{ "url": "https://retail.sbi.bank.in", "auditedAt": "2026-07-27T03:48:17.014Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete public-surface audit. Authenticated banking, real registration, transfers, and any flow requiring credentials, CAPTCHA completion, OTP, or personal data were intentionally not exercised.", "page": { "appType": "spa", "framework": "Angular", "notes": "retail.sbi.bank.in redirects to yonoretail.sbi.bank.in/registration/welcome. Representative public routes include the login/registration entry, advertised account-opening route, privacy policy, and Terms deep link." }, "evidenceUsed": [ "screenshot", "responsive-layout", "forced-colors", "prefers-color-scheme", "prefers-reduced-motion", "DOM/CSSOM probe", "interaction probe", "HAR", "DevTools trace", "discoverability/no-JS", "headers", "cookies", "trackers", "images", "secrets", "Lighthouse", "heap-summary" ], "guidanceConsulted": [ "accessibility", "accessible-error-announcement", "adapt-scrollbar-to-contrast-preferences", "agentic-forms", "agentic-javascript-tools", "animate-to-from-top-layer", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "batch-analytics-events", "break-up-long-tasks", "calculate-event-differentials", "calculate-with-intrinsic-sizes", "capture-location-agnostic-data", "carousel-slide-effects", "carousel-snap-highlights", "component-specific-light-dark-theme", "coordinate-global-events", "cross-document-transitions", "css", "css-layout", "dark-mode", "declarative-dialog-popover-control", "defer-rendering-heavy-content", "deliver-optimized-decorative-images", "deprioritize-background-fetches", "detect-initial-visibility-state", "directional-navigation-transitions", "efficient-background-processing", "faster-spa-view-transitions", "fluid-scaling", "forms", "full-session-analytics", "highlight-text-ranges", "html", "identify-heavy-scripts", "improve-text-layout-and-legibility", "interactive-content-reveal", "interest-triggered-tooltips", "language-detection", "language-model", "light-dismiss-a-dialog", "manage-recurring-intervals", "move-dom-element-without-losing-state", "optimize-preload-priority", "optimize-script-priority", "passkey-authentication", "passkey-conditional-create", "passkey-management", "passkey-reauthentication", "passkeys", "performance", "persistent-app-tours", "persistent-toast-notifications", "persistent-top-layer-ui", "physics-based-easing", "position-aware-tooltips", "precise-text-alignment", "privacy", "pull-to-reveal", "required-field-feedback", "resilient-context-menus-and-nested-dropdowns", "resolution-optimized-pseudo-elements", "same-document-transitions", "schedule-tasks-by-priority", "scroll-entry-exit-effects", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scrollability-affordance-hints", "search-hidden-content", "security", "sequence-distributed-events", "size-aware-styling", "stabilize-reactive-state", "stack-drill-down", "summarizer", "support-global-calendar-systems", "translator", "validate-input-after-interaction", "visually-stable-font-fallbacks", "visually-stable-mixed-fonts", "webmcp" ], "artifacts": [ { "type": "screenshot", "path": "evidence/account-desktop.png", "caption": "account desktop", "findingIds": [ "F06", "F26" ] }, { "type": "layout", "path": "evidence/account-mobile-layout.json", "caption": "account mobile layout", "findingIds": [] }, { "type": "screenshot", "path": "evidence/account-mobile.png", "caption": "account mobile", "findingIds": [] }, { "type": "other", "path": "evidence/account-probe.json", "caption": "account probe", "findingIds": [ "F06", "F26" ] }, { "type": "other", "path": "evidence/curl-headers.txt", "caption": "curl headers", "findingIds": [ "F17", "F18" ] }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "heap baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/heap-post-toggle.heapsnapshot", "caption": "heap post toggle", "findingIds": [] }, { "type": "other", "path": "evidence/home-cookies.json", "caption": "home cookies", "findingIds": [ "F18", "F19", "F24" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "home dark", "findingIds": [ "F01" ] }, { "type": "other", "path": "evidence/home-deep-probe.json", "caption": "home deep probe", "findingIds": [ "F02", "F04", "F05", "F11", "F15", "F17", "F20", "F22", "F25", "F29" ] }, { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "home desktop", "findingIds": [ "F04" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-crawler.png", "caption": "home discoverability crawler", "findingIds": [ "F16", "F21" ] }, { "type": "screenshot", "path": "evidence/home-discoverability-rendered.png", "caption": "home discoverability rendered", "findingIds": [ "F16", "F21" ] }, { "type": "discoverability", "path": "evidence/home-discoverability.json", "caption": "home discoverability", "findingIds": [ "F16", "F21" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "home dom", "findingIds": [ "F21" ] }, { "type": "other", "path": "evidence/home-headers.json", "caption": "home headers", "findingIds": [ "F18" ] }, { "type": "screenshot", "path": "evidence/home-high-contrast.png", "caption": "home high contrast", "findingIds": [] }, { "type": "other", "path": "evidence/home-images.json", "caption": "home images", "findingIds": [] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "home mobile layout", "findingIds": [ "F29" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "home mobile", "findingIds": [ "F04", "F05", "F29" ] }, { "type": "other", "path": "evidence/home-recon.json", "caption": "home recon", "findingIds": [] }, { "type": "other", "path": "evidence/home-secrets.json", "caption": "home secrets", "findingIds": [] }, { "type": "other", "path": "evidence/home-summary.json", "caption": "home summary", "findingIds": [ "F09", "F10", "F19", "F27" ] }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "home trace summary", "findingIds": [ "F08", "F09" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "home trace", "findingIds": [ "F08" ] }, { "type": "other", "path": "evidence/home-trackers.json", "caption": "home trackers", "findingIds": [ "F19", "F24", "F27" ] }, { "type": "har", "path": "evidence/home.har", "caption": "home", "findingIds": [ "F10", "F19", "F27" ] }, { "type": "other", "path": "evidence/language-menu-probe.json", "caption": "language menu probe", "findingIds": [] }, { "type": "lighthouse", "path": "evidence/lighthouse-home.json", "caption": "lighthouse home", "findingIds": [ "F08", "F09", "F10", "F13", "F14", "F15", "F16", "F20", "F27" ] }, { "type": "lighthouse", "path": "evidence/lighthouse-privacy.json", "caption": "lighthouse privacy", "findingIds": [ "F11" ] }, { "type": "other", "path": "evidence/login-invalid-probe.json", "caption": "login invalid probe", "findingIds": [ "F07", "F28" ] }, { "type": "screenshot", "path": "evidence/login-invalid.png", "caption": "login