{ "url": "https://www.patreon.com", "auditedAt": "2026-07-28T11:20:19.819Z", "mode": "report", "status": "completed", "statusDetail": "Atomic coverage complete across 58 checks. Login was challenged independently, so judgements rely on the reachable public marketing, pricing, product, creator-category, and signup-entry surfaces.", "page": { "appType": "hybrid", "framework": "Next.js marketing application plus a separate account application", "notes": "Representative public marketing templates are server-rendered. The login route intermittently triggers Cloudflare verification. The audit does not cover authenticated creator/member dashboards, checkout after account creation, private posts, cancellation after login, mobile native apps, or every sitemap entry." }, "evidenceUsed": [ "screenshot", "dom", "layout-metrics", "evaluate-probe", "prefers-color-scheme emulation", "prefers-reduced-motion emulation", "prefers-contrast emulation", "trace", "har", "headers", "cookies", "trackers", "secrets", "images", "raw HTML and robots/sitemap fetch", "heap-summary comparison", "Lighthouse 13.4.1 with axe-core 4.12.1" ], "guidanceConsulted": [ "dark-mode", "component-specific-light-dark-theme", "accessibility", "adapt-scrollbar-to-contrast-preferences", "same-document-transitions", "cross-document-transitions", "group-element-transitions", "faster-spa-view-transitions", "scrollytelling", "parallax-scroll-effects", "scroll-entry-exit-effects", "carousel-slide-effects", "physics-based-easing", "individual-transform-properties", "animate-element-entry-exit", "animate-to-from-top-layer", "animate-to-intrinsic-sizes", "dynamic-sibling-animations", "interactive-content-reveal", "pull-to-reveal", "swipe-to-remove", "shrinking-header-on-scroll", "scroll-progress-indicator", "scroll-position-aware-elements", "scroll-snap-realtime-feedback", "scroll-snap-state-sync", "scroll-target-on-load", "soft-edge-content-fade", "scrollability-affordance-hints", "anchor-positioning-tab-underline", "position-aware-tooltips", "interest-triggered-tooltips", "interest-triggered-action-previews", "directional-navigation-transitions", "carousel-snap-highlights", "navigation-drawer", "stack-drill-down", "persistent-app-tours", "persistent-toast-notifications", "light-dismiss-a-dialog", "platform-controls-dismiss-dialog", "declarative-dialog-popover-control", "animated-select-picker", "branded-select-styling", "brand-consistent-forms", "custom-select-picker-layouts", "rich-media-picker", "complex-shapes", "shaped-cutouts", "overflow-clipping-control", "visually-texture-content", "apply-webgl-shaders", "interactive-content-in-3d-scenes", "highlight-text-ranges", "prevent-text-wrapping", "customize-scrollbar-color-and-thickness", "export-html-media-from-canvas", "fluid-scaling", "calculate-with-intrinsic-sizes", "css-layout", "size-aware-styling", "content-based-styling", "child-state-based-styling", "design-token-reactivity", "dynamic-sibling-styling", "form-fields-automatically-fit-contents", "improve-text-layout-and-legibility", "forms", "accessible-error-announcement", "required-field-feedback", "validate-input-after-interaction", "identify-inp-causes", "schedule-tasks-by-priority", "optimize-preload-priority", "improve-next-page-load-performance", "interactions-in-complex-layouts", "performance", "visually-stable-font-fallbacks", "break-up-long-tasks", "identify-heavy-scripts", "optimize-script-priority", "defer-rendering-heavy-content", "defer-work-until-scroll-ends", "optimize-image-priority", "conditional-async-dependencies", "expose-canvas-content-to-browser-features", "move-dom-element-without-losing-state", "precise-text-alignment", "visually-stable-mixed-fonts", "css", "html", "reduce-style-repetition", "security", "privacy", "batch-analytics-events", "full-session-analytics", "calculate-total-foreground-time", "passkeys", "passkey-registration", "passkey-authentication", "passkey-reauthentication", "passkey-conditional-create", "passkey-management", "flicker-free-client-side-ab-testing", "consistent-cross-document-transitions", "stabilize-reactive-state", "resilient-context-menus-and-nested-dropdowns", "persistent-top-layer-ui", "detect-initial-visibility-state", "sequence-distributed-events", "translator", "language-detection", "support-global-calendar-systems", "capture-location-agnostic-data", "format-human-readable-durations", "manage-recurring-intervals", "calculate-event-differentials", "coordinate-global-events", "model-partial-time-concepts", "search-hidden-content", "select-menu-interaction", "style-parent-with-has", "autofill-address-form", "autofill-payment-form", "autofill-sign-in-form", "autofill-sign-up-form", "autofill-highlight-inputs", "deliver-optimized-decorative-images", "resolution-optimized-pseudo-elements", "deprioritize-background-fetches", "efficient-background-processing", "webmcp", "agentic-forms", "agentic-javascript-tools", "language-model", "summarizer" ], "artifacts": [ { "type": "screenshot", "path": "evidence/home-desktop.png", "caption": "Homepage