{ "url": "https://pimpbunny.com", "auditedAt": "2026-07-28T10:44:08.023Z", "mode": "report", "status": "completed", "statusDetail": "Coverage-complete multi-template audit. The required age-assurance UI obscured screenshots, but rendered DOM and objective probes remained available; no check was omitted.", "page": { "appType": "mpa", "framework": "Server-rendered multi-page site with legacy/custom JavaScript components", "notes": "Adult media/catalog site with listing, search, model, localized and video-detail templates. Initial visual state is a third-party age-assurance overlay." }, "evidenceUsed": [ "screenshot", "dom", "evaluate-probe", "layout-metrics", "har", "trace", "discoverability", "headers", "cookies", "trackers", "images", "secrets", "lighthouse", "axe-core", "heap-summary", "robots/sitemap/manifest" ], "guidanceConsulted": [ "dark-mode", "accessibility", "same-document-transitions", "navigation-drawer", "declarative-dialog-popover-control", "fluid-scaling", "forms", "performance", "break-up-long-tasks", "optimize-image-priority", "html", "security", "privacy", "passkeys", "flicker-free-client-side-ab-testing", "translator", "autofill-sign-in-form", "deliver-optimized-decorative-images", "webmcp", "manage-recurring-intervals" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Initial desktop view, age assurance overlay", "condition": "desktop", "findingIds": [ "F07", "F34" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Initial mobile view, age assurance overlay", "condition": "360x800" }, { "type": "screenshot", "path": "evidence/home-dark-reduced.png", "caption": "Dark + reduced-motion condition", "condition": "prefers-color-scheme: dark; prefers-reduced-motion: reduce", "findingIds": [ "F01" ] }, { "type": "dom", "path": "evidence/home-dom.json", "caption": "Rendered DOM and computed styles", "findingIds": [ "F04", "F05", "F08", "F09" ] }, { "type": "other", "path": "evidence/home-recon.json", "caption": "Metadata, routes, forms and feature recon", "findingIds": [ "F07", "F09", "F19", "F22", "F23", "F26", "F31", "F32" ] }, { "type": "other", "path": "evidence/overlay-probe.json", "caption": "Fixed overlay, iframe and visible-control inspection", "findingIds": [ "F08", "F28" ] }, { "type": "layout", "path": "evidence/home-layout-desktop.json", "caption": "Desktop layout/CLS/long tasks" }, { "type": "layout", "path": "evidence/home-layout-mobile.json", "caption": "Mobile layout/CLS/overflow", "condition": "360x800", "findingIds": [ "F13" ] }, { "type": "har", "path": "evidence/home.har", "caption": "Network capture", "findingIds": [ "F14" ] }, { "type": "har-summary", "path": "evidence/home-summary.json", "caption": "Compact network signals", "findingIds": [ "F14", "F15", "F25", "F34", "F35" ] }, { "type": "trace", "path": "evidence/home-trace.json", "caption": "DevTools performance trace" }, { "type": "trace-summary", "path": "evidence/home-trace-summary.json", "caption": "Compact trace timing and blocking data", "findingIds": [ "F12" ] }, { "type": "discoverability", "path": "evidence/discoverability.json", "caption": "Raw HTML vs rendered content comparison" }, { "type": "screenshot", "path": "evidence/discoverability-rendered.png", "caption": "Browser-rendered crawler comparison" }, { "type": "screenshot", "path": "evidence/discoverability-crawler.png", "caption": "JavaScript-disabled crawler comparison" }, { "type": "other", "path": "evidence/headers.json", "caption": "Security headers", "findingIds": [ "F24", "F27" ] }, { "type": "other", "path": "evidence/cookies.json", "caption": "Cookie security", "findingIds": [ "F24" ] }, { "type": "other", "path": "evidence/trackers.json", "caption": "Third-party/tracker origins", "findingIds": [ "F07", "F25", "F31" ] }, { "type": "other", "path": "evidence/images.json", "caption": "Image sizing, format and alternative-text audit", "findingIds": [ "F13", "F20", "F33" ] }, { "type": "other", "path": "evidence/secrets.json", "caption": "Client-side secret scan" }, { "type": "lighthouse", "path": "evidence/lighthouse.json", "caption": "Lighthouse report", "findingIds": [ "F12", "F15", "F21", "F22", "F26", "F28" ] }, { "type": "other", "path": "evidence/a11y-probe.json", "caption": "axe-core violations", "findingIds": [ "F02", "F11", "F16", "F17", "F18", "F19" ] }, { "type": "other", "path": "evidence/ui-probe.json", "caption": "CSS feature, focus and target-size probe", "findingIds": [ "F03", "F04", "F05", "F06", "F10", "F11", "F29", "F30" ] }, { "type": "other", "path": "evidence/preferences-probe.json", "caption": "Computed preferences probe", "condition": "dark, reduce, contrast more", "findingIds": [ "F01", "F02" ] }, { "type": "other", "path": "evidence/robots.json", "caption": "robots.txt and AI crawler policy" }, { "type": "other", "path": "evidence/sitemap.json", "caption": "Sitemap index" }, { "type": "other", "path": "evidence/manifest.json", "caption": "Web app manifest", "findingIds": [ "F29" ] }, { "type": "other", "path": "evidence/path-videos.json", "caption": "Listing route probe" }, { "type": "other", "path": "evidence/path-onlyfans-creators.json", "caption": "Model listing route probe" }, { "type": "other", "path": "evidence/path-search--q-test.json", "caption": "Search results route probe", "findingIds": [ "F06", "F10", "F32" ] }, { "type": "other", "path": "evidence/path-video-detail.json", "caption": "Video detail/player probe", "findingIds": [ "F18", "F23", "F35" ] }, { "type": "screenshot", "path": "evidence/video-detail-mobile.png", "caption": "Video detail initial mobile view", "condition": "360x800" }, { "type": "other", "path": "evidence/path-es.json", "caption": "Spanish localized route probe", "findingIds": [ "F30" ] }, { "type": "other", "path": "evidence/404.json", "caption": "404 recovery route probe" }, { "type": "screenshot", "path": "evidence/404-mobile.png", "caption": "404 initial mobile view", "condition": "360x800" }, { "type": "heap", "path": "evidence/heap-baseline.heapsnapshot", "caption": "Baseline heap summary", "findingIds": [ "F36" ] }, { "type": "heap", "path": "evidence/heap-post.heapsnapshot", "caption": "Heap summary after ten menu cycles", "findingIds": [ "F36" ] }, { "type": "other", "path": "evidence/runtime-probe.json", "caption": "Post-interaction runtime metrics", "findingIds": [ "F36" ] }, { "type": "other", "path": "evidence/coverage-manifest.json", "caption": "Atomic coverage and evidence plan" } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Emulated preference screenshots, computed styles, animation and CSS feature probes", "evidence": "The dark/reduced screenshot is visually identical to the light capture; the computed body remains rgb(255,255,255), color-scheme is normal, and CSS inspection found no prefers-color-scheme rule.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark-reduced.png", "evidence/preferences-probe.json", "evidence/ui-probe.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "medium", "method": "Emulated preference screenshots, computed styles, animation and CSS feature probes", "evidence": "CSS inspection found a prefers-reduced-motion rule and the emulated reduced-motion probe reported no active animations.