invalid", "findingIds": [ "F07", "F28" ] }, { "type": "other", "path": "evidence/memory-metrics.json", "caption": "memory metrics", "findingIds": [] }, { "type": "screenshot", "path": "evidence/open-now-after-click.png", "caption": "open now after click", "findingIds": [] }, { "type": "other", "path": "evidence/open-now-probe.json", "caption": "open now probe", "findingIds": [ "F02", "F06", "F26" ] }, { "type": "other", "path": "evidence/preferences-probe.json", "caption": "preferences probe", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/privacy-desktop.png", "caption": "privacy desktop", "findingIds": [] }, { "type": "layout", "path": "evidence/privacy-mobile-layout.json", "caption": "privacy mobile layout", "findingIds": [ "F03", "F12" ] }, { "type": "screenshot", "path": "evidence/privacy-mobile.png", "caption": "privacy mobile", "findingIds": [ "F03", "F12" ] }, { "type": "other", "path": "evidence/privacy-probe.json", "caption": "privacy probe", "findingIds": [ "F03", "F11", "F15", "F19", "F24" ] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots", "findingIds": [ "F16" ] }, { "type": "other", "path": "evidence/sitemap.xml", "caption": "sitemap", "findingIds": [ "F17" ] }, { "type": "screenshot", "path": "evidence/terms-desktop.png", "caption": "terms desktop", "findingIds": [ "F23" ] }, { "type": "other", "path": "evidence/terms-headers.txt", "caption": "terms headers", "findingIds": [ "F23" ] }, { "type": "layout", "path": "evidence/terms-mobile-layout.json", "caption": "terms mobile layout", "findingIds": [] }, { "type": "screenshot", "path": "evidence/terms-mobile.png", "caption": "terms mobile", "findingIds": [] }, { "type": "other", "path": "evidence/terms-probe.json", "caption": "terms probe", "findingIds": [ "F23" ] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The dark-mode screenshot is pixel-identical to the light screenshot; the probe reports color-scheme \"normal\" and a white body background while prefers-color-scheme: dark matches.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-dark.png", "evidence/preferences-probe.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "evaluate under prefers-reduced-motion: reduce found zero active animations on the public entry state.", "artifacts": [ "evidence/preferences-probe.json" ], "pathIds": [ "home-login" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "forced-colors/high-contrast screenshot retained visible text, borders, input outlines and focus affordances.", "artifacts": [ "evidence/home-high-contrast.png" ], "pathIds": [ "home-login" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The rendered DOM and CSS probe found no authored view-transition rules or calls; attempted Open Now navigation remained on the welcome state without a visual continuity cue.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-deep-probe.json", "evidence/open-now-probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon and DOM inspection.", "evidence": "No scroll-linked animation was present on the representative pages, so there is no implementation to classify.", "reason": "No scroll-linked animation was present on the representative pages, so there is no implementation to classify.", "pathIds": [ "home-login" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon and DOM inspection.", "evidence": "No gesture-driven carousel, swipe, pull, or drag interaction was present in the public representative paths.", "reason": "No gesture-driven carousel, swipe, pull, or drag interaction was present in the public representative paths.", "pathIds": [ "home-login" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The privacy page is 9,307 CSS pixels tall at 360px, while its screenshot and DOM show only a static logo header and no progress, section navigation, or scroll-state response.", "pathIds": [ "privacy-policy" ], "artifacts": [ "evidence/privacy-mobile.png", "evidence/privacy-mobile-layout.json", "evidence/privacy-probe.json" ], "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon and DOM inspection.", "evidence": "No tooltip or viewport-edge transient overlay was exposed in the tested public states, so anchor behavior was not applicable.", "reason": "No tooltip or viewport-edge transient overlay was exposed in the tested public states, so anchor behavior was not applicable.", "pathIds": [ "home-login" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "The page provides a skip-to-main-content link, visible keyboard outline, descriptive recovery links and clear visual hierarchy.", "artifacts": [ "evidence/home-recon.json", "evidence/home-deep-probe.json", "evidence/home-desktop.png" ], "pathIds": [ "home-login" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "Desktop and mobile load screenshots show core content immediately with no interstitial or obscuring consent wall.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ], "pathIds": [ "home-login" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "DOM inspection found native dialog elements for modal states and no load-time custom full-screen overlay.", "artifacts": [ "evidence/home-deep-probe.json", "evidence/home-dom.json" ], "pathIds": [ "home-login" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "First-viewport screenshots prioritize login/account actions and content, with a compact header and no ad chrome.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ], "pathIds": [ "home-login" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "All 360px layout captures reported scrollWidth=clientWidth=360 and zero horizontal overflow.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/privacy-mobile-layout.json", "evidence/home-mobile.png" ], "pathIds": [ "home-login", "privacy-policy" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The CSSOM probe found zero @container rules across the loaded application despite the login and content-card components being reused in materially different widths.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-deep-probe.json", "evidence/home-mobile.png", "evidence/home-desktop.png" ], "findingIds": [ "F04" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The rendered target probe measured Get Help and WhatsApp at 14px high, footer and recovery links at 16–21px high, and A-/A/A+ controls only 9–17px wide.