at 1440x1000 with consent dialog over the hero.", "condition": "desktop", "findingIds": [ "F04" ] }, { "type": "screenshot", "path": "evidence/home-mobile.png", "caption": "Mobile first viewport; consent dialog occupies most of the usable viewport.", "condition": "360x800", "findingIds": [ "F04" ] }, { "type": "screenshot", "path": "evidence/home-dark.png", "caption": "Homepage under dark preference. The photographic hero changes as the carousel advances, while no document color-scheme is declared.", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "screenshot", "path": "evidence/home-high-contrast.png", "caption": "High-contrast preference capture; the middle consent action loses its visible label.", "condition": "prefers-contrast: more", "findingIds": [ "F02" ] }, { "type": "layout", "path": "evidence/home-mobile-layout.json", "caption": "Mobile layout metrics: no horizontal overflow and CLS 0.0053.", "condition": "360x800", "findingIds": [] }, { "type": "other", "path": "evidence/home-probe.json", "caption": "DOM, metadata, structure, form, focus, media, and feature probe.", "condition": "desktop", "findingIds": [ "F03" ] }, { "type": "other", "path": "evidence/home-dark-probe.json", "caption": "Computed dark-mode probe: color-scheme remains normal.", "condition": "prefers-color-scheme: dark", "findingIds": [ "F01" ] }, { "type": "other", "path": "evidence/home-reduced-motion-probe.json", "caption": "Reduced-motion probe: videos are paused and no active animations remain.", "condition": "prefers-reduced-motion: reduce", "findingIds": [] }, { "type": "other", "path": "evidence/home-headers.json", "caption": "Security response-header inspection.", "condition": "default", "findingIds": [ "F12" ] }, { "type": "other", "path": "evidence/home-cookies.json", "caption": "Cookie flag and lifetime inspection.", "condition": "default", "findingIds": [ "F13" ] }, { "type": "other", "path": "evidence/home-trackers.json", "caption": "Third-party and known-tracker origin inventory.", "condition": "default", "findingIds": [ "F14" ] }, { "type": "other", "path": "evidence/home-secrets.json", "caption": "Client-visible secret scan; no sensitive secrets detected.", "condition": "default", "findingIds": [] }, { "type": "screenshot", "path": "evidence/pricing-desktop.png", "caption": "Pricing page first viewport.", "condition": "desktop", "findingIds": [] }, { "type": "screenshot", "path": "evidence/podcasts-desktop.png", "caption": "Representative creator-category page.", "condition": "desktop", "findingIds": [] }, { "type": "screenshot", "path": "evidence/newsletter-desktop.png", "caption": "Representative product landing page.", "condition": "desktop", "findingIds": [] }, { "type": "screenshot", "path": "evidence/create-desktop.png", "caption": "Creator signup entry with labelled email field and identity-provider choices.", "condition": "desktop", "findingIds": [ "F15" ] }, { "type": "lighthouse", "path": "evidence/pricing-lighthouse.json", "caption": "Full Lighthouse report for the pricing page, including axe-core accessibility audits.", "condition": "mobile emulation", "findingIds": [ "F05", "F07", "F08", "F09", "F10", "F11", "F18" ] }, { "type": "other", "path": "evidence/lighthouse-summary.json", "caption": "Compact extraction of Lighthouse categories, metrics, and failing audits.", "condition": "mobile emulation", "findingIds": [ "F05", "F07", "F08", "F09", "F10", "F11", "F18" ] }, { "type": "har", "path": "evidence/pricing.har", "caption": "Pricing-page HAR retained for network inspection.", "condition": "cold load", "findingIds": [ "F06", "F14", "F18" ] }, { "type": "har-summary", "path": "evidence/pricing-summary.json", "caption": "Pricing HAR summary: 59 requests and 25.1 MB transferred, including 21.9 MB of fonts.", "condition": "cold load", "findingIds": [ "F06", "F14", "F18" ] }, { "type": "trace", "path": "evidence/pricing-trace.json", "caption": "DevTools trace for the pricing page.", "condition": "cold load", "findingIds": [] }, { "type": "trace-summary", "path": "evidence/pricing-trace-summary.json", "caption": "Trace summary: LCP 866 ms and TBT 8.8 ms in an unthrottled run.", "condition": "cold load", "findingIds": [] }, { "type": "other", "path": "evidence/raw-summary.json", "caption": "Raw HTML summary showing pricing content, title, description, and headings are server-rendered.", "condition": "Googlebot request", "findingIds": [] }, { "type": "other", "path": "evidence/robots.txt", "caption": "robots.txt with search allowed, sitemap declaration, and explicit AI crawler policy.", "condition": "direct fetch", "findingIds": [ "F16" ] }, { "type": "heap", "path": "evidence/pricing-heap-baseline.json", "caption": "Baseline heap summary for pricing: 464,148 nodes and 26.6 MB self size.", "condition": "baseline", "findingIds": [] }, { "type": "heap", "path": "evidence/pricing-heap-post.json", "caption": "Post-interaction heap after 10 disclosure-toggle cycles: 466,861 nodes and 27.3 MB self size.", "condition": "10 repeated disclosure cycles", "findingIds": [] } ], "config": { "loaded": false }, "coverage": { "catalogVersion": "modern-web-guidance@0.0.172", "catalogChecksum": "sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7", "expected": 58, "recorded": 58, "judged": 58, "blocked": 0, "notRun": 0, "missing": 0, "unknown": 0, "duplicates": 0, "complete": true }, "checkOutcomes": [ { "principleId": "respect-user-preferences", "checkId": "respects-color-scheme", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Under prefers-color-scheme: dark, the computed probe reports colorScheme \"normal\" and transparent body background rather than a dark-aware document palette.