIds": [ "register" ], "artifacts": [ "evidence/register-flow.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The registration form visibly labels “Limites de Jogo Responsável” with “Ilimitado (padrão)” before account creation.", "pathIds": [ "register" ], "artifacts": [ "evidence/register-flow.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse found 8 distorted image instances, while the image primitive found 16 missing-dimension and 15 oversized images.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/images.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "Lighthouse estimates 330 KiB unused JavaScript and 144 KiB unused CSS; FontAwesome all.css is 99.9% unused and analytics bundles dominate several waste entries. The initial page transfers 4.09 MB across 295 requests; 1.08 MB and 87 requests are third-party, with 1.35 MB in fonts alone.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ], "findingIds": [ "F12", "F25" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The initial page transfers 4.09 MB across 295 requests; 1.08 MB and 87 requests are third-party, with 1.35 MB in fonts alone.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judged from route and interaction recon.", "evidence": "This regulated gambling surface does not declare an agent-facing transaction capability, and autonomous betting tools would require explicit safety/product intent not present here.", "reason": "This regulated gambling surface does not declare an agent-facing transaction capability, and autonomous betting tools would require explicit safety/product intent not present here.", "pathIds": [ "home" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judged from route and interaction recon.", "evidence": "No summarization or language-model task is part of the observed core betting, promotion or help journeys; built-in AI is not applicable.", "reason": "No summarization or language-model task is part of the observed core betting, promotion or help journeys; built-in AI is not applicable.", "pathIds": [ "home" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "After ten Hoje/3 Dias filter cycles, heap node count fell from 939,206 to 936,888 and self size from 54.41 MB to 54.30 MB, showing no retained growth in that interaction.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap.heapsnapshot", "evidence/home-heap-post.heapsnapshot" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "issues", "confidence": "high", "method": "Direct screenshot/DOM/CDP/Lighthouse evidence gathered on representative routes and conditions.", "evidence": "The baseline heap summary reports 939,206 heap nodes and 54.4 MB self size with 3,325 DOM elements; repeated filter toggling did not grow it further, but the initial footprint is heavy.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap.heapsnapshot", "evidence/runtime-probe.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Direct representative-path inspection using the referenced evidence artifact(s).", "evidence": "The before/after heap summaries did not expose Detached* among top constructors and total nodes decreased after repeated filter toggles.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-heap.heapsnapshot", "evidence/home-heap-post.heapsnapshot" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05", "F06" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F07" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F09", "F10", "F11", "F12" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F13", "F14", "F15" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F16", "F17" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "pass" }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F18", "F19", "F20" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F21", "F08" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F22", "F08", "F23", "F24" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F17", "F12", "F25" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "This regulated gambling surface does not declare an agent-facing transaction capability, and autonomous betting tools would require explicit safety/product intent not present here." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F26" ] } ], "paths": [ { "id": "home", "description": "Homepage and discovery hub, representing the main acquisition, game-discovery, consent and registration entry experience.", "url": "https://betao.bet.br/", "conditions": [ "desktop 800x600", "mobile 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors: active", "keyboard focus" ], "result": "issues" }, { "id": "promotions", "description": "Promotions listing, representing regulated commercial offers and campaign cards.", "url": "https://betao.bet.br/promotions", "conditions": [ "mobile 360x800" ], "result": "issues" }, { "id": "casino", "description": "Casino listing, representing the primary game-discovery catalogue.", "url": "https://betao.bet.br/casino/slots/all", "conditions": [ "mobile 360x800" ], "result": "issues" }, { "id": "sports", "description": "Sportsbook, representing the live-data betting journey and network-dependent state handling.", "url": "https://betao.bet.br/sports", "conditions": [ "mobile 360x800", "live API failure observed" ], "result": "issues" }, { "id": "help", "description": "Help centre, representing support and recovery content.", "url": "https://betao.bet.br/help", "conditions": [ "mobile 360x800" ], "result": "issues" }, { "id": "register", "description": "Registration entry flow inspected through the first personal-data form; no personal data was submitted.", "url": "https://betao.bet.br/", "conditions": [ "registration modal opened" ], "result": "issues" }, { "id": "not-found", "description": "Synthetic missing route used to inspect HTTP failure handling and indexing policy.", "url": "https://betao.bet.br/definitely-not-a-real-page-404", "conditions": [ "HTTP 404" ], "result": "pass" } ], "findings": [ { "id": "F01", "severity": "low", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The site exposes only a hard-coded dark palette rather than following the user’s color-scheme preference.", "evidence": "The normal and emulated-dark screenshots are visually identical, and the computed root color-scheme is not declared as a light/dark pair.", "suggestedFix": "Declare color-scheme and provide preference-driven light and dark tokens with prefers-color-scheme or light-dark().", "effort": "medium", "artifacts": [ "evidence/home-desktop.png", "evidence/home-dark.png" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F02", "severity": "medium", "principleId": "respect-user-preferences", "principleCheckId": "respects-reduced-motion", "guidanceId": "accessibility", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Reduced-motion preference does not stop non-essential motion.", "evidence": "Under prefers-reduced-motion: reduce, 13 animations remained, including continuously running blink animations at 800 ms and 1000 ms and ten 350 ms row-slide animations.", "suggestedFix": "Add a prefers-reduced-motion: reduce layer that removes blinking, row entrance motion and non-essential transitions.", "effort": "small", "artifacts": [ "evidence/reduced-motion.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F03", "severity": "low", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Route and state changes do not use View Transitions.", "evidence": "The platform probe found browser support but no view-transition CSS or authored transition names across the representative Next.js UI.", "suggestedFix": "Use document.startViewTransition for same-document state changes and cross-document view-transition CSS for route changes, with reduced-motion fallbacks.", "effort": "medium", "artifacts": [ "evidence/platform-probe.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F04", "severity": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The cookie consent panel obscures primary content on every sampled mobile route.", "evidence": "Mobile screenshots of home, promotions, casino, sports and help show the same large fixed consent panel covering roughly the lower quarter to third of the viewport.", "suggestedFix": "Use a compact, non-blocking consent surface where legally permissible, keep equivalent accept/reject choices visible, and preserve access to the current task.", "effort": "medium", "artifacts": [ "evidence/home-mobile.png", "evidence/promotions-mobile.png", "evidence/casino-mobile.png", "evidence/sports-mobile.png", "evidence/help-mobile.png" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F05", "severity": "medium", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Modal overlays are implemented as custom divs rather than native dialog/popover primitives.", "evidence": "The platform probe found zero dialog and zero popover elements; the registration overlay is a div with role=dialog and the consent surface has no dialog semantics.", "suggestedFix": "Use for modal account flows and popover for transient UI, including native focus management and light-dismiss where appropriate.", "effort": "medium", "artifacts": [ "evidence/platform-probe.json", "evidence/register-flow.