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark-reduced.png", "evidence/preferences-probe.json", "evidence/ui-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Emulated preference screenshots, computed styles, animation and CSS feature probes", "evidence": "Under prefers-contrast: more, controls retain normal colors and CSS inspection found no prefers-contrast or forced-colors rules; axe also found 16 contrast failures.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark-reduced.png", "evidence/preferences-probe.json", "evidence/ui-probe.json" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Rendered CSS feature probe and interaction inspection", "evidence": "The CSS feature probe found no view-transition rules on this multi-page site.", "pathIds": [ "home" ], "artifacts": [ "evidence/ui-probe.json", "evidence/home-dom.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "not-applicable", "confidence": "high", "method": "Rendered CSS feature probe and interaction inspection", "evidence": "CSS and animation probes found no scroll-timeline and no observed scroll-linked effect.", "pathIds": [ "home" ], "artifacts": [ "evidence/ui-probe.json", "evidence/home-dom.json" ], "reason": "No parallax, scrollytelling, or scroll-linked reveal behavior was observed on representative templates." }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "medium", "method": "Rendered CSS feature probe and interaction inspection", "evidence": "CSS inspection found scroll-snap support and no evidence that the listing requires custom pointer gestures.", "pathIds": [ "home" ], "artifacts": [ "evidence/ui-probe.json", "evidence/home-dom.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "issues", "confidence": "high", "method": "Long-page DOM, CSS feature probe, and visible navigation inspection", "evidence": "The homepage main content is over 10,000px tall, but CSS inspection found no scroll-state queries or progress treatment and the rendered chrome is static.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/ui-probe.json" ], "findingIds": [ "F04" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "issues", "confidence": "high", "method": "Long-page DOM, CSS feature probe, and visible navigation inspection", "evidence": "The DOM uses data-popover controls while CSS inspection found no anchor-name or position-anchor support.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/ui-probe.json" ], "findingIds": [ "F05" ] }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "issues", "confidence": "high", "method": "Long-page DOM, CSS feature probe, and visible navigation inspection", "evidence": "No View Transition, highlight, or comparable attention-guidance rules were found across listing, search and detail navigation.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dom.json", "evidence/ui-probe.json" ], "findingIds": [ "F06" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Load screenshots, overlay DOM, tracker and network inspection", "evidence": "The initial screenshot is fully obscured by an age-verification overlay, while page scripts also include popunder and smartpop advertising integrations. Age assurance is necessary, but unrelated popunder behavior is not.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/overlay-probe.json", "evidence/trackers.json" ], "findingIds": [ "F07" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "issues", "confidence": "high", "method": "Load screenshots, overlay DOM, tracker and network inspection", "evidence": "The active page overlay is a fixed fancybox div and the DOM contains no dialog or popover elements.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/overlay-probe.json", "evidence/trackers.json" ], "findingIds": [ "F08" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "issues", "confidence": "high", "method": "Load screenshots, overlay DOM, tracker and network inspection", "evidence": "The rendered homepage includes a premium banner, six affiliate links, multiple live/ad placements and 345 interactive elements before/around a 10,000px content feed.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png", "evidence/overlay-probe.json", "evidence/trackers.json" ], "findingIds": [ "F09" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "medium", "method": "Desktop/mobile screenshots, layout metrics, focus and target-size probes", "evidence": "At 360x800, layout metrics report scrollWidth 360, clientWidth 360, and horizontalOverflowPx 0.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-layout-mobile.json", "evidence/ui-probe.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "issues", "confidence": "high", "method": "Desktop/mobile screenshots, layout metrics, focus and target-size probes", "evidence": "CSS inspection found no @container rules despite card components appearing across homepage, listing, search and detail templates.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-layout-mobile.json", "evidence/ui-probe.json" ], "findingIds": [ "F10" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "issues", "confidence": "high", "method": "Desktop/mobile screenshots, layout metrics, focus and target-size probes", "evidence": "The target probe found 106 visible controls below 44px, including three 28x28 header buttons; axe reports the viewport disables user scaling.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-layout-mobile.json", "evidence/ui-probe.json" ], "findingIds": [ "F11" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "medium", "method": "Homepage, listing, search, detail and 404 task walkthroughs", "evidence": "Title/description clearly identify adult video/model content and the entry state clearly asks the user to start age verification.", "pathIds": [ "search-flow" ], "artifacts": [ "evidence/home-recon.json", "evidence/path-search--q-test.json", "evidence/path-video-detail.json", "evidence/404.json" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Homepage, listing, search, detail and 404 task walkthroughs", "evidence": "Direct walkthroughs loaded listing, populated search results, and a specific video detail URL with title, metadata and player DOM.", "pathIds": [ "search-flow" ], "artifacts": [ "evidence/home-recon.json", "evidence/path-search--q-test.json", "evidence/path-video-detail.json", "evidence/404.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "medium", "method": "Homepage, listing, search, detail and 404 task walkthroughs", "evidence": "A nonexistent URL resolves to a visible PAGE NOT FOUND state with Back to Home and alternative content.", "pathIds": [ "search-flow" ], "artifacts": [ "evidence/home-recon.json", "evidence/path-search--q-test.json", "evidence/path-video-detail.json", "evidence/404.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Lighthouse, trace, layout, HAR and images primitives", "evidence": "Lighthouse measured LCP 21.04s, FCP 2.82s and Speed Index 12.31s, producing a 0.59 performance score; the trace corroborates a much faster gate paint, showing the full content load is the expensive state.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json", "evidence/home-summary.json", "evidence/images.json", "evidence/home-layout-mobile.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "issues", "confidence": "high", "method": "Lighthouse, trace, layout, HAR and images primitives", "evidence": "All 90 inspected images lack width/height attributes and mobile observed CLS reached 0.09375.