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-dark.png", "evidence/home-dark-probe.json" ], "findingIds": [ "F01" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-reduced-motion", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Reduced-motion emulation reports no active animations and all four videos paused.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-reduced-motion-probe.json" ] }, { "principleId": "respect-user-preferences", "checkId": "respects-contrast", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "The prefers-contrast: more screenshot shows the middle consent action as a blue button with no visible label, while its label is visible in the ordinary desktop capture.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-high-contrast.png", "evidence/home-desktop.png" ], "findingIds": [ "F02" ] }, { "principleId": "implement-natural-interactions", "checkId": "view-transitions", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse code coverage identifies GSAP, ScrollTrigger, and Lenis in the shared app bundle; no active ScrollTimeline was observed in the rendered probe.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/pricing-lighthouse.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "scroll-driven-animations", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse code coverage identifies GSAP, ScrollTrigger, and Lenis in the shared app bundle; no active ScrollTimeline was observed in the rendered probe.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json", "evidence/pricing-lighthouse.json" ], "findingIds": [ "F03" ] }, { "principleId": "implement-natural-interactions", "checkId": "physical-gestures", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The audited public surfaces retain native scrolling, standard buttons, dialog, and details interactions; no pointermove-only gesture was observed.", "pathIds": [ "home", "pricing" ], "artifacts": [ "evidence/home-probe.json" ] }, { "principleId": "provide-guided-navigation", "checkId": "scroll-state-aware-chrome", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Desktop and mobile captures show persistent global navigation plus explicit down-arrow scroll affordances that adapt to the viewport.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "provide-guided-navigation", "checkId": "anchored-positioning", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-route reconnaissance.", "evidence": "No tooltip, anchored popover, or edge-positioned menu was present in the representative public templates; the consent surface is a modal dialog and does not require anchoring.", "reason": "No tooltip, anchored popover, or edge-positioned menu was present in the representative public templates; the consent surface is a modal dialog and does not require anchoring." }, { "principleId": "provide-guided-navigation", "checkId": "directs-attention", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Hero arrows, down-arrow cues, descriptive navigation labels, and skip links provide visible directional and focus cues.", "pathIds": [ "home", "pricing" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "no-intrusive-interruptions", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "At 360x800 the consent surface occupies most of the lower viewport and obscures the hero copy and primary page content on first load.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png", "evidence/home-desktop.png" ], "findingIds": [ "F04" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "semantic-dismissible-primitives", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The DOM probe records four dialog elements and five details elements; consent provides explicit reject and choices actions.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-probe.json" ] }, { "principleId": "maximize-content-reduce-noise", "checkId": "reduced-chrome", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Screenshots show content-led full-bleed creator imagery and minimal application framing outside navigation and consent.", "pathIds": [ "home", "podcasts", "newsletter" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "responsive-no-horizontal-scroll", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "At 360x800, layout reports scrollWidth 360, innerWidth 360, no horizontal overflow, and a viewport meta tag.