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F06", "severity": "medium", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "overflow-clipping-control", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The first viewport is crowded with rankings, live win amounts, carousels and persistent chrome.", "evidence": "The mobile homepage shows header, hero, paid-today carousel, bettor ranking, search, content tabs, bottom navigation and consent at once, leaving little stable task space.", "suggestedFix": "Reduce simultaneous promotional modules, prioritize one primary task, and defer secondary live rankings below the first viewport.", "effort": "medium", "artifacts": [ "evidence/home-mobile.png" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F07", "severity": "medium", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Several primary touch targets are shorter than the recommended target size.", "evidence": "The platform probe measured the visible Cadastre-se control at 34 px high and Entrar at 38 px high, below a comfortable 44 px target.", "suggestedFix": "Increase interactive hit areas to at least 44 CSS px without relying on visual size alone and retain the visible focus treatment.", "effort": "small", "artifacts": [ "evidence/platform-probe.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F08", "severity": "high", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The sportsbook converts failed live-data requests into a misleading empty state with no retry.", "evidence": "HAR evidence records repeated 403/ERR_FAILED responses from prod20562.fssb.io while the sports page says “Nenhum evento encontrado” and offers no retry or failure explanation.", "suggestedFix": "Distinguish network/API failure from a genuine empty result, announce the state, and provide retry plus support/recovery paths.", "effort": "medium", "artifacts": [ "evidence/home-summary.json", "evidence/sports-mobile.png" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F09", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "confidence": "high", "summary": "Mobile load performance is poor.", "evidence": "Lighthouse measured LCP 12.0 s, FCP 4.7 s, TBT 710 ms, CLS 0.155 and a performance score of 0.36; the raw-CDP trace corroborated LCP 2.79 s and 98.69 ms blocking time in a less-throttled run.", "suggestedFix": "Prioritize the LCP resource, reduce initial CSS/JS/font payloads, defer trackers and non-critical modules, then remeasure under mobile throttling.", "effort": "large", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace.json", "evidence/home-trace-summary.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F10", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "confidence": "high", "summary": "Late content causes visible layout instability.", "evidence": "The 360 px layout observer measured CLS 0.131, dominated by a 0.1308 shift at about 5.3 s; the image audit found 16 images without explicit dimensions.", "suggestedFix": "Reserve intrinsic image and dynamic-module space with width/height or aspect-ratio and avoid inserting late banners above settled content.", "effort": "medium", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/images.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F11", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-preload-priority", "guidanceCategory": "performance", "confidence": "high", "summary": "The critical delivery path is oversized and fragmented.", "evidence": "The HAR contains 295 requests and 4.09 MB transferred, including 29 stylesheets and 1.35 MB of fonts; numerous parser-inserted stylesheets are VeryHigh-priority render-blocking candidates.", "suggestedFix": "Subset and consolidate fonts, reduce critical CSS, preload only true critical resources and defer route-irrelevant styles and scripts.", "effort": "large", "artifacts": [ "evidence/home.har", "evidence/home-summary.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F12", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "confidence": "high", "summary": "Large amounts of unused CSS and JavaScript ship on first load.", "evidence": "Lighthouse estimates 330 KiB unused JavaScript and 144 KiB unused CSS; FontAwesome all.css is 99.9% unused and analytics bundles dominate several waste entries.", "suggestedFix": "Code-split route features, replace full icon-font bundles with used SVGs/subsets, and load analytics only after valid consent.", "effort": "medium", "artifacts": [ "evidence/lighthouse.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F13", "severity": "high", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Text and primary controls fail WCAG contrast.", "evidence": "Lighthouse found 19 contrast failures, including white Cadastre-se text on #ff9400 at 2.21:1 and ranking labels at 3.17:1.", "suggestedFix": "Adjust foreground/background tokens to meet 4.5:1 for normal text and test every state in the dark theme.", "effort": "small", "artifacts": [ "evidence/lighthouse.