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-deep-probe.json", "evidence/home-mobile.png" ], "findingIds": [ "F05" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "The first viewport clearly identifies YONO SBI, existing-user login, registration, activation and account-opening actions.", "artifacts": [ "evidence/home-desktop.png", "evidence/home-mobile.png" ], "pathIds": [ "home-login" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Direct navigation to the linked savings-account landing URL returned to /registration/welcome, and an attempted Open Now activation remained on the welcome URL and state.", "pathIds": [ "account-opening" ], "artifacts": [ "evidence/account-desktop.png", "evidence/account-probe.json", "evidence/open-now-probe.json" ], "findingIds": [ "F06" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "After activating Login with all fields empty, the page text was unchanged, :invalid returned no controls, and the four aria-live regions remained empty.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/login-invalid-probe.json", "evidence/login-invalid.png" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Lighthouse measured LCP 12.3s, FCP 6.3s, TBT 670ms and a performance score of 0.38; the independent trace measured FCP/LCP 5.08s and TBT 182.68ms.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-trace.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "Measured CLS was 0.066 on the entry page and 0.043 on privacy, both below the 0.1 good threshold.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/privacy-mobile-layout.json", "evidence/lighthouse-home.json" ], "pathIds": [ "home-login", "privacy-policy" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Lighthouse found 575KiB of unused JavaScript, 2.1s JavaScript execution, a 650ms maximum potential FID, and 670ms TBT; the trace recorded a 232.68ms long task.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-summary.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "HAR recorded 131 requests and 1.91MB transferred, including 37 scripts/1.31MB and 216KB fonts; Lighthouse estimated 1.27s redirect savings and found a font-display delay.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F10" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Lighthouse found 575KiB of unused JavaScript, 2.1s JavaScript execution, a 650ms maximum potential FID, and 670ms TBT; the trace recorded a 232.68ms long task.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-summary.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "Lighthouse scored entry accessibility 1.00; form probes found labels/ARIA names for primary username, password and captcha controls.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-deep-probe.json" ], "pathIds": [ "home-login" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "Lighthouse reported no contrast failures and forced-colors retained essential UI visibility.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-high-contrast.png" ], "pathIds": [ "home-login" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The privacy page jumps from one H1 to eleven H6 headings and Lighthouse failed heading-order; the welcome page uses three H1 elements plus empty H2/H5/H6 elements.", "pathIds": [ "privacy-policy" ], "artifacts": [ "evidence/privacy-probe.json", "evidence/home-deep-probe.json", "evidence/lighthouse-privacy.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "At 360px the text is confined to an approximately 209px-wide inset card, causing the page to extend to 9,307px and forcing excessive wrapping.", "pathIds": [ "privacy-policy" ], "artifacts": [ "evidence/privacy-mobile.png", "evidence/privacy-mobile-layout.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Mobile layouts had zero horizontal overflow, but the target-size probe found many visible actions only 14–21px high and text-size controls as narrow as 9px.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-mobile-layout.json", "evidence/home-deep-probe.json", "evidence/home-mobile.png" ], "findingIds": [ "F29" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "Lighthouse errors-in-console and inspector-issues audits both passed.", "artifacts": [ "evidence/lighthouse-home.json" ], "pathIds": [ "home-login" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Lighthouse identified three carousel images rendered around 0.67 aspect ratio although their natural ratios are 1.01–1.14.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F13" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Lighthouse found a deprecated unload listener in polyfills, an IndexedDB event preventing BFCache restoration, and missing source maps for three large first-party bundles.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/lighthouse-home.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Both welcome and privacy routes use the same title “YONO SBI”; DOM and Lighthouse found no meta description.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-deep-probe.json", "evidence/privacy-probe.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Discoverability measured 1% raw/rendered content coverage and isJsShell=true; crawler screenshot is blank. Lighthouse found 20 anchors without valid destinations and robots.txt returned application HTML with 17 parse errors.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-crawler.png", "evidence/home-discoverability-rendered.png", "evidence/lighthouse-home.json", "evidence/robots.txt" ], "findingIds": [ "F16" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "DOM probes found no canonical, Open Graph, or structured metadata; sitemap.xml returned the same 89KB Angular shell rather than a sitemap, and the entry performs a 307 cross-host redirect.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-deep-probe.json", "evidence/sitemap.xml", "evidence/curl-headers.txt" ], "findingIds": [ "F17" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "DOM probes found no canonical, Open Graph, or structured metadata; sitemap.xml returned the same 89KB Angular shell rather than a sitemap, and the entry performs a 307 cross-host redirect.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-deep-probe.json", "evidence/sitemap.xml", "evidence/curl-headers.txt" ], "findingIds": [ "F17" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The cookies audit found TLTSID without Secure or HttpOnly and with SameSite=None; CSP allows unsafe-inline for script and style. HTTPS, HSTS, nosniff and X-Frame-Options are present.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-cookies.json", "evidence/home-headers.json", "evidence/curl-headers.txt" ], "findingIds": [ "F18" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Trackers found Google Tag Manager plus Firebase services; HAR recorded 130 cross-origin requests relative to the requested host and gtag requests with id=undefined. The privacy page states “We do not use cookies” although TLTSID is set.", "pathIds": [ "privacy-policy" ], "artifacts": [ "evidence/home-trackers.json", "evidence/home.har", "evidence/home-summary.json", "evidence/home-cookies.json", "evidence/privacy-probe.json" ], "findingIds": [ "F19" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Lighthouse failed geolocation-on-start at polyfills code; the sign-in DOM exposes username/password with no WebAuthn/passkey affordance and the password field lacks current-password autocomplete.