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile-layout.json" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "component-level-responsiveness", "status": "pass", "confidence": "medium", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The same global navigation and hero components visibly recompose from full desktop navigation to a mobile menu and stacked search control.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-mobile.png" ] }, { "principleId": "adapt-to-the-form-factor", "checkId": "input-modality-aware", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Lighthouse target-size audit passes; the page provides skip links and focusable native controls across mobile and desktop.", "pathIds": [ "home", "pricing", "create" ], "artifacts": [ "evidence/pricing-lighthouse.json" ] }, { "principleId": "support-core-task-success", "checkId": "clear-purpose-and-primary-action", "status": "pass", "confidence": "medium", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Home, pricing, creator-category, product, and signup captures each present a specific H1 and prominent Get Started or Continue action.", "pathIds": [ "home", "pricing", "podcasts", "newsletter", "create" ], "artifacts": [ "evidence/pricing-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "primary-flow-completion", "status": "pass", "confidence": "medium", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The public path reaches transparent pricing and a labelled creator signup entry with email and three federated identity options, without a detour before account creation.", "pathIds": [ "pricing", "create" ], "artifacts": [ "evidence/create-desktop.png" ] }, { "principleId": "support-core-task-success", "checkId": "clear-system-state-and-recovery", "status": "pass", "confidence": "medium", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The signup entry disables Continue until input, exposes help and recovery links, and the security challenge names its verification state rather than presenting a blank shell.", "pathIds": [ "create", "login" ], "artifacts": [ "evidence/create-desktop.png" ] }, { "principleId": "be-fast-and-stable", "checkId": "good-core-web-vitals", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse reports performance 56, FCP 3.3 s, LCP 13.1 s, Speed Index 15.3 s, and time to interactive 55.5 s; CLS remains good at 0.00032.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F05" ] }, { "principleId": "be-fast-and-stable", "checkId": "visual-stability", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Lighthouse reports CLS 0.00032 on pricing and the mobile layout observer reports CLS 0.0053 on home, both in the good range.", "pathIds": [ "home", "pricing" ], "artifacts": [ "evidence/lighthouse-summary.json" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-main-thread", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse estimates 534 KiB of unused JavaScript, including 88.7% of app.js, and reports 4.0 s main-thread work with 1.44 s in script evaluation.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-fast-and-stable", "checkId": "efficient-resource-delivery", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "The HAR summary records 25,087,774 transferred bytes, of which 21,890,918 bytes are six fonts; four Noto CJK variable fonts alone account for about 21.4 MB.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing.har", "evidence/pricing-summary.json" ], "findingIds": [ "F06" ] }, { "principleId": "be-fast-and-stable", "checkId": "trim-unused-and-duplicate-code", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse estimates 534 KiB of unused JavaScript, including 88.7% of app.js, and reports 4.0 s main-thread work with 1.44 s in script evaluation.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-inclusive", "checkId": "names-roles-labels", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Lighthouse accessibility is 95 and reports no names, labels, alt-text, or ARIA audit failure; signup email has a programmatic label and autocomplete=email.", "pathIds": [ "pricing", "create" ], "artifacts": [ "evidence/pricing-lighthouse.json" ] }, { "principleId": "be-inclusive", "checkId": "sufficient-contrast", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse axe-core reports ratios as low as 1.83:1 for fee details and 2.99:1 for multiple card descriptions against white, below the required 4.5:1.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F08" ] }, { "principleId": "be-inclusive", "checkId": "structure-and-focus", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse identifies the H4 \"Your world to create\" as an invalid heading-order transition; the page also exposes two separate H1 headings.