{ "url": "https://jup9.com", "auditedAt": "2026-07-23T08:10:00.000Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete audit of the site’s sole authored page plus its HTTP 404 failure state. External propush.me corporate destinations were not audited because they are a different host.", "page": { "appType": "mpa", "framework": "Static HTML/CSS", "notes": "Single-page ad-delivery domain disclosure. Core content is server-rendered; JavaScript only decodes Cloudflare-obfuscated email addresses and writes the copyright year." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "trace", "har", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "heap-summary", "Lighthouse", "axe-core", "raw HTTP fetch" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "dom", "path": "evidence/404-dom.json", "caption": "Audit evidence: 404-dom.json", "findingIds": [ "F3", "F14" ] }, { "type": "screenshot", "path": "evidence/404.png", "caption": "Unknown route showing the generic nginx 404.", "findingIds": [ "F3", "F14" ] }, { "type": "other", "path": "evidence/axe.json", "caption": "axe-core WCAG violation and pass output.", "findingIds": [ "F6", "F7", "F8" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Audit evidence: cookies.json", "findingIds": [ "F11", "F12", "F13" ] }, { "type": "other", "path": "evidence/curl-headers.txt", "caption": "Audit evidence: curl-headers.txt", "findingIds": [] }, { "type": "screenshot", "path": "evidence/dark-mode.png", "caption": "Page under prefers-color-scheme: dark; surface remains light.", "condition": "prefers-color-scheme: dark", "findingIds": [ "F1" ] }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "Crawler/no-JavaScript view; core content remains visible.", "findingIds": [ "F9" ] }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Browser-rendered view with JavaScript.", "findingIds": [ "F9" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "Audit evidence: discoverability.json", "findingIds": [ "F9" ] }, { "type": "other", "path": "evidence/headers.json", "caption": "Audit evidence: headers.json", "findingIds": [ "F11", "F12", "F13" ] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "Readable heap summary from the baseline snapshot.", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-summary.json", "caption": "Condensed heap and in-page memory metrics.", "findingIds": [] }, { "type": "screenshot", "path": "evidence/high-contrast.png", "caption": "Page under prefers-contrast: more; design remains unchanged.", "condition": "prefers-contrast: more", "findingIds": [ "F2" ] }, { "type": "other", "path": "evidence/images.json", "caption": "Audit evidence: images.json", "findingIds": [ "F6" ] }, { "type": "layout", "path": "evidence/layout-mobile.json", "caption": "Audit evidence: layout-mobile.json", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "lighthouse", "path": "evidence/lighthouse-summary.json", "caption": "Compact Lighthouse scores, metrics, and failures.", "findingIds": [ "F4", "F5", "F9" ] }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "Full Lighthouse report.", "findingIds": [ "F6", "F7", "F8" ] }, { "type": "trace-summary", "path": "evidence/load-trace-summary.json", "caption": "Compact trace timings and main-thread summary.", "findingIds": [ "F4", "F5" ] }, { "type": "trace", "path": "evidence/load-trace.json", "caption": "DevTools performance trace retained for inspection.", "findingIds": [] }, { "type": "screenshot", "path": "evidence/mobile-360.png", "caption": "Disclosure page at a 360×800 mobile viewport.", "condition": "viewport: 360x800", "findingIds": [] }, { "type": "har-summary", "path": "evidence/network-summary.json", "caption": "Compact HAR network signals.", "findingIds": [ "F5", "F12", "F15" ] }, { "type": "har", "path": "evidence/network.har", "caption": "HAR 1.2 network capture retained for verification.", "findingIds": [ "F5", "F12", "F15" ] }, { "type": "other", "path": "evidence/platform-probe.json", "caption": "Audit evidence: platform-probe.json", "findingIds": [ "F1", "F2", "F8", "F9", "F10" ] }, { "type": "other", "path": "evidence/raw-home.html", "caption": "Audit evidence: raw-home.html", "findingIds": [] }, { "type": "screenshot", "path": "evidence/recon-desktop.png", "caption": "Desktop first viewport of the disclosure page.", "findingIds": [] }, { "type": "dom", "path": "evidence/recon-dom.json", "caption": "Audit evidence: recon-dom.json", "findingIds": [ "F8", "F9", "F10" ] }, { "type": "other", "path": "evidence/reduced-motion-probe.json", "caption": "Audit evidence: reduced-motion-probe.json", "condition": "prefers-reduced-motion: reduce", "findingIds": [] }, { "type": "other", "path": "evidence/robots-status.txt", "caption": "Audit evidence: robots-status.txt", "findingIds": [] }, { "type": "other", "path": "evidence/robots.txt", "caption": "Audit evidence: robots.txt", "findingIds": [] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Audit evidence: secrets.json", "findingIds": [ "F11", "F12", "F13" ] }, { "type": "other", "path": "evidence/sitemap-status.txt", "caption": "Audit evidence: sitemap-status.txt", "findingIds": [] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "Audit evidence: sitemap.xml", "findingIds": [] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Audit evidence: trackers.json", "findingIds": [ "F11", "F12", "F13" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Active audit using