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json", "evidence/home-summary.json", "evidence/images.json", "evidence/home-layout-mobile.json" ], "findingIds": [ "F13" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "pass", "confidence": "medium", "method": "Lighthouse, trace, layout, HAR and images primitives", "evidence": "Trace recorded one 51.48ms long task and only 1.48ms total blocking time; Lighthouse TBT was 78.5ms.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json", "evidence/home-summary.json", "evidence/images.json", "evidence/home-layout-mobile.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Lighthouse, trace, layout, HAR and images primitives", "evidence": "The HAR captured 139 requests and 9.20MB transferred, including 6.25MB images, 2.00MB XHR/media and six parser-blocking stylesheets.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json", "evidence/home-summary.json", "evidence/images.json", "evidence/home-layout-mobile.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Lighthouse, trace, layout, HAR and images primitives", "evidence": "Lighthouse estimates 338KiB unused JavaScript and 39KiB unused CSS; the HAR records 80 third-party requests and 2.69MB third-party transfer.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json", "evidence/home-summary.json", "evidence/images.json", "evidence/home-layout-mobile.json" ], "findingIds": [ "F15" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "issues", "confidence": "high", "method": "axe-core, Lighthouse accessibility, screenshots and focus probe", "evidence": "axe found critical unnamed header buttons, 20 unnamed links, one missing image alternative and three untitled frames.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json", "evidence/home-mobile.png", "evidence/ui-probe.json" ], "findingIds": [ "F16" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "axe-core, Lighthouse accessibility, screenshots and focus probe", "evidence": "axe found 16 serious contrast failures, including 14px navigation links at 3.2:1 where 4.5:1 is required.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json", "evidence/home-mobile.png", "evidence/ui-probe.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "axe-core, Lighthouse accessibility, screenshots and focus probe", "evidence": "axe found content outside landmarks; the homepage content headings precede the age-gate H1, and the detail page has an empty heading followed by promotional model headings.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json", "evidence/home-mobile.png", "evidence/ui-probe.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "medium", "method": "axe-core, Lighthouse accessibility, screenshots and focus probe", "evidence": "Desktop/mobile screenshots show readable age-gate typography and the content DOM uses an 18px body size with fluid widths.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json", "evidence/home-mobile.png", "evidence/ui-probe.json" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "issues", "confidence": "high", "method": "axe-core, Lighthouse accessibility, screenshots and focus probe", "evidence": "The viewport is width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0; axe classifies this as critical.", "pathIds": [ "home" ], "artifacts": [ "evidence/a11y-probe.json", "evidence/home-mobile.png", "evidence/ui-probe.json" ], "findingIds": [ "F19" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "pass", "confidence": "medium", "method": "Lighthouse best-practices audits, DOM and images inspection", "evidence": "Lighthouse errors-in-console audit passed with zero items.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/images.json", "evidence/home-dom.json" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "issues", "confidence": "high", "method": "Lighthouse best-practices audits, DOM and images inspection", "evidence": "The image audit found 90/90 without explicit dimensions, 40 oversized, 66 without srcset and 43 legacy-format images.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/images.json", "evidence/home-dom.json" ], "findingIds": [ "F20" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Lighthouse best-practices audits, DOM and images inspection", "evidence": "Lighthouse reports three BFCache failure reasons centered on Cache-Control: no-store and a JavaScript request receiving no-store.", "pathIds": [ "home" ], "artifacts": [ "evidence/lighthouse.json", "evidence/images.json", "evidence/home-dom.json" ], "findingIds": [ "F21" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "medium", "method": "DOM metadata probe, robots/sitemap inspection, Lighthouse SEO and discoverability primitive", "evidence": "Homepage, listing, search, detail, Spanish and 404 probes each expose descriptive titles; homepage has a descriptive meta description.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/home-recon.json", "evidence/robots.json", "evidence/sitemap.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "issues", "confidence": "high", "method": "DOM metadata probe, robots/sitemap inspection, Lighthouse SEO and discoverability primitive", "evidence": "Lighthouse found five non-crawlable anchors; the DOM also includes a Go Premium href ending in #.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/home-recon.json", "evidence/robots.json", "evidence/sitemap.json" ], "findingIds": [ "F22" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "pass", "confidence": "medium", "method": "DOM metadata probe, robots/sitemap inspection, Lighthouse SEO and discoverability primitive", "evidence": "Homepage returned 200, exposes canonical and hreflang, robots permits general/search crawling, and sitemap.xml is present and populated.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/home-recon.json", "evidence/robots.json", "evidence/sitemap.json" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "DOM metadata probe, robots/sitemap inspection, Lighthouse SEO and discoverability primitive", "evidence": "Open Graph is present and the detail template has VideoObject JSON-LD, but the homepage contains no JSON-LD describing the site/organization.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/home-recon.json", "evidence/robots.json", "evidence/sitemap.json" ], "findingIds": [ "F23" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Headers, cookies, secrets, trackers and HAR primitives", "evidence": "HTTPS/HSTS are present, but CSP is absent; PHPSESSID is not Secure or HttpOnly, and kt_acctoken uses SameSite=None without HttpOnly.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/trackers.json", "evidence/secrets.json", "evidence/home-summary.json" ], "findingIds": [ "F24" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Headers, cookies, secrets, trackers and HAR primitives", "evidence": "The tracker probe found 15 third-party origins including Google Analytics; HAR recorded 80 third-party requests and 2.69MB before gate completion.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/trackers.json", "evidence/secrets.json", "evidence/home-summary.json" ], "findingIds": [ "F25" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Headers, cookies, secrets, trackers and HAR primitives", "evidence": "The site exposes profile/account and subscription controls, but rendered source contains no WebAuthn/passkey integration; Lighthouse confirms no permission prompts on load.