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F09" ] }, { "principleId": "be-inclusive", "checkId": "legible-text", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Desktop and mobile screenshots show readable line lengths and unclipped primary text; the specific contrast defects are recorded separately.", "pathIds": [ "home", "pricing", "podcasts", "newsletter" ], "artifacts": [ "evidence/pricing-desktop.png" ] }, { "principleId": "be-inclusive", "checkId": "zoom-reflow-targets-and-media", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Mobile reflow has no overflow, viewport scaling is not disabled, Lighthouse target-size passes, and media images in the probe have alt attributes.", "pathIds": [ "home", "pricing" ], "artifacts": [ "evidence/home-mobile-layout.json" ] }, { "principleId": "follow-best-practices", "checkId": "no-console-errors", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse records a blocked XMLHttpRequest to cloudflareinsights.com/cdn-cgi/rum and a corresponding net::ERR_FAILED console error.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F10" ] }, { "principleId": "follow-best-practices", "checkId": "sound-document-and-assets", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Raw HTML has a valid title, charset-bearing Next.js document, server-rendered headings, and sized hero assets; Lighthouse does not report doctype or aspect-ratio failures.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/raw-summary.json" ] }, { "principleId": "follow-best-practices", "checkId": "browser-platform-hygiene", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse reports app.js without a source map and several Next.js chunk maps with missing sourcesContent entries.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F11" ] }, { "principleId": "be-discoverable", "checkId": "title-and-description", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "All five public templates inspected expose unique descriptive titles and meta descriptions.", "pathIds": [ "home", "pricing", "podcasts", "newsletter", "create" ], "artifacts": [ "evidence/raw-summary.json" ] }, { "principleId": "be-discoverable", "checkId": "crawlable-and-mobile-friendly", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The raw pricing HTML contains meaningful navigation and pricing content, real href links, a viewport meta tag, robots search allowance, and sitemap declaration.", "pathIds": [ "home", "pricing" ], "artifacts": [ "evidence/raw-summary.json" ] }, { "principleId": "be-discoverable", "checkId": "canonical-and-indexing-signals", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Both rendered probes and the 200 raw pricing HTML contain no rel=canonical, although 20 hreflang links, search-allowing robots rules, and a sitemap are present.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/raw-summary.json", "evidence/robots.txt" ], "findingIds": [ "F16" ] }, { "principleId": "be-discoverable", "checkId": "structured-and-shareable-metadata", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "The rendered and raw probes find seven Open Graph tags and zero JSON-LD blocks on the pricing template.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/raw-summary.json", "evidence/home-probe.json" ], "findingIds": [ "F17" ] }, { "principleId": "be-private-and-secure", "checkId": "secure-transport-and-headers", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "The header probe finds no Content-Security-Policy, no X-Frame-Options or observed frame-ancestors policy, no Permissions-Policy, and HSTS max-age of only 30 days. The cookie probe reports analytics_session_id and patreon_currency_pref without Secure; patreon_device_id is retained for 400 days; all five observed cookies have SameSite=None.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-headers.json", "evidence/home-cookies.json" ], "findingIds": [ "F12", "F13" ] }, { "principleId": "be-private-and-secure", "checkId": "data-minimisation-and-third-parties", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "The HAR records 27 third-party requests and 2.35 MB from third-party origins; the tracker probe observes Google Tag Manager, Google Analytics, Sentry, and ten third-party origins.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/home-trackers.json", "evidence/pricing.har", "evidence/pricing-summary.json" ], "findingIds": [ "F14" ] }, { "principleId": "be-private-and-secure", "checkId": "in-context-permissions-and-modern-auth", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "The signup DOM exposes Google, Apple, Facebook, email, and current-password controls; no WebAuthn or passkey action is present in the audited entry state.", "pathIds": [ "create" ], "artifacts": [ "evidence/create-desktop.png" ], "findingIds": [ "F15" ] }, { "principleId": "be-private-and-secure", "checkId": "defensive-browser-policies", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "The header probe finds no Content-Security-Policy, no X-Frame-Options or observed frame-ancestors policy, no Permissions-Policy, and HSTS max-age of only 30 days.", "pathIds": [ "home" ], "artifacts": [ "evidence/home-headers.json" ], "findingIds": [ "F12" ] }, { "principleId": "be-resilient", "checkId": "progressive-enhancement", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "A Googlebot raw request returns HTTP 200 with 250,628 bytes, pricing title, two H1 elements, descriptive content, and navigation before JavaScript.