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-deep-probe.json" ], "findingIds": [ "F20" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The cookies audit found TLTSID without Secure or HttpOnly and with SameSite=None; CSP allows unsafe-inline for script and style. HTTPS, HSTS, nosniff and X-Frame-Options are present.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-cookies.json", "evidence/home-headers.json", "evidence/curl-headers.txt" ], "findingIds": [ "F18" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Raw HTML contains only one content token while the rendered page contains 139; discoverability reports 1% coverage and the no-JS crawler screenshot is blank.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-crawler.png", "evidence/home-discoverability-rendered.png", "evidence/home-dom.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "During the representative direct-route capture, Terms of Service displayed only “403 ERROR – The request could not be satisfied,” without SBI navigation, retry, contact, or return actions; later HEAD requests were intermittent, reinforcing the need for robust handling.", "pathIds": [ "terms-direct" ], "artifacts": [ "evidence/terms-desktop.png", "evidence/terms-probe.json", "evidence/terms-headers.txt" ], "findingIds": [ "F23" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "DOM probes found no web app manifest. The browser supports service workers, but no install surface or captured offline fallback was exposed.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-deep-probe.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "During the representative direct-route capture, Terms of Service displayed only “403 ERROR – The request could not be satisfied,” without SBI navigation, retry, contact, or return actions; later HEAD requests were intermittent, reinforcing the need for robust handling.", "pathIds": [ "terms-direct" ], "artifacts": [ "evidence/terms-desktop.png", "evidence/terms-probe.json", "evidence/terms-headers.txt" ], "findingIds": [ "F23" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "The document declares lang=en, loads en_US locale resources, and its mobile layouts preserve reading order without overflow; no bidi content was present to require an explicit dir override.", "artifacts": [ "evidence/home-deep-probe.json", "evidence/home-summary.json", "evidence/home-mobile-layout.json" ], "pathIds": [ "home-login" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon and DOM inspection.", "evidence": "The audited public pages displayed no dates, currencies, durations, or locale-sensitive numbers to format.", "reason": "The audited public pages displayed no dates, currencies, durations, or locale-sensitive numbers to format.", "pathIds": [ "home-login" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon and DOM inspection.", "evidence": "The audited public pages contained no event scheduling or time-zone-sensitive data.", "reason": "The audited public pages contained no event scheduling or time-zone-sensitive data.", "pathIds": [ "home-login" ] }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "The visible policy says “We do not use cookies on our web site,” while CDP observed TLTSID and the page loads GTM and Firebase services.", "pathIds": [ "privacy-policy" ], "artifacts": [ "evidence/privacy-probe.json", "evidence/home-cookies.json", "evidence/home-trackers.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Activating Login on empty fields produced no visible message, no native invalid controls and no populated alert/live region.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/login-invalid-probe.json", "evidence/login-invalid.png" ], "findingIds": [ "F28" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Username uses autocomplete=off and the password field has no autocomplete token; fields have no stable names in the rendered form probe.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home-deep-probe.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Open Now advertises account creation, but both activation evidence and direct routing failed to leave the welcome page, with no explanation or alternative.", "pathIds": [ "account-opening" ], "artifacts": [ "evidence/open-now-probe.json", "evidence/account-probe.json", "evidence/account-desktop.png" ], "findingIds": [ "F26" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Lighthouse identified three carousel images rendered around 0.67 aspect ratio although their natural ratios are 1.01–1.14. HAR measured 1.91MB/131 requests; Lighthouse estimated 575KiB unused JavaScript and 40KiB unused CSS, while malformed GTM id=undefined requests and multiple Firebase calls occur before interaction.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/lighthouse-home.json", "evidence/home.har", "evidence/home-summary.json", "evidence/home-trackers.json" ], "findingIds": [ "F13", "F27" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "HAR measured 1.91MB/131 requests; Lighthouse estimated 575KiB unused JavaScript and 40KiB unused CSS, while malformed GTM id=undefined requests and multiple Firebase calls occur before interaction.", "pathIds": [ "home-login" ], "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/lighthouse-home.json", "evidence/home-trackers.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Direct visual, DOM, CDP, HAR/trace, Lighthouse, or interaction evidence as named.", "evidence": "Trackers found Google Tag Manager plus Firebase services; HAR recorded 130 cross-origin requests relative to the requested host and gtag requests with id=undefined. The privacy page states “We do not use cookies” although TLTSID is set. HAR measured 1.91MB/131 requests; Lighthouse estimated 575KiB unused JavaScript and 40KiB unused CSS, while malformed GTM id=undefined requests and multiple Firebase calls occur before interaction.", "pathIds": [ "privacy-policy", "home-login" ], "artifacts": [ "evidence/home-trackers.json", "evidence/home.har", "evidence/home-summary.json", "evidence/home-cookies.json", "evidence/privacy-probe.json", "evidence/lighthouse-home.json" ], "findingIds": [ "F19", "F27" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon and DOM inspection.", "evidence": "This sensitive banking entry point exposes no declared agent-facing surface; emerging WebMCP capability is not assumed appropriate without an explicit safety model.", "reason": "This sensitive banking entry point exposes no declared agent-facing surface; emerging WebMCP capability is not assumed appropriate without an explicit safety model.", "pathIds": [ "home-login" ] }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-path recon and DOM inspection.", "evidence": "No summarisation or language-model task is part of the tested login, legal-content, or account-opening paths.", "reason": "No summarisation or language-model task is part of the tested login, legal-content, or account-opening paths.", "pathIds": [ "home-login" ] }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "After 20 password-visibility toggles, heap self-size fell from 767,808 to 764,300 bytes; closures stayed at 1,803 and node count changed only +12.