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/trackers.json", "evidence/secrets.json", "evidence/home-summary.json" ], "findingIds": [ "F26" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Headers, cookies, secrets, trackers and HAR primitives", "evidence": "HSTS, nosniff, SAMEORIGIN and same-origin referrer policy are present, but CSP and Permissions-Policy are absent.", "pathIds": [ "home" ], "artifacts": [ "evidence/headers.json", "evidence/cookies.json", "evidence/trackers.json", "evidence/secrets.json", "evidence/home-summary.json" ], "findingIds": [ "F27" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "medium", "method": "Raw-vs-rendered discoverability, manifest/service-worker probes, 404 walkthrough and runtime inspection", "evidence": "Discoverability primitive found 99% raw/rendered content coverage, no empty mount and no JavaScript shell.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/manifest.json", "evidence/404.json", "evidence/ui-probe.json" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "issues", "confidence": "high", "method": "Raw-vs-rendered discoverability, manifest/service-worker probes, 404 walkthrough and runtime inspection", "evidence": "Menus use custom data-popover wiring, the age gate is a fixed fancybox overlay, and Lighthouse reports BFCache blocking.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/manifest.json", "evidence/404.json", "evidence/ui-probe.json" ], "findingIds": [ "F28" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "issues", "confidence": "high", "method": "Raw-vs-rendered discoverability, manifest/service-worker probes, 404 walkthrough and runtime inspection", "evidence": "A standalone manifest with icons/start_url exists, but the service-worker controller probe is false.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/manifest.json", "evidence/404.json", "evidence/ui-probe.json" ], "findingIds": [ "F29" ] }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "medium", "method": "Raw-vs-rendered discoverability, manifest/service-worker probes, 404 walkthrough and runtime inspection", "evidence": "The exercised unknown URL presents a useful Page Not Found state and Back to Home recovery path.", "pathIds": [ "home" ], "artifacts": [ "evidence/discoverability.json", "evidence/manifest.json", "evidence/404.json", "evidence/ui-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "issues", "confidence": "high", "method": "English/Spanish route probes, hreflang and CSS logical-property inspection", "evidence": "The Spanish route renders Spanish navigation and pricing but html lang remains en; CSS inspection found 329 physical-direction declarations and only one logical-property signal.", "pathIds": [ "spanish" ], "artifacts": [ "evidence/path-es.json", "evidence/path-onlyfans-creators.json", "evidence/ui-probe.json" ], "findingIds": [ "F30" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "medium", "method": "English/Spanish route probes, hreflang and CSS logical-property inspection", "evidence": "Spanish route localizes relative dates and subscription prices/decimal formatting and exposes locale-specific hreflang URLs.", "pathIds": [ "spanish" ], "artifacts": [ "evidence/path-es.json", "evidence/path-onlyfans-creators.json", "evidence/ui-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "English/Spanish route probes, hreflang and CSS logical-property inspection", "evidence": "No event scheduling or time-zone-sensitive workflow was present in the representative routes.", "pathIds": [ "spanish" ], "artifacts": [ "evidence/path-es.json", "evidence/path-onlyfans-creators.json", "evidence/ui-probe.json" ], "reason": "Representative public templates display relative publication ages but expose no scheduled cross-zone events or user-entered times." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "issues", "confidence": "high", "method": "Commercial/search form DOM and advertising/third-party walkthrough", "evidence": "The page loads popunder/smartpop scripts and presents many external affiliate destinations around core navigation before the user clears age assurance.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json", "evidence/path-search--q-test.json", "evidence/trackers.json" ], "findingIds": [ "F31" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "medium", "method": "Commercial/search form DOM and advertising/third-party walkthrough", "evidence": "The exposed search flow is optional GET input with no required-field trap; a direct query returns clear categorized results.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json", "evidence/path-search--q-test.json", "evidence/trackers.json" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "not-applicable", "confidence": "high", "method": "Commercial/search form DOM and advertising/third-party walkthrough", "evidence": "DOM form inventory found search text fields and package radios, but no personal-data fields requiring autofill tokens.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json", "evidence/path-search--q-test.json", "evidence/trackers.json" ], "reason": "No address, payment-card, sign-in, or sign-up text fields were exposed in the unauthenticated representative paths." }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "issues", "confidence": "high", "method": "Commercial/search form DOM and advertising/third-party walkthrough", "evidence": "A four-option recurring upgrade form is injected on every audited template, but its DOM labels show price/term only and no nearby cancellation, renewal or reversal information.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-recon.json", "evidence/path-search--q-test.json", "evidence/trackers.json" ], "findingIds": [ "F32" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "HAR, images, trackers, video DOM and trace inspection", "evidence": "The image audit found 40 oversized images, 43 legacy-format images, 66 without responsive sources and no modern-format images.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/images.json", "evidence/trackers.json", "evidence/path-video-detail.json" ], "findingIds": [ "F33" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "HAR, images, trackers, video DOM and trace inspection", "evidence": "HAR captured 62 XHR/fetch requests and about 2MB, largely live HLS segments, while an age gate obscured the page.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/images.json", "evidence/trackers.json", "evidence/path-video-detail.json" ], "findingIds": [ "F34" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "HAR, images, trackers, video DOM and trace inspection", "evidence": "The HAR records 80 third-party requests/2.69MB; detail DOM contains four video elements, two autoplaying muted, with no tracks.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-summary.json", "evidence/images.json", "evidence/trackers.json", "evidence/path-video-detail.json" ], "findingIds": [ "F35" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "robots.txt policy and rendered capability/source probes", "evidence": "robots.txt disallows GPTBot, ChatGPT-User, ClaudeBot and other AI agents; no WebMCP capability was observed.", "pathIds": [ "home" ], "artifacts": [ "evidence/robots.json", "evidence/discoverability.json" ], "reason": "The operator explicitly blocks major AI agents in robots.txt and does not signal an agent-facing capability intent." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "robots.txt policy and rendered capability/source probes", "evidence": "DOM and script capability probes expose no built-in language-model or summarizer surface.", "pathIds": [ "home" ], "artifacts": [ "evidence/robots.json", "evidence/discoverability.json" ], "reason": "No summarization, generation, or other user task requiring on-device inference exists on the representative media-browsing paths." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "issues", "confidence": "low", "method": "Baseline and post-interaction heap summaries plus repeated-menu runtime probe", "evidence": "After ten open/close cycles, heap summary size rose from 18.61MB/281,093 nodes to 22.22MB/315,989 nodes (about 19%/12%); separate browser sessions make this a low-confidence risk signal, not proof of a leak.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot", "evidence/runtime-probe.json" ], "findingIds": [ "F36" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "medium", "method": "Baseline and post-interaction heap summaries plus repeated-menu runtime probe", "evidence": "Baseline summary is 18.61MB for the media-heavy page; the live DOM contains about 2,482 elements and runtime JS heap is about 18.26MB, proportionate though worth monitoring.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot", "evidence/runtime-probe.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "medium", "method": "Baseline and post-interaction heap summaries plus repeated-menu runtime probe", "evidence": "Heap summaries list no Detached* constructor among leading populations; after ten menu cycles the menu returns to opened=false and live DOM remains 2,479 elements.", "pathIds": [ "home" ], "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot", "evidence/runtime-probe.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "issues", "findingIds": [ "F04", "F05", "F06" ] }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F07", "F08", "F09" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F11" ] }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13", "F14", "F15" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F16", "F17", "F18", "F19" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F20", "F21" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F22", "F23" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F24", "F25", "F26", "F27" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "issues", "findingIds": [ "F28", "F29" ] }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "issues", "findingIds": [ "F30" ] }, { "principleId": "be-trustworthy", "expectation": "default", "status": "issues", "findingIds": [ "F31", "F32" ] }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F33", "F34", "F35" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "Derived from its atomic check outcomes." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "issues", "findingIds": [ "F36" ] } ], "paths": [ { "id": "home", "description": "Homepage/catalog and required age-assurance entry state; represents shared header, ads, feed and global security/performance.", "url": "https://pimpbunny.com/", "conditions": [ "desktop", "360x800", "dark", "reduced-motion", "high contrast", "keyboard focus" ], "result": "issues" }, { "id": "videos-listing", "description": "Video listing archetype; represents paginated catalog templates.", "url": "https://pimpbunny.com/videos/", "conditions": [ "rendered DOM" ], "result": "issues" }, { "id": "models-listing", "description": "Model listing/filter archetype with large filter form.", "url": "https://pimpbunny.com/onlyfans-creators/", "conditions": [ "rendered DOM" ], "result": "issues" }, { "id": "search-flow", "description": "Primary search journey using a direct GET query and populated results.", "url": "https://pimpbunny.com/search/?q=test", "conditions": [ "query results" ], "result": "pass" }, { "id": "video-detail", "description": "Primary media detail/player archetype with VideoObject data and related content.", "url": "https://pimpbunny.com/videos/erotic-medusa-gets-her-ass-fucked-by-a-bbc/", "conditions": [ "360x800", "player DOM" ], "result": "issues" }, { "id": "spanish", "description": "Localized template used to test lang, hreflang and localized data.", "url": "https://pimpbunny.com/es/", "conditions": [ "Spanish locale" ], "result": "issues" }, { "id": "not-found", "description": "HTTP/navigation failure recovery surface.", "url": "https://pimpbunny.com/this-path-should-not-exist-web-uplift", "conditions": [ "360x800" ], "result": "pass" } ], "findings": [ { "id": "F01", "severity": "medium", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "confidence": "high", "summary": "No user-preference dark theme", "evidence": "The dark/reduced screenshot is visually identical to the light capture; the computed body remains rgb(255,255,255), color-scheme is normal, and CSS inspection found no prefers-color-scheme rule.", "suggestedFix": "Declare color-scheme and provide preference-driven dark surface/text tokens with prefers-color-scheme or light-dark().", "effort": "small", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-dark-reduced.png", "evidence/preferences-probe.json" ] }, { "id": "F02", "severity": "medium", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "High-contrast preferences are not handled", "evidence": "Under prefers-contrast: more, controls retain normal colors and CSS inspection found no prefers-contrast or forced-colors rules; axe also found 16 contrast failures.", "suggestedFix": "Add forced-colors and prefers-contrast adaptations, preserving visible borders, focus, and system colors.", "effort": "small", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/preferences-probe.json", "evidence/a11y-probe.json" ] }, { "id": "F03", "severity": "low", "principleId": "implement-natural-interactions", "principleCheckId": "view-transitions", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Route and state changes lack View Transitions", "evidence": "The CSS feature probe found no view-transition rules on this multi-page site.", "suggestedFix": "Add cross-document view transitions for same-origin navigation, with a reduced-motion fallback.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/ui-probe.json" ] }, { "id": "F04", "severity": "low", "principleId": "provide-guided-navigation", "principleCheckId": "scroll-state-aware-chrome", "guidanceId": "navigation-drawer", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Long pages provide no scroll-state guidance", "evidence": "The homepage main content is over 10,000px tall, but CSS inspection found no scroll-state queries or progress treatment and the rendered chrome is static.", "suggestedFix": "Add a compact scroll-aware header or progress affordance without obscuring content.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-dom.json", "evidence/ui-probe.json" ] }, { "id": "F05", "severity": "low", "principleId": "provide-guided-navigation", "principleCheckId": "anchored-positioning", "guidanceId": "navigation-drawer", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Menus use hand-wired positioning rather than anchored primitives", "evidence": "The DOM uses data-popover controls while CSS inspection found no anchor-name or position-anchor support.", "suggestedFix": "Use popover with CSS anchor positioning and position-try fallbacks for menus near viewport edges.