dark-mode.png, platform-probe.json", "evidence": "Dark preference was actively emulated; the rendered surface remained white and CSS contains no adaptive theme.", "pathIds": [ "home" ], "artifacts": [ "evidence/dark-mode.png", "evidence/platform-probe.json" ], "findingIds": [ "F1" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Active audit using reduced-motion-probe.json", "evidence": "Reduced-motion was actively emulated; there are no CSS/WAAPI animations or auto-advancing content to reduce.", "pathIds": [ "home" ], "artifacts": [ "evidence/reduced-motion-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Active audit using high-contrast.png, platform-probe.json", "evidence": "Increased contrast was actively emulated; output did not adapt and CSS has no prefers-contrast/forced-colors treatment.", "pathIds": [ "home" ], "artifacts": [ "evidence/high-contrast.png", "evidence/platform-probe.json" ], "findingIds": [ "F2" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "This single static document has no same-document state swap or internal route transition to animate.", "reason": "This single static document has no same-document state swap or internal route transition to animate.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "The page has no parallax, scrollytelling, reveal, carousel, or other scroll-linked motion.", "reason": "The page has no parallax, scrollytelling, reveal, carousel, or other scroll-linked motion.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "The only interactions are native links; the page adds no custom pointer handlers, scroll hijacking, gesture emulation, or motion that fights platform behavior.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-desktop.png", "evidence": "There is no sticky/affixed chrome or long multi-section navigation whose state must react to scroll.", "reason": "There is no sticky/affixed chrome or long multi-section navigation whose state must react to scroll.", "artifacts": [ "evidence/recon-desktop.png" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "No tooltips, popovers, menus, or tethered overlays exist on this page.", "reason": "No tooltips, popovers, menus, or tethered overlays exist on this page.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Active audit using recon-desktop.png, recon-dom.json, platform-probe.json", "evidence": "The single-view page uses clearly labelled sections, underlined contact links, a distinct footer navigation, and visible focus outlines to make each navigation target and focus move apparent.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-desktop.png", "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Active audit using recon-desktop.png, mobile-360.png, layout-mobile.json", "evidence": "Initial desktop/mobile screenshots and DOM show no popup, banner, consent wall, or overlay obscuring content.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-desktop.png", "evidence/mobile-360.png", "evidence/layout-mobile.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "No overlay, disclosure, picker, modal flow, or rich control is present.", "reason": "No overlay, disclosure, picker, modal flow, or rich control is present.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Active audit using recon-desktop.png", "evidence": "The first viewport is a sparse text disclosure with one logo and no application frame or decorative clutter.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Active audit using mobile-360.png, layout-mobile.json", "evidence": "At 360×800 the layout primitive reports scrollWidth=clientWidth=360, overflow 0, and the mobile screenshot reflows legibly.", "pathIds": [ "home" ], "artifacts": [ "evidence/mobile-360.png", "evidence/layout-mobile.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "high", "method": "Active audit using mobile-360.png, layout-mobile.json, recon-dom.json, platform-probe.json", "evidence": "The simple container/content/footer components adapt through fluid max-width, padding, wrapping, and a narrow-screen footer rule; the mobile capture confirms the changed layout.", "pathIds": [ "home" ], "artifacts": [ "evidence/mobile-360.png", "evidence/layout-mobile.json", "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json, axe.json, lighthouse.json", "evidence": "Programmatic keyboard focus produced a visible native 1px auto outline on every link; axe passed target-size and no hover-only content exists.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json", "evidence/axe.json", "evidence/lighthouse.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Active audit using recon-desktop.png", "evidence": "The first viewport plainly explains the domain’s purpose, then presents a clearly labelled abuse-reporting section and email action.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "The primary action is a real mailto link with descriptive visible address; there are no hidden requirements, account wall, modal, or upsell.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Active audit using 404.png, 404-dom.json", "evidence": "The exercised not-found state is a bare nginx page with no recovery route.", "pathIds": [ "error-404" ], "artifacts": [ "evidence/404.png", "evidence/404-dom.json" ], "findingIds": [ "F3" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "medium", "method": "Active audit using load-trace-summary.json, lighthouse-summary.json", "evidence": "Lighthouse LCP/FCP was 2.62 s, narrowly above the 2.5 s good LCP threshold; CLS and TBT were 0 and a separate trace measured LCP 1.03 s.", "pathIds": [ "home" ], "artifacts": [ "evidence/load-trace-summary.