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post-toggle.heapsnapshot" ], "pathIds": [ "home-login" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "Heap summary reported 26,499 nodes and 767,808 bytes of self size, proportionate for the tested entry state.", "artifacts": [ "evidence/heap-baseline.heapsnapshot" ], "pathIds": [ "home-login" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Direct evidence review under the stated path and condition.", "evidence": "Before/after summaries showed stable closure count and no Detached* constructor in top populations; total self-size did not grow after repetition.", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post-toggle.heapsnapshot" ], "pathIds": [ "home-login" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F02" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "pass", "findingIds": [] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "issues", "findingIds": [ "F06", "F07" ] }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F09", "F10" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F11", "F12", "F29" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F13", "F14" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F15", "F16", "F17" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F18", "F19", "F20" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F21", "F23", "F22" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass", "findingIds": [] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F24", "F28", "F25", "F26" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F13", "F27", "F19" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "This sensitive banking entry point exposes no declared agent-facing surface; emerging WebMCP capability is not assumed appropriate without an explicit safety model. No summarisation or language-model task is part of the tested login, legal-content, or account-opening paths.", "findingIds": [] }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass", "findingIds": [] } ], "paths": [ { "id": "home-login", "description": "Canonical public entry and existing-user login. Represents global shell, navigation, preferences, security, performance, accessibility and the primary authentication form.", "url": "https://retail.sbi.bank.in", "conditions": [ "desktop 780px", "mobile 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "forced-colors/high contrast", "empty login submit", "no JavaScript crawler" ], "result": "issues" }, { "id": "account-opening", "description": "Prominent “Open Now” journey and its direct savings-account route. Represents the primary new-customer conversion flow.", "url": "https://yonoretail.sbi.bank.in/registration/accounts/savingAccount/landing", "conditions": [ "direct navigation", "activation from welcome" ], "result": "failed" }, { "id": "privacy-policy", "description": "Long-form public legal/content archetype; used to assess reading layout, heading structure, disclosure and mobile reflow.", "url": "https://yonoretail.sbi.bank.in/information-pages/privacy-policy", "conditions": [ "desktop", "mobile 360x800" ], "result": "issues" }, { "id": "terms-direct", "description": "Public Terms of Service deep link and failure-state archetype.", "url": "https://yonoretail.sbi.bank.in/information-pages/terms-of-service", "conditions": [ "direct navigation", "desktop", "mobile 360x800" ], "result": "failed" } ], "findings": [ { "id": "F01", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "summary": "The login experience ignores the user’s dark-color preference.", "evidence": "The dark-mode screenshot is pixel-identical to the light screenshot; the probe reports color-scheme \"normal\" and a white body background while prefers-color-scheme: dark matches.", "artifacts": [ "evidence/home-dark.png", "evidence/preferences-probe.json" ], "suggestedFix": "Declare color-scheme: light dark and define semantic surface/text tokens with prefers-color-scheme or light-dark(), preserving SBI brand contrast.", "effort": "medium" }, { "id": "F02", "severity": "low", "confidence": "medium", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "summary": "State and route changes do not use View Transitions.", "evidence": "The rendered DOM and CSS probe found no authored view-transition rules or calls; attempted Open Now navigation remained on the welcome state without a visual continuity cue.", "artifacts": [ "evidence/home-deep-probe.json", "evidence/open-now-probe.json" ], "suggestedFix": "Use document.startViewTransition for same-document state changes and @view-transition for eligible cross-document routes, with reduced-motion fallbacks.", "effort": "medium" }, { "id": "F03", "severity": "low", "confidence": "high", "pathId": "privacy-policy", "url": "https://yonoretail.sbi.bank.in/information-pages/privacy-policy", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "scroll-progress-indicator", "guidanceCategory": "user-experience", "summary": "Long content has no position-aware navigation or progress affordance.", "evidence": "The privacy page is 9,307 CSS pixels tall at 360px, while its screenshot and DOM show only a static logo header and no progress, section navigation, or scroll-state response.", "artifacts": [ "evidence/privacy-mobile.png", "evidence/privacy-mobile-layout.json", "evidence/privacy-probe.json" ], "suggestedFix": "Add a lightweight reading-progress or section affordance using scroll-state/container queries, and keep it non-obstructive.", "effort": "small" }, { "id": "F04", "severity": "low", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "css", "summary": "Components adapt only at page/viewport level, not at their container boundary.", "evidence": "The CSSOM probe found zero @container rules across the loaded application despite the login and content-card components being reused in materially different widths.", "artifacts": [ "evidence/home-deep-probe.json", "evidence/home-mobile.png", "evidence/home-desktop.png" ], "suggestedFix": "Give reusable shells an inline-size container and move component-specific breakpoints to @container queries with a viewport-query fallback.", "effort": "medium" }, { "id": "F05", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Several primary links and text-size controls have undersized hit