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/raw-summary.json" ] }, { "principleId": "be-resilient", "checkId": "resilient-runtime-behaviour", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Representative navigation, dialogs, details, mobile reflow, and signup controls render without clipping in the retained captures.", "pathIds": [ "home", "pricing", "create" ], "artifacts": [ "evidence/home-mobile.png" ] }, { "principleId": "be-resilient", "checkId": "offline-and-installable", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-route reconnaissance.", "evidence": "The audited surfaces are public marketing and signup entry pages rather than an installable application shell; offline installation is not a core task for these templates.", "reason": "The audited surfaces are public marketing and signup entry pages rather than an installable application shell; offline installation is not a core task for these templates." }, { "principleId": "be-resilient", "checkId": "network-and-http-failure-states", "status": "pass", "confidence": "medium", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The login route presents a named Cloudflare security-verification state with explanatory copy rather than a blank or misleading success state.", "pathIds": [ "login" ], "artifacts": [ "evidence/create-desktop.png" ] }, { "principleId": "be-internationalised", "checkId": "lang-dir-and-logical-properties", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Rendered HTML declares lang=en, while the site exposes locale-aware regional navigation and 20 hreflang alternatives in raw pricing HTML.", "pathIds": [ "home", "pricing" ], "artifacts": [ "evidence/home-probe.json" ] }, { "principleId": "be-internationalised", "checkId": "locale-aware-data", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Pricing uses percentage and currency-aware copy, the region selector contains 238 options, and raw HTML exposes 20 localized alternatives.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/raw-summary.json" ] }, { "principleId": "be-internationalised", "checkId": "time-zone-correctness", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-route reconnaissance.", "evidence": "The representative public marketing, pricing, and signup surfaces expose no event times or other time-zone-sensitive data to evaluate.", "reason": "The representative public marketing, pricing, and signup surfaces expose no event times or other time-zone-sensitive data to evaluate." }, { "principleId": "be-trustworthy", "checkId": "no-dark-patterns", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Consent gives Accept all and Reject non-essential equal button prominence; pricing states 10% plus processing and applicable fees; signup discloses terms and email sharing.", "pathIds": [ "home", "pricing", "create" ], "artifacts": [ "evidence/home-desktop.png" ] }, { "principleId": "be-trustworthy", "checkId": "humane-error-handling", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The signup uses a labelled required email input, native email validity, a disabled initial Continue state, and a help link.", "pathIds": [ "create" ], "artifacts": [ "evidence/create-desktop.png" ] }, { "principleId": "be-trustworthy", "checkId": "trustworthy-input-assistance", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Signup DOM uses autocomplete=email and autocomplete=current-password with associated labels.", "pathIds": [ "create" ], "artifacts": [ "evidence/create-desktop.png" ] }, { "principleId": "be-trustworthy", "checkId": "safe-commercial-and-account-flows", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "Pricing visibly states the 10% platform fee and additional fee categories before signup; account terms, privacy, and email-sharing consequences are disclosed.", "pathIds": [ "pricing", "create" ], "artifacts": [ "evidence/pricing-desktop.png" ] }, { "principleId": "be-sustainable", "checkId": "optimised-assets", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse estimates 1,354 KiB savings: the PNG hero wastes about 749 KiB and a 95x95 animated logo transfers about 639 KiB.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/pricing-summary.json" ], "findingIds": [ "F18" ] }, { "principleId": "be-sustainable", "checkId": "no-wasteful-work", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "Lighthouse estimates 534 KiB of unused JavaScript, including 88.7% of app.js, and reports 4.0 s main-thread work with 1.44 s in script evaluation.