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F4" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Active audit using mobile-360.png, layout-mobile.json, load-trace-summary.json, lighthouse-summary.json", "evidence": "Mobile layout observation after 3 s and Lighthouse both measured CLS 0 with no layout-shift entries.", "pathIds": [ "home" ], "artifacts": [ "evidence/mobile-360.png", "evidence/layout-mobile.json", "evidence/load-trace-summary.json", "evidence/lighthouse-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "high", "method": "Active audit using load-trace-summary.json, lighthouse-summary.json", "evidence": "Trace and Lighthouse found no long tasks and 0 ms total blocking time; the page has only minimal scripting.", "pathIds": [ "home" ], "artifacts": [ "evidence/load-trace-summary.json", "evidence/lighthouse-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Active audit using network-summary.json, network.har, load-trace-summary.json, lighthouse-summary.json", "evidence": "HAR/Lighthouse show a render-critical CSS→Google Fonts CSS→font chain, missing preconnect, and missing cache headers on versioned CSS/SVG.", "pathIds": [ "home" ], "artifacts": [ "evidence/network-summary.json", "evidence/network.har", "evidence/load-trace-summary.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F5" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "pass", "confidence": "high", "method": "Active audit using network-summary.json, network.har, lighthouse.json", "evidence": "Lighthouse reports no unused CSS/JS savings and HAR shows only 786 bytes of script with no large duplicate or legacy bundle.", "pathIds": [ "home" ], "artifacts": [ "evidence/network-summary.json", "evidence/network.har", "evidence/lighthouse.json" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "Active audit using axe.json, lighthouse.json, images.json", "evidence": "axe and Lighthouse identify the logo image as missing alt; links have accessible names and no form/canvas exists.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json", "evidence/lighthouse.json", "evidence/images.json" ], "findingIds": [ "F6" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Active audit using axe.json, lighthouse.json", "evidence": "axe measured link contrast at 3.79:1 and footer text at 3.94:1 against white, below 4.5:1.", "pathIds": [ "home" ], "artifacts": [ "evidence/axe.json", "evidence/lighthouse.json" ], "findingIds": [ "F7" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json, axe.json, lighthouse.json", "evidence": "Landmarks and focus outlines are present, but there are zero semantic headings and axe reports no h1.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json", "evidence/axe.json", "evidence/lighthouse.json" ], "findingIds": [ "F8" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Active audit using recon-desktop.png, mobile-360.png, layout-mobile.json", "evidence": "Desktop/mobile screenshots show unclipped 16px body text, readable line lengths around 600px, clear spacing, and no cramped wrapping.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-desktop.png", "evidence/mobile-360.png", "evidence/layout-mobile.json" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "high", "method": "Active audit using mobile-360.png, layout-mobile.json, axe.json, lighthouse.json", "evidence": "The viewport allows scaling, 360px reflow has no horizontal overflow, axe passes target-size, and no audio/video requires alternatives.", "pathIds": [ "home" ], "artifacts": [ "evidence/mobile-360.png", "evidence/layout-mobile.json", "evidence/axe.json", "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Active audit using lighthouse.json", "evidence": "Lighthouse’s errors-in-console audit passed with an empty error table.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "pass", "confidence": "high", "method": "Active audit using raw-home.html, robots.txt, sitemap.xml, images.json, lighthouse.json", "evidence": "Raw/DOM evidence has HTML5 doctype and UTF-8 charset; SVG logo displays at its natural ratio, Lighthouse passes aspect/responsive sizing, and no deprecated API was found.", "pathIds": [ "home" ], "artifacts": [ "evidence/raw-home.html", "evidence/robots.txt", "evidence/sitemap.xml", "evidence/images.json", "evidence/lighthouse.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "pass", "confidence": "high", "method": "Active audit using lighthouse.json, platform-probe.json", "evidence": "Lighthouse passes deprecations, BFCache, inspector issues, source maps, third-party cookies, and best-practices overall; no forms or permission prompts exist.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/platform-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json, discoverability.json, discoverability-rendered.png, discoverability-crawler.png", "evidence": "Title is the generic “Propush” and meta description is absent in raw and rendered DOM; Lighthouse fails meta-description.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json", "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png" ], "findingIds": [ "F9" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json, raw-home.html, robots.txt, sitemap.xml", "evidence": "All six links have real href values and descriptive visible labels, viewport metadata is present, and missing robots.txt does not block crawling.