areas.", "evidence": "The rendered target probe measured Get Help and WhatsApp at 14px high, footer and recovery links at 16–21px high, and A-/A/A+ controls only 9–17px wide.", "artifacts": [ "evidence/home-deep-probe.json", "evidence/home-mobile.png" ], "suggestedFix": "Expand interactive hit areas to at least 24×24 CSS pixels, preferably 44×44 on touch layouts, without reducing visible spacing.", "effort": "small" }, { "id": "F06", "severity": "high", "confidence": "high", "pathId": "account-opening", "url": "https://yonoretail.sbi.bank.in/registration/accounts/savingAccount/landing", "principleId": "support-core-task-success", "principleCheckId": "primary-flow-completion", "guidanceId": "forms", "guidanceCategory": "forms", "summary": "The prominent Open Now account-opening path does not reach its advertised journey.", "evidence": "Direct navigation to the linked savings-account landing URL returned to /registration/welcome, and an attempted Open Now activation remained on the welcome URL and state.", "artifacts": [ "evidence/account-desktop.png", "evidence/account-probe.json", "evidence/open-now-probe.json" ], "suggestedFix": "Restore the public account-opening route, use a real navigable href, preserve deep-link routing, and show an actionable error if onboarding is unavailable.", "effort": "large" }, { "id": "F07", "severity": "high", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "support-core-task-success", "principleCheckId": "clear-system-state-and-recovery", "guidanceId": "accessible-error-announcement", "guidanceCategory": "forms", "summary": "Submitting the empty login state provides no visible or programmatic recovery feedback.", "evidence": "After activating Login with all fields empty, the page text was unchanged, :invalid returned no controls, and the four aria-live regions remained empty.", "artifacts": [ "evidence/login-invalid-probe.json", "evidence/login-invalid.png" ], "suggestedFix": "Apply native constraints, validate after interaction, place specific messages beside each field, set aria-invalid, and announce an error summary through a populated live region.", "effort": "medium" }, { "id": "F08", "severity": "high", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "The primary banking entry page is slow to become useful.", "evidence": "Lighthouse measured LCP 12.3s, FCP 6.3s, TBT 670ms and a performance score of 0.38; the independent trace measured FCP/LCP 5.08s and TBT 182.68ms.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-trace.json" ], "suggestedFix": "Prioritize the LCP content, eliminate the redirect where possible, reduce boot-time JavaScript, and defer non-critical analytics and application features.", "effort": "large" }, { "id": "F09", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-main-thread", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "summary": "Large, mostly unused JavaScript blocks the main thread.", "evidence": "Lighthouse found 575KiB of unused JavaScript, 2.1s JavaScript execution, a 650ms maximum potential FID, and 670ms TBT; the trace recorded a 232.68ms long task.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-trace-summary.json", "evidence/home-summary.json" ], "suggestedFix": "Profile the long task, split route code, tree-shake unused dependencies, and schedule non-critical work after the core login UI is interactive.", "effort": "large" }, { "id": "F10", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-script-priority", "guidanceCategory": "performance", "summary": "The load has an expensive redirect and an oversized dependency chain.", "evidence": "HAR recorded 131 requests and 1.91MB transferred, including 37 scripts/1.31MB and 216KB fonts; Lighthouse estimated 1.27s redirect savings and found a font-display delay.", "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Serve the canonical entry directly, preload only true critical dependencies, subset/swap fonts, and defer non-essential chunks and third parties.", "effort": "large" }, { "id": "F11", "severity": "medium", "confidence": "high", "pathId": "privacy-policy", "url": "https://yonoretail.sbi.bank.in/information-pages/privacy-policy", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Heading hierarchy is not logical on key pages.", "evidence": "The privacy page jumps from one H1 to eleven H6 headings and Lighthouse failed heading-order; the welcome page uses three H1 elements plus empty H2/H5/H6 elements.", "artifacts": [ "evidence/privacy-probe.json", "evidence/home-deep-probe.json", "evidence/lighthouse-privacy.json" ], "suggestedFix": "Use one page H1 and sequential H2/H3 section headings; remove empty headings and use CSS, not heading rank, for visual sizing.", "effort": "small" }, { "id": "F12", "severity": "low", "confidence": "high", "pathId": "privacy-policy", "url": "https://yonoretail.sbi.bank.in/information-pages/privacy-policy", "principleId": "be-inclusive", "principleCheckId": "legible-text", "guidanceId": "improve-text-layout-and-legibility", "guidanceCategory": "css", "summary": "The mobile privacy policy is needlessly narrow and laborious to read.", "evidence": "At 360px the text is confined to an approximately 209px-wide inset card, causing the page to extend to 9,307px and forcing excessive wrapping.", "artifacts": [ "evidence/privacy-mobile.png", "evidence/privacy-mobile-layout.json" ], "suggestedFix": "Reduce mobile card insets, set a comfortable measure using ch units at larger sizes, and let the content use most of the small viewport.", "effort": "small" }, { "id": "F13", "severity": "low", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "Three security-practice images are distorted.", "evidence": "Lighthouse identified three carousel images rendered around 0.67 aspect ratio although their natural ratios are 1.01–1.14.", "artifacts": [ "evidence/lighthouse-home.json" ], "suggestedFix": "Preserve intrinsic aspect ratio with width/height or aspect-ratio and object-fit, and avoid forcing all editorial images into one distorted box.", "effort": "small" }, { "id": "F14", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "html", "summary": "The app carries deprecated and navigation-hostile platform behavior.", "evidence": "Lighthouse found a deprecated unload listener in polyfills, an IndexedDB event preventing BFCache restoration, and missing source maps for three large first-party bundles.", "artifacts": [ "evidence/lighthouse-home.json" ], "suggestedFix": "Remove unload handlers, close or avoid IndexedDB work around pagehide/freeze, verify BFCache restoration, and publish protected production source maps.", "effort": "medium" }, { "id": "F15", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-discoverable", "principleCheckId": "title-and-description", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Public pages have