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F14", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Heading and landmark structure is not consistently logical.", "evidence": "Lighthouse failed heading-order; DOM recon shows early H3 headings before the page H1, and the help route renders two H1 elements.", "suggestedFix": "Place one descriptive H1 near the start of each main region, follow sequential heading levels and add a semantic main landmark.", "effort": "medium", "artifacts": [ "evidence/lighthouse.json", "evidence/focus-metadata.json", "evidence/help-mobile.png" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F15", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "guidanceCategory": "accessibility", "confidence": "high", "summary": "The viewport configuration prevents normal pinch zoom.", "evidence": "The rendered viewport meta includes maximum-scale=1 even though the narrow layout itself has no horizontal overflow.", "suggestedFix": "Remove maximum-scale=1 and do not disable user scaling; retain the existing fluid no-overflow layout.", "effort": "trivial", "artifacts": [ "evidence/platform-probe.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F16", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The page loads with browser console errors and runtime request failures.", "evidence": "Lighthouse reports 13 console-error items and a failed errors-in-console audit; HAR also records failed/aborted requests.", "suggestedFix": "Fix first-party errors, handle expected third-party failures without uncaught noise, and enforce clean-console checks in CI.", "effort": "medium", "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F17", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Several images have incorrect aspect ratios or missing dimensions.", "evidence": "Lighthouse found 8 distorted image instances, while the image primitive found 16 missing-dimension and 15 oversized images.", "suggestedFix": "Preserve intrinsic aspect ratios, declare dimensions and keep responsive srcset/sizes for content imagery.", "effort": "medium", "artifacts": [ "evidence/lighthouse.json", "evidence/images.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F18", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "confidence": "high", "summary": "Security policy coverage is incomplete and multiple cookies are insecure.", "evidence": "CSP is limited to frame-ancestors, with no script-src/object-src; nosniff, Referrer-Policy and Permissions-Policy are absent. The cookie audit found 11 cookies with issues, including analytics cookies lacking Secure.", "suggestedFix": "Deploy a nonce/hash-based CSP, nosniff, strict referrer and permissions policies, and set Secure/SameSite appropriately on every cookie.", "effort": "medium", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F19", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "security", "confidence": "high", "summary": "Tracking starts with a large third-party footprint before an affirmative consent choice.", "evidence": "The initial HAR includes 87 third-party requests and 1.08 MB; the tracker probe found 16 third-party origins and DoubleClick, Facebook and Google Ads trackers while the consent panel was still shown.", "suggestedFix": "Block non-essential analytics/advertising storage and requests until opt-in, minimize vendors and retention, and provide an equally prominent reject-all action.", "effort": "large", "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/trackers.json", "evidence/home-mobile.png" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F20", "severity": "medium", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "guidanceCategory": "security", "confidence": "high", "summary": "Authentication is password-only despite a relevant account flow.", "evidence": "The registration form requests a password and the runtime/source probe found no PublicKeyCredential or navigator.credentials integration; no permission prompt fired on load.", "suggestedFix": "Offer passkeys/WebAuthn for sign-in and reauthentication while retaining a secure fallback.", "effort": "large", "artifacts": [ "evidence/register-flow.json", "evidence/runtime-probe.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F21", "severity": "medium", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "guidanceId": "stabilize-reactive-state", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The app manifest is present but no service worker is registered.", "evidence": "The manifest declares standalone display and start_url, but navigator.serviceWorker.getRegistrations() returned an empty list, so no offline fallback is available.", "suggestedFix": "Register a scoped service worker and provide a purposeful offline shell/fallback for help and account-recovery content.", "effort": "medium", "artifacts": [ "evidence/site-files.json", "evidence/runtime-probe.