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json", "evidence/raw-home.html", "evidence/robots.txt", "evidence/sitemap.xml" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "high", "method": "Active audit using raw-home.html, robots.txt, sitemap.xml, recon-dom.json, platform-probe.json", "evidence": "The home document returns 200 over its sole public URL, has no noindex/noarchive, robots 404 leaves crawling allowed, and no localized variants require hreflang; no conflicting sitemap signal exists.", "pathIds": [ "home" ], "artifacts": [ "evidence/raw-home.html", "evidence/robots.txt", "evidence/sitemap.xml", "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "The organizational disclosure has no JSON-LD and no Open Graph metadata.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Active audit using headers.json, cookies.json, secrets.json, trackers.json", "evidence": "HTTPS and nosniff are present with no cookies/mixed content, but CSP is missing and HSTS is effectively only one second.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json", "evidence/trackers.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Active audit using headers.json, cookies.json, secrets.json, trackers.json, network-summary.json, network.har", "evidence": "No trackers, analytics, cookies, or exposed secrets were found, but two Google Fonts origins receive visitor requests and 45.7 KB.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json", "evidence/trackers.json", "evidence/network-summary.json", "evidence/network.har" ], "findingIds": [ "F12" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json, headers.json, cookies.json, secrets.json, trackers.json", "evidence": "The static disclosure requests no permissions and has no authentication surface.", "reason": "The static disclosure requests no permissions and has no authentication surface.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json", "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json", "evidence/trackers.json" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Active audit using headers.json, cookies.json, secrets.json, trackers.json", "evidence": "No clickjacking protection, Referrer-Policy, or Permissions-Policy is declared.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json", "evidence/trackers.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "Active audit using discoverability.json, discoverability-rendered.png, discoverability-crawler.png, raw-home.html, robots.txt, sitemap.xml", "evidence": "Discoverability comparison finds 97% raw/rendered content overlap and no JS shell; core content and links exist before JavaScript.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png", "evidence/raw-home.html", "evidence/robots.txt", "evidence/sitemap.xml" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json, raw-home.html, robots.txt, sitemap.xml", "evidence": "The page has no overlays/distributed async UI; its only authored runtime update sets the year, while all core content remains stable and usable.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json", "evidence/raw-home.html", "evidence/robots.txt", "evidence/sitemap.xml" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "This is a small informational disclosure, not an app-like workflow; installability and offline operation are not proportionate requirements.", "reason": "This is a small informational disclosure, not an app-like workflow; installability and offline operation are not proportionate requirements.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Active audit using 404.png, 404-dom.json", "evidence": "A real unknown route returns an unbranded nginx 404 with no recovery action.", "pathIds": [ "error-404" ], "artifacts": [ "evidence/404.png", "evidence/404-dom.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "The English document declares lang=en; no physical left/right CSS was found and the layout has no bidirectional-sensitive ordering.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "This deliberately English disclosure contains no dates, currency, measurements, durations, or other locale-sensitive data; only a four-digit copyright year is shown.", "reason": "This deliberately English disclosure contains no dates, currency, measurements, durations, or other locale-sensitive data; only a four-digit copyright year is shown.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "No times, events, recurrence, deadlines, or stored temporal data are exposed.", "reason": "No times, events, recurrence, deadlines, or stored temporal data are exposed.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Active audit using recon-desktop.png, recon-dom.json, platform-probe.json", "evidence": "Screenshots/DOM show no consent wall, upsell, disguised ad, forced continuity, misleading default, or cancellation obstruction.", "pathIds": [ "home" ], "artifacts": [ "evidence/recon-desktop.png", "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "No form or editable input exists to validate.", "reason": "No form or editable input exists to validate.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "No input or authentication/payment/address field exists.", "reason": "No input or authentication/payment/address field exists.