generic titles and no meta descriptions.", "evidence": "Both welcome and privacy routes use the same title “YONO SBI”; DOM and Lighthouse found no meta description.", "artifacts": [ "evidence/home-deep-probe.json", "evidence/privacy-probe.json", "evidence/lighthouse-home.json" ], "suggestedFix": "Give every public route a unique descriptive title and concise description, for example “YONO SBI Net Banking Login | State Bank of India”.", "effort": "small" }, { "id": "F16", "severity": "high", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "search-hidden-content", "guidanceCategory": "user-experience", "summary": "The public entry page is effectively empty to non-JavaScript crawlers and many links are not crawlable.", "evidence": "Discoverability measured 1% raw/rendered content coverage and isJsShell=true; crawler screenshot is blank. Lighthouse found 20 anchors without valid destinations and robots.txt returned application HTML with 17 parse errors.", "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-crawler.png", "evidence/home-discoverability-rendered.png", "evidence/lighthouse-home.json", "evidence/robots.txt" ], "suggestedFix": "Server-render public content and navigation, emit real href destinations, and serve a valid text/plain robots.txt and sitemap instead of the SPA shell.", "effort": "large" }, { "id": "F17", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "guidanceCategory": "html", "summary": "Canonical, sitemap, and share/entity metadata are absent or invalid.", "evidence": "DOM probes found no canonical, Open Graph, or structured metadata; sitemap.xml returned the same 89KB Angular shell rather than a sitemap, and the entry performs a 307 cross-host redirect.", "artifacts": [ "evidence/home-deep-probe.json", "evidence/sitemap.xml", "evidence/curl-headers.txt" ], "suggestedFix": "Choose one canonical public host, emit per-route canonical and social metadata plus Organization/WebSite JSON-LD, and publish a valid XML sitemap consistent with robots policy.", "effort": "medium" }, { "id": "F18", "severity": "high", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "summary": "A banking entry page sets an insecure cookie and weakens its CSP.", "evidence": "The cookies audit found TLTSID without Secure or HttpOnly and with SameSite=None; CSP allows unsafe-inline for script and style. HTTPS, HSTS, nosniff and X-Frame-Options are present.", "artifacts": [ "evidence/home-cookies.json", "evidence/home-headers.json", "evidence/curl-headers.txt" ], "suggestedFix": "Set Secure, HttpOnly and an appropriate Lax/Strict SameSite value; migrate inline scripts/styles to nonces or hashes and tighten CSP after report-only validation.", "effort": "medium" }, { "id": "F19", "severity": "high", "confidence": "high", "pathId": "privacy-policy", "url": "https://yonoretail.sbi.bank.in/information-pages/privacy-policy", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "summary": "Tracking and background calls are neither minimal nor accurately disclosed.", "evidence": "Trackers found Google Tag Manager plus Firebase services; HAR recorded 130 cross-origin requests relative to the requested host and gtag requests with id=undefined. The privacy page states “We do not use cookies” although TLTSID is set.", "artifacts": [ "evidence/home-trackers.json", "evidence/home.har", "evidence/home-summary.json", "evidence/home-cookies.json", "evidence/privacy-probe.json" ], "suggestedFix": "Inventory and purpose-limit telemetry, remove malformed/unused GTM, gate non-essential analytics on informed choice, and update the privacy statement to match actual cookies and processors.", "effort": "large" }, { "id": "F20", "severity": "high", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "guidanceCategory": "security", "summary": "The page requests location on load and exposes only password authentication.", "evidence": "Lighthouse failed geolocation-on-start at polyfills code; the sign-in DOM exposes username/password with no WebAuthn/passkey affordance and the password field lacks current-password autocomplete.", "artifacts": [ "evidence/lighthouse-home.json", "evidence/home-deep-probe.json" ], "suggestedFix": "Request location only after a clear user gesture and purpose explanation; add passkey sign-in/registration while retaining a secure recovery path and correct autocomplete tokens.", "effort": "large" }, { "id": "F21", "severity": "high", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-resilient", "principleCheckId": "progressive-enhancement", "guidanceId": "html", "guidanceCategory": "html", "summary": "The public content and navigation disappear without JavaScript.", "evidence": "Raw HTML contains only one content token while the rendered page contains 139; discoverability reports 1% coverage and the no-JS crawler screenshot is blank.", "artifacts": [ "evidence/home-discoverability.json", "evidence/home-discoverability-crawler.png", "evidence/home-discoverability-rendered.png", "evidence/home-dom.json" ], "suggestedFix": "Server-render the login guidance, notices, help links and public information; layer client behavior on semantic forms and links rather than an empty Angular root.", "effort": "large" }, { "id": "F22", "severity": "low", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "guidanceId": "performance", "guidanceCategory": "performance", "summary": "The app-like banking experience has no installability or explicit offline fallback metadata.", "evidence": "DOM probes found no web app manifest. The browser supports service workers, but no install surface or captured offline fallback was exposed.", "artifacts": [ "evidence/home-deep-probe.json" ], "suggestedFix": "Provide a minimal manifest and service-worker-controlled offline shell that clearly explains unavailable online banking actions and offers safe retry/help paths.", "effort": "medium" }, { "id": "F23", "severity": "high", "confidence": "high", "pathId": "terms-direct", "url": "https://yonoretail.sbi.bank.in/information-pages/terms-of-service", "principleId": "be-resilient", "principleCheckId": "network-and-http-failure-states", "guidanceId": "persistent-toast-notifications", "guidanceCategory": "user-experience", "summary": "A linked legal route can fail as a generic 403 with no recovery.", "evidence": "During the representative direct-route capture, Terms of Service displayed only “403 ERROR – The request could not be satisfied,” without SBI navigation, retry, contact, or return actions; later HEAD requests were intermittent, reinforcing the need for robust handling.", "artifacts": [ "evidence/terms-desktop.png", "evidence/terms-probe.json", "evidence/terms-headers.txt" ], "suggestedFix": "Fix edge routing/cache consistency and replace generic edge failures with a branded, accessible recovery response containing retry, home, and