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F22", "severity": "high", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "forms", "guidanceCategory": "forms", "confidence": "high", "summary": "Consent does not offer an equivalent reject-all choice.", "evidence": "The first layer offers Personalizar and a brightly emphasized Aceitar tudo. After Personalizar, visible actions are Salvar preferências and Aceitar tudo, still with no reject-all control.", "suggestedFix": "Present Accept all and Reject all with equal prominence, use privacy-preserving defaults, and make withdrawal as easy as consent.", "effort": "small", "artifacts": [ "evidence/home-mobile.png", "evidence/consent-probe.json" ], "pathId": "register", "url": "https://betao.bet.br/" }, { "id": "F23", "severity": "medium", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-up-form", "guidanceCategory": "forms", "confidence": "high", "summary": "Registration disables or omits useful autofill semantics.", "evidence": "The email field uses autocomplete=off and the CPF field has no autocomplete token; only the password field has new-password.", "suggestedFix": "Use autocomplete=email, name and inputmode tokens appropriate to each field; do not disable password-manager/autofill support.", "effort": "small", "artifacts": [ "evidence/register-flow.json" ], "pathId": "register", "url": "https://betao.bet.br/" }, { "id": "F24", "severity": "high", "principleId": "be-trustworthy", "principleCheckId": "safe-commercial-and-account-flows", "guidanceId": "forms", "guidanceCategory": "forms", "confidence": "high", "summary": "The responsible-gambling limit defaults to unlimited during account creation.", "evidence": "The registration form visibly labels “Limites de Jogo Responsável” with “Ilimitado (padrão)” before account creation.", "suggestedFix": "Require an explicit, informed limit choice, make protective limits easy to choose and change, and avoid unlimited as the preselected default.", "effort": "medium", "artifacts": [ "evidence/register-flow.json" ], "pathId": "register", "url": "https://betao.bet.br/" }, { "id": "F25", "severity": "medium", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Page weight and third-party resources are disproportionate to the first-view task.", "evidence": "The initial page transfers 4.09 MB across 295 requests; 1.08 MB and 87 requests are third-party, with 1.35 MB in fonts alone.", "suggestedFix": "Set route-level byte/request budgets, defer non-essential trackers, subset fonts and avoid loading offscreen live modules before demand.", "effort": "large", "artifacts": [ "evidence/home-summary.json" ], "pathId": "home", "url": "https://betao.bet.br/" }, { "id": "F26", "severity": "medium", "principleId": "be-memory-efficient", "principleCheckId": "bounded-footprint", "guidanceId": "manage-recurring-intervals", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The homepage has a high baseline memory footprint for a discovery page.", "evidence": "The baseline heap summary reports 939,206 heap nodes and 54.4 MB self size with 3,325 DOM elements; repeated filter toggling did not grow it further, but the initial footprint is heavy.", "suggestedFix": "Reduce simultaneously mounted hidden desktop/mobile trees, virtualize repeated cards and dispose unused live-data objects and subscriptions.", "effort": "large", "artifacts": [ "evidence/home-heap.heapsnapshot", "evidence/runtime-probe.json" ], "pathId": "home", "url": "https://betao.bet.br/" } ], "taskList": [ { "id": "T01", "title": "Gate trackers on valid consent and add a symmetric reject-all action", "priority": 1, "findingIds": [ "F19", "F22" ], "guidanceId": "privacy", "status": "open" }, { "id": "T02", "title": "Cut the critical payload and fix LCP/CLS", "priority": 2, "findingIds": [ "F09", "F10", "F11", "F12", "F25" ], "guidanceId": "performance", "status": "open" }, { "id": "T03", "title": "Make registration protective by default", "priority": 3, "findingIds": [ "F23", "F24" ], "guidanceId": "forms", "status": "open" }, { "id": "T04", "title": "Fix contrast, heading order, zoom and target sizes", "priority": 4, "findingIds": [ "F07", "F13", "F14", "F15" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T05", "title": "Harden CSP, headers and cookie attributes", "priority": 5, "findingIds": [ "F18" ], "guidanceId": "security", "status": "open" }, { "id": "T06", "title": "Expose honest sportsbook failure and retry states", "priority": 6, "findingIds": [ "F08" ], "guidanceId": "persistent-toast-notifications", "status": "open" }, { "id": "T07", "title": "Replace custom modal surfaces with semantic primitives", "priority": 7, "findingIds": [ "F04", "F05" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T08", "title": "Reduce baseline DOM/heap footprint", "priority": 8, "findingIds": [ "F26" ], "guidanceId": "manage-recurring-intervals", "status": "open" }, { "id": "T09", "title": "Add preference-aware theming and reduced-motion rules", "priority": 9, "findingIds": [ "F01", "F02" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T10", "title": "Add offline fallback and passkey support", "priority": 10, "findingIds": [ "F20", "F21" ], "guidanceId": "passkeys", "status": "open" } ], "budget": { "pathCount": 7, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-23T03-03-38-536Z" }