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-desktop.png, recon-dom.json, platform-probe.json", "evidence": "The page explicitly states it does not sell goods/services or request payment and exposes no checkout, subscription, auth, consent, or account flow.", "reason": "The page explicitly states it does not sell goods/services or request payment and exposes no checkout, subscription, auth, consent, or account flow.", "artifacts": [ "evidence/recon-desktop.png", "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "pass", "confidence": "high", "method": "Active audit using images.json", "evidence": "The only image is an SVG displayed at its natural 150px width; images evidence finds no oversizing or legacy raster format.", "pathIds": [ "home" ], "artifacts": [ "evidence/images.json" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "pass", "confidence": "high", "method": "Active audit using load-trace-summary.json, lighthouse-summary.json, network-summary.json, network.har", "evidence": "Trace finds no long/background tasks and HAR has only seven requests with no analytics or polling.", "pathIds": [ "home" ], "artifacts": [ "evidence/load-trace-summary.json", "evidence/lighthouse-summary.json", "evidence/network-summary.json", "evidence/network.har" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Active audit using network-summary.json, network.har", "evidence": "A 43.7 KB third-party font accounts for most of this otherwise tiny text-only page’s 54.6 KB transfer.", "pathIds": [ "home" ], "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "findingIds": [ "F15" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Active audit using discoverability.json, discoverability-rendered.png, discoverability-crawler.png, recon-dom.json, platform-probe.json", "evidence": "This static disclosure has no transactional/productivity capability requiring WebMCP tools; its server-rendered text and real mail link remain machine-readable.", "reason": "This static disclosure has no transactional/productivity capability requiring WebMCP tools; its server-rendered text and real mail link remain machine-readable.", "artifacts": [ "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png", "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "No summarisation, generation, or other inference feature is part of this page’s intended task.", "reason": "No summarisation, generation, or other inference feature is part of this page’s intended task.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "not-applicable", "confidence": "high", "method": "Active audit using recon-dom.json, platform-probe.json", "evidence": "The static page has no modal, route cycle, feed, editor, or representative interaction that can legitimately be repeated about ten times.", "reason": "The static page has no modal, route cycle, feed, editor, or representative interaction that can legitimately be repeated about ten times.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Active audit using heap-baseline.heapsnapshot, heap-summary.json, recon-dom.json, platform-probe.json", "evidence": "Heap summary reports 31,280 nodes and 1.15 MB self size; in-page metrics show 40 DOM elements and about 1.2 MB used JS heap, proportionate to this page.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-summary.json", "evidence/recon-dom.json", "evidence/platform-probe.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Active audit using heap-baseline.heapsnapshot, heap-summary.json, raw-home.html, robots.txt, sitemap.xml", "evidence": "Heap constructor summary contains no Detached* population, and authored source contains no addEventListener, timer, observer, or cache setup; only a one-time year assignment runs.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-summary.json", "evidence/raw-home.html", "evidence/robots.txt", "evidence/sitemap.xml" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F1", "F2" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "pass" }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass" }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "pass" }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F3" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F4", "F5" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F6", "F7", "F8" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "pass" }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F9", "F10" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F11", "F12", "F13" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F14" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F15" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "This static disclosure has no transactional/productivity capability requiring WebMCP tools; its server-rendered text and real mail link remain machine-readable. No summarisation, generation, or other inference feature is part of this page’s intended task." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Homepage and only authored template: domain-purpose disclosure, abuse-reporting contact, responsive layout, preferences, accessibility, performance, security, crawler, and memory states.", "url": "https://jup9.com/", "conditions": [ "desktop viewport", "viewport: 360x800", "prefers-color-scheme: dark", "prefers-contrast: more", "prefers-reduced-motion: reduce", "keyboard focus", "JavaScript disabled/crawler view", "throttled Lighthouse load" ], "result": "issues" }, { "id": "error-404", "description": "Representative HTTP/network failure surface, exercised with a nonexistent path to judge state clarity and recovery.", "url": "https://jup9.com/not-a-real-page", "conditions": [ "unknown route / HTTP 404" ], "result": "issues" } ], "findings": [ { "id": "F1", "pathId": "home", "url": "https://jup9.