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-dom.json", "evidence/ui-probe.json" ] }, { "id": "F06", "severity": "low", "principleId": "provide-guided-navigation", "principleCheckId": "directs-attention", "guidanceId": "same-document-transitions", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Navigation changes do not cue moved attention", "evidence": "No View Transition, highlight, or comparable attention-guidance rules were found across listing, search and detail navigation.", "suggestedFix": "Use directional transitions and focus/highlight cues after navigation while honoring reduced motion.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/ui-probe.json", "evidence/path-search--q-test.json" ] }, { "id": "F07", "severity": "high", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Third-party interruptions dominate entry", "evidence": "The initial screenshot is fully obscured by an age-verification overlay, while page scripts also include popunder and smartpop advertising integrations. Age assurance is necessary, but unrelated popunder behavior is not.", "suggestedFix": "Keep the required age gate focused and remove automatic popunder/smartpop interruptions; defer promotional surfaces until an explicit user action.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-desktop.png", "evidence/home-recon.json", "evidence/trackers.json" ] }, { "id": "F08", "severity": "medium", "principleId": "maximize-content-reduce-noise", "principleCheckId": "semantic-dismissible-primitives", "guidanceId": "declarative-dialog-popover-control", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The age gate and menus are custom overlay structures", "evidence": "The active page overlay is a fixed fancybox div and the DOM contains no dialog or popover elements.", "suggestedFix": "Implement the age gate as a modal dialog and transient menus with popover, including focus trapping, return, and declarative dismissal.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/overlay-probe.json", "evidence/home-dom.json" ] }, { "id": "F09", "severity": "medium", "principleId": "maximize-content-reduce-noise", "principleCheckId": "reduced-chrome", "guidanceId": "visually-texture-content", "guidanceCategory": "css", "confidence": "high", "summary": "Promotional chrome crowds the content experience", "evidence": "The rendered homepage includes a premium banner, six affiliate links, multiple live/ad placements and 345 interactive elements before/around a 10,000px content feed.", "suggestedFix": "Reduce persistent promotional chrome and make editorial/media content the dominant hierarchy.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-recon.json", "evidence/home-dom.json" ] }, { "id": "F10", "severity": "low", "principleId": "adapt-to-the-form-factor", "principleCheckId": "component-level-responsiveness", "guidanceId": "size-aware-styling", "guidanceCategory": "css", "confidence": "high", "summary": "Reusable cards are not container-responsive", "evidence": "CSS inspection found no @container rules despite card components appearing across homepage, listing, search and detail templates.", "suggestedFix": "Give reusable card/grid components containment and size-aware container query variants.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/ui-probe.json", "evidence/path-search--q-test.json" ] }, { "id": "F11", "severity": "high", "principleId": "adapt-to-the-form-factor", "principleCheckId": "input-modality-aware", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Touch and zoom affordances are restricted", "evidence": "The target probe found 106 visible controls below 44px, including three 28x28 header buttons; axe reports the viewport disables user scaling.", "suggestedFix": "Increase icon-button hit areas to at least 44x44 CSS px, retain visible focus, and remove maximum-scale/user-scalable restrictions.", "effort": "small", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/ui-probe.json", "evidence/a11y-probe.json" ] }, { "id": "F12", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "confidence": "high", "summary": "Largest Contentful Paint is extremely slow", "evidence": "Lighthouse measured LCP 21.04s, FCP 2.82s and Speed Index 12.31s, producing a 0.59 performance score; the trace corroborates a much faster gate paint, showing the full content load is the expensive state.", "suggestedFix": "Prioritize the true LCP resource and prevent below-gate media/ads from competing before age verification and user intent.", "effort": "large", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/lighthouse.json", "evidence/home-trace-summary.json" ] }, { "id": "F13", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "visual-stability", "guidanceId": "optimize-image-priority", "guidanceCategory": "performance", "confidence": "high", "summary": "Images do not reserve layout space", "evidence": "All 90 inspected images lack width/height attributes and mobile observed CLS reached 0.09375.", "suggestedFix": "Emit intrinsic width/height or aspect-ratio for every media card and reserve ad/player slots.", "effort": "small", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/images.json", "evidence/home-layout-mobile.json" ] }, { "id": "F14", "severity": "high", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-preload-priority", "guidanceCategory": "performance", "confidence": "high", "summary": "Initial delivery is excessively heavy", "evidence": "The HAR captured 139 requests and 9.20MB transferred, including 6.25MB images, 2.00MB XHR/media and six parser-blocking stylesheets.", "suggestedFix": "Gate nonessential media and ads, consolidate critical CSS, lazy-load below-fold assets, and set intentional cache policies.", "effort": "large", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home.har", "evidence/home-summary.json" ] }, { "id": "F15", "severity": "medium", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "confidence": "high", "summary": "Unused and third-party code inflate startup", "evidence": "Lighthouse estimates 338KiB unused JavaScript and 39KiB unused CSS; the HAR records 80 third-party requests and 2.69MB third-party transfer.", "suggestedFix": "Remove unused legacy libraries, route-split behavior, and load advertising/analytics only after consent and need.", "effort": "large", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/lighthouse.json", "evidence/home-summary.json" ] }, { "id": "F16", "severity": "high", "principleId": "be-inclusive", "principleCheckId": "names-roles-labels", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Many controls and media lack accessible names", "evidence": "axe found critical unnamed header buttons, 20 unnamed links, one missing image alternative and three untitled frames.", "suggestedFix": "Add concise accessible names, useful iframe titles and correct decorative/meaningful image alternatives.