support actions.", "effort": "medium" }, { "id": "F24", "severity": "high", "confidence": "high", "pathId": "privacy-policy", "url": "https://yonoretail.sbi.bank.in/information-pages/privacy-policy", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "privacy", "guidanceCategory": "privacy", "summary": "The privacy statement contradicts observed site behavior.", "evidence": "The visible policy says “We do not use cookies on our web site,” while CDP observed TLTSID and the page loads GTM and Firebase services.", "artifacts": [ "evidence/privacy-probe.json", "evidence/home-cookies.json", "evidence/home-trackers.json" ], "suggestedFix": "Publish an accurate, plain-language inventory of essential and non-essential cookies and processors, including purpose, retention, choice, and deletion controls.", "effort": "medium" }, { "id": "F25", "severity": "high", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-trustworthy", "principleCheckId": "trustworthy-input-assistance", "guidanceId": "autofill-sign-in-form", "guidanceCategory": "forms", "summary": "The sign-in form disables or omits standard password-manager assistance.", "evidence": "Username uses autocomplete=off and the password field has no autocomplete token; fields have no stable names in the rendered form probe.", "artifacts": [ "evidence/home-deep-probe.json" ], "suggestedFix": "Use stable name/id values with autocomplete=username and autocomplete=current-password; retain paste support and let password managers fill the form.", "effort": "small" }, { "id": "F26", "severity": "high", "confidence": "high", "pathId": "account-opening", "url": "https://yonoretail.sbi.bank.in/registration/accounts/savingAccount/landing", "principleId": "be-trustworthy", "principleCheckId": "safe-commercial-and-account-flows", "guidanceId": "forms", "guidanceCategory": "forms", "summary": "The advertised new-account action is not a dependable, transparent account flow.", "evidence": "Open Now advertises account creation, but both activation evidence and direct routing failed to leave the welcome page, with no explanation or alternative.", "artifacts": [ "evidence/open-now-probe.json", "evidence/account-probe.json", "evidence/account-desktop.png" ], "suggestedFix": "Make the route dependable, explain eligibility and required steps before collecting data, and preserve a clear cancel/back/support path throughout onboarding.", "effort": "large" }, { "id": "F27", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "performance", "summary": "The entry route transfers and executes substantial work with little immediate value.", "evidence": "HAR measured 1.91MB/131 requests; Lighthouse estimated 575KiB unused JavaScript and 40KiB unused CSS, while malformed GTM id=undefined requests and multiple Firebase calls occur before interaction.", "artifacts": [ "evidence/home.har", "evidence/home-summary.json", "evidence/lighthouse-home.json", "evidence/home-trackers.json" ], "suggestedFix": "Set a route-level byte/request budget, remove malformed analytics, lazy-load non-login modules and below-fold media, and eliminate unused CSS/JavaScript.", "effort": "large" }, { "id": "F28", "severity": "high", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-trustworthy", "principleCheckId": "humane-error-handling", "guidanceId": "accessible-error-announcement", "guidanceCategory": "forms", "summary": "Login validation does not help the user understand or correct omissions.", "evidence": "Activating Login on empty fields produced no visible message, no native invalid controls and no populated alert/live region.", "artifacts": [ "evidence/login-invalid-probe.json", "evidence/login-invalid.png" ], "suggestedFix": "Validate on submit/blur after interaction, identify each missing field in plain language, focus an error summary, and preserve entered values.", "effort": "medium" }, { "id": "F29", "severity": "medium", "confidence": "high", "pathId": "home-login", "url": "https://yonoretail.sbi.bank.in/registration/welcome", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "summary": "Reflow works, but touch target sizing does not meet an inclusive baseline.", "evidence": "Mobile layouts had zero horizontal overflow, but the target-size probe found many visible actions only 14–21px high and text-size controls as narrow as 9px.", "artifacts": [ "evidence/home-mobile-layout.json", "evidence/home-deep-probe.json", "evidence/home-mobile.png" ], "suggestedFix": "Retain the successful reflow while expanding all interactive target boxes and spacing adjacent controls to prevent accidental activation.", "effort": "small" } ], "taskList": [ { "id": "T01", "title": "Restore dependable account-opening and legal deep links", "priority": 1, "findingIds": [ "F06", "F23", "F26" ], "guidanceId": "forms", "status": "open" }, { "id": "T02", "title": "Make the public shell server-rendered and crawlable", "priority": 2, "findingIds": [ "F16", "F17", "F21" ], "guidanceId": "html", "status": "open" }, { "id": "T03", "title": "Cut login LCP and JavaScript/network cost", "priority": 3, "findingIds": [ "F08", "F09", "F10", "F27" ], "guidanceId": "performance", "status": "open" }, { "id": "T04", "title": "Correct privacy disclosure and minimize telemetry", "priority": 4, "findingIds": [ "F19", "F24" ], "guidanceId": "privacy", "status": "open" }, { "id": "T05", "title": "Harden cookies, CSP, and browser policies", "priority": 5, "findingIds": [ "F18" ], "guidanceId": "security", "status": "open" }, { "id": "T06", "title": "Repair login validation, autofill, and modern authentication", "priority": 6, "findingIds": [ "F07", "F20", "F25", "F28" ], "guidanceId": "autofill-sign-in-form", "status": "open" }, { "id": "T07", "title": "Fix headings, touch targets, and mobile legal-page measure", "priority": 7, "findingIds": [ "F05", "F11", "F12", "F29" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T08", "title": "Add unique metadata, canonical and social/entity signals", "priority": 8, "findingIds": [ "F15", "F17" ], "guidanceId": "html", "status": "open" }, { "id": "T09", "title": "Respect dark-mode preferences", "priority": 9, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T10", "title": "Modernize responsive and navigation behavior", "priority": 10, "findingIds": [ "F02", "F03", "F04" ], "guidanceId": "size-aware-styling", "status": "open" }, { "id": "T11", "title": "Remove deprecated/BFCache blockers and distorted imagery", "priority": 11, "findingIds": [ "F13", "F14" ], "guidanceId": "performance", "status": "open" }, { "id": "T12", "title": "Add an explicit safe offline fallback", "priority": 12, "findingIds": [ "F22" ], "guidanceId": "performance", "status": "open" } ], "budget": { "wallClockSeconds": 3600, "pathCount": 4, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-27T03-48-17-014Z" }