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "The page ignores the user’s dark color-scheme preference.", "evidence": "The dark-mode screenshot remains a hard-coded white surface with black text; the CSS probe found no color-scheme, prefers-color-scheme, or light-dark() support.", "artifacts": [ "evidence/dark-mode.png", "evidence/platform-probe.json" ], "suggestedFix": "Declare color-scheme: light dark and define adaptive surface, text, link, and logo colors with prefers-color-scheme or light-dark(), following dark-mode guidance.", "effort": "small" }, { "id": "F2", "pathId": "home", "url": "https://jup9.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "adapt-scrollbar-to-contrast-preferences", "guidanceCategory": "user-experience", "severity": "low", "confidence": "high", "summary": "The design has no response to increased-contrast or forced-color preferences.", "evidence": "The prefers-contrast: more screenshot is visually identical to the default and the CSS probe found no prefers-contrast or forced-colors rules.", "artifacts": [ "evidence/high-contrast.png", "evidence/platform-probe.json" ], "suggestedFix": "Add a high-contrast/forced-colors treatment for links and essential UI and avoid suppressing system colors.", "effort": "small" }, { "id": "F3", "pathId": "error-404", "url": "https://jup9.com/not-a-real-page", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "The not-found state gives no route back or recovery action.", "evidence": "The exercised 404 path shows only “404 Not Found” and “nginx”, with no home link, contact route, explanation, or retry/recovery option.", "artifacts": [ "evidence/404.png", "evidence/404-dom.json" ], "suggestedFix": "Serve a branded 404 page that explains the state and offers links back to the disclosure page and abuse-reporting contact.", "effort": "small" }, { "id": "F4", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "low", "confidence": "medium", "summary": "The throttled lab LCP narrowly misses the good Core Web Vitals threshold.", "evidence": "Lighthouse measured LCP/FCP at 2.62 s (good LCP is at most 2.5 s), although the unthrottled trace measured 1.03 s and both found zero blocking time and zero CLS.", "artifacts": [ "evidence/load-trace-summary.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Shorten the critical font/style chain and retest under throttling to bring LCP consistently below 2.5 s.", "effort": "small" }, { "id": "F5", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-preload-priority", "guidanceCategory": "performance", "severity": "medium", "confidence": "high", "summary": "A third-party web-font chain delays first rendering and first-party static assets lack useful cache headers.", "evidence": "HAR and Lighthouse show a 1.16 s critical chain from index.css to Google Fonts CSS to a 38–44 KB Roboto font; no preconnect is present, and the logo/CSS responses lack cache headers.", "artifacts": [ "evidence/network-summary.json", "evidence/network.har", "evidence/load-trace-summary.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Prefer a system font or self-host a tightly subsetted font; if retained, preload/preconnect it deliberately. Add long-lived immutable caching for versioned CSS and SVG assets.", "effort": "small" }, { "id": "F6", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "The Propush logo image has no text alternative.", "evidence": "axe and Lighthouse both report the sole has no alt attribute; the images primitive confirms alt is absent.", "artifacts": [ "evidence/axe.json", "evidence/lighthouse.json", "evidence/images.json" ], "suggestedFix": "Give the informative logo concise alt text such as “Propush.me by PropellerAds”, or alt=\"\" only if equivalent adjacent text is added.", "effort": "trivial" }, { "id": "F7", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "medium", "confidence": "high", "summary": "Links and footer text do not meet WCAG AA contrast.", "evidence": "axe measured blue links at 3.79:1 and gray footer text at 3.94:1 against white; normal text requires 4.5:1.", "artifacts": [ "evidence/axe.json", "evidence/lighthouse.json" ], "suggestedFix": "Darken link and footer colors until normal text reaches at least 4.5:1 in every supported theme.", "effort": "trivial" }, { "id": "F8", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "medium", "confidence": "high", "summary": "The page has no semantic heading structure.", "evidence": "The DOM probe found zero h1–h6 elements and axe reports page-has-heading-one; visible section titles are paragraphs. Landmarks and visible native focus outlines do work.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json", "evidence/axe.json", "evidence/lighthouse.json" ], "suggestedFix": "Use an h1 for the page purpose and h2 elements for Key Information, Reporting Abuse, and Contact Us while preserving the visual treatment.", "effort": "trivial" }, { "id": "F9", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Search results get a generic title and no description.", "evidence": "The rendered and raw documents use the title “Propush” and have no meta description; Lighthouse fails meta-description.