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/a11y-probe.json" ] }, { "id": "F17", "severity": "high", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Text contrast fails WCAG AA", "evidence": "axe found 16 serious contrast failures, including 14px navigation links at 3.2:1 where 4.5:1 is required.", "suggestedFix": "Adjust text tokens to meet WCAG AA in every state and verify in normal and high-contrast modes.", "effort": "small", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/a11y-probe.json" ] }, { "id": "F18", "severity": "medium", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "confidence": "high", "summary": "Landmark and page-heading structure is inconsistent", "evidence": "axe found content outside landmarks; the homepage content headings precede the age-gate H1, and the detail page has an empty heading followed by promotional model headings.", "suggestedFix": "Use one meaningful page H1, logical heading order, and contain all primary content in named landmarks.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/a11y-probe.json", "evidence/path-video-detail.json" ] }, { "id": "F19", "severity": "high", "principleId": "be-inclusive", "principleCheckId": "zoom-reflow-targets-and-media", "guidanceId": "fluid-scaling", "guidanceCategory": "css", "confidence": "high", "summary": "Mobile zoom is disabled", "evidence": "The viewport is width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0; axe classifies this as critical.", "suggestedFix": "Allow pinch zoom and 200% text zoom; re-test reflow and target sizing at narrow widths.", "effort": "trivial", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-recon.json", "evidence/a11y-probe.json" ] }, { "id": "F20", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "sound-document-and-assets", "guidanceId": "html", "guidanceCategory": "html", "confidence": "high", "summary": "Image assets are not soundly dimensioned or modernized", "evidence": "The image audit found 90/90 without explicit dimensions, 40 oversized, 66 without srcset and 43 legacy-format images.", "suggestedFix": "Emit dimensions and responsive AVIF/WebP sources sized to card breakpoints.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/images.json" ] }, { "id": "F21", "severity": "medium", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "html", "confidence": "high", "summary": "The page is blocked from the back/forward cache", "evidence": "Lighthouse reports three BFCache failure reasons centered on Cache-Control: no-store and a JavaScript request receiving no-store.", "suggestedFix": "Avoid blanket no-store on public pages and isolate truly sensitive responses so back/forward navigation can restore instantly.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/lighthouse.json" ] }, { "id": "F22", "severity": "medium", "principleId": "be-discoverable", "principleCheckId": "crawlable-and-mobile-friendly", "guidanceId": "html", "guidanceCategory": "html", "confidence": "high", "summary": "Some navigation targets are not crawlable", "evidence": "Lighthouse found five non-crawlable anchors; the DOM also includes a Go Premium href ending in #.", "suggestedFix": "Use real destination URLs for navigation and buttons for actions; retain descriptive link text.", "effort": "small", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/lighthouse.json", "evidence/home-recon.json" ] }, { "id": "F23", "severity": "low", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "guidanceCategory": "html", "confidence": "high", "summary": "The homepage lacks organization/site structured data", "evidence": "Open Graph is present and the detail template has VideoObject JSON-LD, but the homepage contains no JSON-LD describing the site/organization.", "suggestedFix": "Add accurate WebSite/Organization JSON-LD and keep the existing VideoObject metadata aligned with visible detail content.", "effort": "small", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-recon.json", "evidence/path-video-detail.json" ] }, { "id": "F24", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "confidence": "high", "summary": "CSP and cookie protections are incomplete", "evidence": "HTTPS/HSTS are present, but CSP is absent; PHPSESSID is not Secure or HttpOnly, and kt_acctoken uses SameSite=None without HttpOnly.", "suggestedFix": "Deploy a nonce/hash-based CSP and mark session/auth-like cookies Secure, HttpOnly and Lax/Strict unless cross-site use is essential.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/headers.json", "evidence/cookies.json" ] }, { "id": "F25", "severity": "high", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "confidence": "high", "summary": "The page sends data across a broad third-party ad/tracking surface", "evidence": "The tracker probe found 15 third-party origins including Google Analytics; HAR recorded 80 third-party requests and 2.69MB before gate completion.", "suggestedFix": "Minimize vendors, require explicit contextual consent, and defer analytics/ad requests until consent and purpose are established.", "effort": "large", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/trackers.json", "evidence/home-summary.json" ] }, { "id": "F26", "severity": "medium", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "guidanceCategory": "identity", "confidence": "high", "summary": "Account surfaces do not expose modern phishing-resistant authentication", "evidence": "The site exposes profile/account and subscription controls, but rendered source contains no WebAuthn/passkey integration; Lighthouse confirms no permission prompts on load.", "suggestedFix": "Offer passkey registration and sign-in alongside recovery, and keep permission requests tied to user actions.", "effort": "large", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-recon.json", "evidence/lighthouse.json" ] }, { "id": "F27", "severity": "medium", "principleId": "be-private-and-secure", "principleCheckId": "defensive-browser-policies", "guidanceId": "security", "guidanceCategory": "security", "confidence": "high", "summary": "Browser policy coverage is incomplete", "evidence": "HSTS, nosniff, SAMEORIGIN and same-origin referrer policy are present, but CSP and Permissions-Policy are absent.", "suggestedFix": "Add a restrictive Permissions-Policy and CSP frame-ancestors; consider Trusted Types for script-heavy authenticated surfaces.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/headers.json" ] }, { "id": "F28", "severity": "medium", "principleId": "be-resilient", "principleCheckId": "resilient-runtime-behaviour", "guidanceId": "conditional-async-dependencies", "guidanceCategory": "performance", "confidence": "high", "summary": "Runtime behavior relies on fragile custom overlays and no-store navigation", "evidence": "Menus use custom data-popover wiring, the age gate is a fixed fancybox overlay, and Lighthouse reports BFCache blocking.", "suggestedFix": "Adopt native dialog/popover behavior, sequence optional dependencies, and restore BFCache eligibility.", "effort": "large", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/overlay-probe.json", "evidence/lighthouse.json" ] }, { "id": "F29", "severity": "low", "principleId": "be-resilient", "principleCheckId": "offline-and-installable", "guidanceId": "flicker-free-client-side-ab-testing", "guidanceCategory": "user-experience", "confidence": "high", "summary": "The installable manifest is not backed by an offline runtime", "evidence": "A standalone manifest with icons/start_url exists, but the service-worker controller probe is false.", "suggestedFix": "If installability is intentional, add a minimal service worker and offline fallback; otherwise remove misleading standalone-app signals.