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json", "evidence/discoverability.json", "evidence/discoverability-rendered.png", "evidence/discoverability-crawler.png", "evidence/lighthouse-summary.json" ], "suggestedFix": "Use a descriptive title such as “jup9.com traffic delivery disclosure | Propush” and add a concise meta description explaining the domain’s purpose and abuse contact.", "effort": "trivial" }, { "id": "F10", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "guidanceCategory": "html", "severity": "low", "confidence": "high", "summary": "The public organizational disclosure has no structured or social-preview metadata.", "evidence": "The metadata probe found no JSON-LD and no Open Graph tags despite the page identifying Propush and its contact/purpose.", "artifacts": [ "evidence/recon-dom.json", "evidence/platform-probe.json" ], "suggestedFix": "Add accurate Organization/WebSite JSON-LD and Open Graph title, description, URL, and image values that match the visible disclosure.", "effort": "small" }, { "id": "F11", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "Transport is HTTPS, but browser-enforced security headers are materially weak.", "evidence": "The headers primitive found no Content-Security-Policy; HSTS is only max-age=1 second. Cookies and mixed-content issues were absent.", "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json", "evidence/trackers.json" ], "suggestedFix": "Deploy a restrictive CSP, raise HSTS to a meaningful duration after rollout validation, and retain HTTPS/nosniff.", "effort": "medium" }, { "id": "F12", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "severity": "low", "confidence": "high", "summary": "A simple disclosure page sends visitors to Google Fonts unnecessarily.", "evidence": "The tracker/HAR evidence shows two Google Fonts origins receive requests and 45,662 of 54,597 transferred bytes are third-party, though no known tracker, cookie, or analytics request was detected.", "artifacts": [ "evidence/network-summary.json", "evidence/network.har", "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json", "evidence/trackers.json" ], "suggestedFix": "Use the system font stack or self-host a subsetted font so reading the disclosure does not disclose visitor network metadata to Google.", "effort": "small" }, { "id": "F13", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "severity": "medium", "confidence": "high", "summary": "Clickjacking, referrer, and permissions defenses are not declared.", "evidence": "The headers primitive found neither frame-ancestors/X-Frame-Options nor Referrer-Policy nor Permissions-Policy.", "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/secrets.json", "evidence/trackers.json" ], "suggestedFix": "Add CSP frame-ancestors (or X-Frame-Options where needed), a strict Referrer-Policy, and a least-privilege Permissions-Policy.", "effort": "small" }, { "id": "F14", "pathId": "error-404", "url": "https://jup9.com/not-a-real-page", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "HTTP failure handling falls back to an unhelpful server default.", "evidence": "A real unknown route returns the generic nginx 404 page without site identity, useful explanation, or recovery options.", "artifacts": [ "evidence/404.png", "evidence/404-dom.json" ], "suggestedFix": "Configure the origin/CDN to return a branded, accessible 404 document with recovery links while preserving the 404 status.", "effort": "small" }, { "id": "F15", "pathId": "home", "url": "https://jup9.com/", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "low", "confidence": "high", "summary": "The font is disproportionate to this small text-only page.", "evidence": "The HAR totals only 54,597 bytes, but the Google font alone is 43,686 bytes and third parties account for 84% of transfer; a system font could provide the same utility with no request.", "artifacts": [ "evidence/network-summary.json", "evidence/network.har" ], "suggestedFix": "Remove the external Roboto request or self-host a minimal subset only when branding value justifies it.", "effort": "small" } ], "taskList": [ { "id": "T1", "title": "Add a restrictive security-header baseline", "priority": 1, "findingIds": [ "F11", "F13" ], "guidanceId": "security", "status": "open" }, { "id": "T2", "title": "Fix logo alternative text, heading semantics, and color contrast", "priority": 2, "findingIds": [ "F6", "F7", "F8" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T3", "title": "Add adaptive dark and increased-contrast themes", "priority": 3, "findingIds": [ "F1", "F2" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T4", "title": "Replace the generic 404 with an actionable branded recovery page", "priority": 4, "findingIds": [ "F3", "F14" ], "guidanceId": "persistent-toast-notifications", "status": "open" }, { "id": "T5", "title": "Remove or self-host the render-blocking Google font and cache versioned assets", "priority": 5, "findingIds": [ "F4", "F5", "F12", "F15" ], "guidanceId": "performance", "status": "open" }, { "id": "T6", "title": "Add descriptive search and share metadata", "priority": 6, "findingIds": [ "F9", "F10" ], "guidanceId": "html", "status": "open" } ], "budget": { "pathCount": 2, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-23T08-07-30-468Z" }