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/manifest.json", "evidence/ui-probe.json" ] }, { "id": "F30", "severity": "high", "principleId": "be-internationalised", "principleCheckId": "lang-dir-and-logical-properties", "guidanceId": "translator", "guidanceCategory": "internationalization", "confidence": "high", "summary": "Localized pages declare the wrong document language", "evidence": "The Spanish route renders Spanish navigation and pricing but html lang remains en; CSS inspection found 329 physical-direction declarations and only one logical-property signal.", "suggestedFix": "Set lang per locale and migrate layout spacing/positioning to logical properties, testing RTL expansion.", "effort": "medium", "pathId": "spanish", "url": "https://pimpbunny.com/es/", "artifacts": [ "evidence/path-es.json", "evidence/ui-probe.json" ] }, { "id": "F31", "severity": "high", "principleId": "be-trustworthy", "principleCheckId": "no-dark-patterns", "guidanceId": "custom-button-actions", "guidanceCategory": "user-experience", "confidence": "high", "summary": "Aggressive affiliate and popunder behavior undermines predictable choice", "evidence": "The page loads popunder/smartpop scripts and presents many external affiliate destinations around core navigation before the user clears age assurance.", "suggestedFix": "Remove automatic popunders, clearly label sponsored destinations, and make refusal/continuation choices equally understandable.", "effort": "large", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-recon.json", "evidence/trackers.json" ] }, { "id": "F32", "severity": "medium", "principleId": "be-trustworthy", "principleCheckId": "safe-commercial-and-account-flows", "guidanceId": "autofill-payment-form", "guidanceCategory": "forms", "confidence": "high", "summary": "Subscription commitments lack nearby cancellation context", "evidence": "A four-option recurring upgrade form is injected on every audited template, but its DOM labels show price/term only and no nearby cancellation, renewal or reversal information.", "suggestedFix": "Show renewal, total commitment, cancellation route and confirmation before selection and purchase.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-recon.json", "evidence/path-search--q-test.json" ] }, { "id": "F33", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "performance", "confidence": "high", "summary": "Media assets are substantially over-delivered", "evidence": "The image audit found 40 oversized images, 43 legacy-format images, 66 without responsive sources and no modern-format images.", "suggestedFix": "Generate responsive AVIF/WebP variants and select by rendered size and density.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/images.json" ] }, { "id": "F34", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "no-wasteful-work", "guidanceId": "efficient-background-processing", "guidanceCategory": "performance", "confidence": "high", "summary": "Heavy media work starts before the user reaches content", "evidence": "HAR captured 62 XHR/fetch requests and about 2MB, largely live HLS segments, while an age gate obscured the page.", "suggestedFix": "Do not start preview streams or background fetches until age verification, visibility and user intent justify them.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-summary.json", "evidence/home-desktop.png" ] }, { "id": "F35", "severity": "high", "principleId": "be-sustainable", "principleCheckId": "third-party-and-media-budget", "guidanceId": "deprioritize-background-fetches", "guidanceCategory": "performance", "confidence": "high", "summary": "Third-party and autoplay media cost is disproportionate", "evidence": "The HAR records 80 third-party requests/2.69MB; detail DOM contains four video elements, two autoplaying muted, with no tracks.", "suggestedFix": "Cap third-party budgets, replace autoplay previews with posters, and defer media until interaction/viewport entry.", "effort": "large", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/home-summary.json", "evidence/path-video-detail.json" ] }, { "id": "F36", "severity": "medium", "principleId": "be-memory-efficient", "principleCheckId": "no-leak-under-repeated-interaction", "guidanceId": "manage-recurring-intervals", "guidanceCategory": "performance", "confidence": "low", "summary": "Repeated menu interaction shows retained-growth risk", "evidence": "After ten open/close cycles, heap summary size rose from 18.61MB/281,093 nodes to 22.22MB/315,989 nodes (about 19%/12%); separate browser sessions make this a low-confidence risk signal, not proof of a leak.", "suggestedFix": "Re-run in one controlled session with forced GC and baseline/target/final snapshots; inspect retained listeners, closures and third-party widgets.", "effort": "medium", "pathId": "home", "url": "https://pimpbunny.com/", "artifacts": [ "evidence/heap-baseline.heapsnapshot", "evidence/heap-post.heapsnapshot", "evidence/runtime-probe.json" ] } ], "taskList": [ { "id": "T01", "title": "Stop pre-gate autoplay, popunders and nonessential third-party requests", "priority": 1, "findingIds": [ "F07", "F12", "F14", "F25", "F31", "F34", "F35" ], "guidanceId": "deprioritize-background-fetches", "status": "open" }, { "id": "T02", "title": "Repair accessible names, contrast, zoom and touch target sizing", "priority": 2, "findingIds": [ "F02", "F11", "F16", "F17", "F18", "F19" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T03", "title": "Optimize and dimension responsive images", "priority": 3, "findingIds": [ "F13", "F20", "F33" ], "guidanceId": "optimize-image-priority", "status": "open" }, { "id": "T04", "title": "Add CSP, Permissions-Policy and secure cookie attributes", "priority": 4, "findingIds": [ "F24", "F27" ], "guidanceId": "security", "status": "open" }, { "id": "T05", "title": "Replace custom overlays with dialog/popover and anchored positioning", "priority": 5, "findingIds": [ "F05", "F08", "F28" ], "guidanceId": "declarative-dialog-popover-control", "status": "open" }, { "id": "T06", "title": "Remove unused legacy bundles and recover BFCache eligibility", "priority": 6, "findingIds": [ "F15", "F21" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T07", "title": "Correct localized lang and migrate to logical CSS properties", "priority": 7, "findingIds": [ "F30" ], "guidanceId": "translator", "status": "open" }, { "id": "T08", "title": "Add preference-driven dark and high-contrast themes", "priority": 8, "findingIds": [ "F01", "F02" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T09", "title": "Make subscription commitments and sponsored destinations explicit", "priority": 9, "findingIds": [ "F31", "F32" ], "guidanceId": "custom-button-actions", "status": "open" }, { "id": "T10", "title": "Improve crawlable links and homepage structured metadata", "priority": 10, "findingIds": [ "F22", "F23" ], "guidanceId": "html", "status": "open" }, { "id": "T11", "title": "Add modern navigation transitions and attention cues", "priority": 11, "findingIds": [ "F03", "F04", "F06" ], "guidanceId": "same-document-transitions", "status": "open" }, { "id": "T12", "title": "Run a controlled same-session memory leak investigation", "priority": 12, "findingIds": [ "F36" ], "guidanceId": "manage-recurring-intervals", "status": "open" } ], "budget": { "pathCount": 7, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-28T10-44-08-023Z" }