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "findingIds": [ "F07" ] }, { "principleId": "be-sustainable", "checkId": "third-party-and-media-budget", "status": "issues", "confidence": "high", "method": "Targeted visual, DOM, Lighthouse, HAR, header, cookie, or runtime evidence as cited.", "evidence": "The HAR summary records 25,087,774 transferred bytes, of which 21,890,918 bytes are six fonts; four Noto CJK variable fonts alone account for about 21.4 MB. The HAR records 27 third-party requests and 2.35 MB from third-party origins; the tracker probe observes Google Tag Manager, Google Analytics, Sentry, and ten third-party origins.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing.har", "evidence/pricing-summary.json", "evidence/home-trackers.json" ], "findingIds": [ "F06", "F14" ] }, { "principleId": "be-agent-ready", "checkId": "structured-agent-capabilities", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-route reconnaissance.", "evidence": "No declared agent-facing intent was found. This emerging capability is not required for the audited public marketing and signup scope.", "reason": "No declared agent-facing intent was found. This emerging capability is not required for the audited public marketing and signup scope." }, { "principleId": "be-agent-ready", "checkId": "on-device-inference", "status": "not-applicable", "confidence": "high", "method": "Applicability judgement from representative-route reconnaissance.", "evidence": "No user task in the audited public marketing and signup scope would clearly benefit from built-in on-device inference.", "reason": "No user task in the audited public marketing and signup scope would clearly benefit from built-in on-device inference." }, { "principleId": "be-memory-efficient", "checkId": "no-leak-under-repeated-interaction", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "After 10 complete details open/close cycles, heap self size is 27.29 MB versus 26.62 MB baseline and closures slightly decrease; the modest 2.5% delta does not show unbounded retained growth.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-heap-post.json" ] }, { "principleId": "be-memory-efficient", "checkId": "bounded-footprint", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "The baseline pricing heap is 26.62 MB self size; Lighthouse reports 1,297 DOM elements with depth 15, proportionate to a long marketing page.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-heap-baseline.json" ] }, { "principleId": "be-memory-efficient", "checkId": "no-detached-dom-or-unbounded-listeners", "status": "pass", "confidence": "high", "method": "Direct inspection using the cited artifact and representative paths.", "evidence": "No Detached constructor appears among the retained top constructors; arrays, objects, and closures do not increase after repeated disclosure toggles.", "pathIds": [ "pricing" ], "artifacts": [ "evidence/pricing-heap-post.json" ] } ], "principleOutcomes": [ { "principleId": "respect-user-preferences", "expectation": "default", "status": "issues", "findingIds": [ "F01", "F02" ] }, { "principleId": "implement-natural-interactions", "expectation": "default", "status": "issues", "findingIds": [ "F03" ] }, { "principleId": "provide-guided-navigation", "expectation": "default", "status": "pass" }, { "principleId": "maximize-content-reduce-noise", "expectation": "default", "status": "issues", "findingIds": [ "F04" ] }, { "principleId": "adapt-to-the-form-factor", "expectation": "default", "status": "pass" }, { "principleId": "support-core-task-success", "expectation": "default", "status": "pass" }, { "principleId": "be-fast-and-stable", "expectation": "default", "status": "issues", "findingIds": [ "F05", "F07", "F06" ] }, { "principleId": "be-inclusive", "expectation": "default", "status": "issues", "findingIds": [ "F08", "F09" ] }, { "principleId": "follow-best-practices", "expectation": "default", "status": "issues", "findingIds": [ "F10", "F11" ] }, { "principleId": "be-discoverable", "expectation": "default", "status": "issues", "findingIds": [ "F16", "F17" ] }, { "principleId": "be-private-and-secure", "expectation": "default", "status": "issues", "findingIds": [ "F12", "F13", "F14", "F15" ] }, { "principleId": "be-resilient", "expectation": "contextual", "status": "pass" }, { "principleId": "be-internationalised", "expectation": "contextual", "status": "pass" }, { "principleId": "be-trustworthy", "expectation": "default", "status": "pass" }, { "principleId": "be-sustainable", "expectation": "contextual", "status": "issues", "findingIds": [ "F18", "F07", "F06", "F14" ] }, { "principleId": "be-agent-ready", "expectation": "contextual", "status": "not-applicable", "reason": "No declared agent-facing intent was found. This emerging capability is not required for the audited public marketing and signup scope. No user task in the audited public marketing and signup scope would clearly benefit from built-in on-device inference." }, { "principleId": "be-memory-efficient", "expectation": "default", "status": "pass" } ], "paths": [ { "id": "home", "description": "Public marketing homepage, including global navigation, hero carousel, consent UI, dark/reduced-motion/high-contrast conditions, and mobile reflow.", "url": "https://www.patreon.com/", "conditions": [ "desktop 1440x1000", "mobile 360x800", "prefers-color-scheme: dark", "prefers-reduced-motion: reduce", "prefers-contrast: more", "keyboard focus sample" ], "result": "issues" }, { "id": "pricing", "description": "Pricing archetype and primary commercial decision surface; used for performance, network, accessibility, metadata, and memory evidence.", "url": "https://www.patreon.com/pricing", "conditions": [ "desktop", "Lighthouse mobile emulation", "raw HTML/no JavaScript", "10 repeated disclosure toggles" ], "result": "issues" }, { "id": "podcasts", "description": "Representative creator-category landing template.", "url": "https://www.patreon.com/creators/podcasts", "conditions": [ "desktop" ], "result": "pass" }, { "id": "newsletter", "description": "Representative product/detail landing template.", "url": "https://www.patreon.com/product/newsletter", "conditions": [ "desktop" ], "result": "pass" }, { "id": "create", "description": "Creator signup entry and account form, including labels, autocomplete, pricing/terms disclosure, and identity-provider choices.", "url": "https://www.patreon.com/create", "conditions": [ "desktop", "form DOM inspection" ], "result": "pass" }, { "id": "login", "description": "Login route reconnaissance. Cloudflare verification appeared in the independent login capture, so login-specific observations were not used to claim flow completion.", "url": "https://www.patreon.com/login", "conditions": [ "desktop" ], "result": "failed" } ], "findings": [ { "id": "F01", "pathId": "home", "url": "https://www.patreon.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-color-scheme", "guidanceId": "dark-mode", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "The public marketing surface does not declare or adapt a document color scheme.", "evidence": "Under prefers-color-scheme: dark, the computed probe reports colorScheme \"normal\" and transparent body background rather than a dark-aware document palette.", "artifacts": [ "evidence/home-dark.png", "evidence/home-dark-probe.json" ], "suggestedFix": "Declare color-scheme: light dark and express non-photographic surfaces, dialogs, text, and controls with preference-aware color tokens or light-dark().", "effort": "medium" }, { "id": "F02", "pathId": "home", "url": "https://www.patreon.com/", "principleId": "respect-user-preferences", "principleCheckId": "respects-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "The consent dialog is not robust under increased contrast.", "evidence": "The prefers-contrast: more screenshot shows the middle consent action as a blue button with no visible label, while its label is visible in the ordinary desktop capture.", "artifacts": [ "evidence/home-high-contrast.png", "evidence/home-desktop.png" ], "suggestedFix": "Use system-aware foreground/background tokens for all consent actions, test forced colors, and preserve text with forced-color-adjust only where strictly necessary.", "effort": "small" }, { "id": "F03", "pathId": "home", "url": "https://www.patreon.com/", "principleId": "implement-natural-interactions", "principleCheckId": "scroll-driven-animations", "guidanceId": "scrollytelling", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "The marketing bundle relies on main-thread animation libraries instead of a declarative motion baseline.", "evidence": "Lighthouse code coverage identifies GSAP, ScrollTrigger, and Lenis in the shared app bundle; no active ScrollTimeline was observed in the rendered probe.", "artifacts": [ "evidence/home-probe.json", "evidence/pricing-lighthouse.json" ], "suggestedFix": "Move scroll-linked effects to CSS scroll-driven animations, use native scrolling rather than Lenis where possible, and use View Transitions for state or route changes with reduced-motion fallbacks.", "effort": "large" }, { "id": "F04", "pathId": "home", "url": "https://www.patreon.com/", "principleId": "maximize-content-reduce-noise", "principleCheckId": "no-intrusive-interruptions", "guidanceId": "light-dismiss-a-dialog", "guidanceCategory": "user-experience", "severity": "medium", "confidence": "high", "summary": "The cookie dialog dominates the first mobile viewport.", "evidence": "At 360x800 the consent surface occupies most of the lower viewport and obscures the hero copy and primary page content on first load.", "artifacts": [ "evidence/home-mobile.png", "evidence/home-desktop.png" ], "suggestedFix": "Use a compact, content-first consent surface while retaining equally prominent accept and reject actions and a clear path to detailed choices.", "effort": "medium" }, { "id": "F05", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-fast-and-stable", "principleCheckId": "good-core-web-vitals", "guidanceId": "performance", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "The throttled mobile load misses the LCP performance bar by a wide margin.", "evidence": "Lighthouse reports performance 56, FCP 3.3 s, LCP 13.1 s, Speed Index 15.3 s, and time to interactive 55.5 s; CLS remains good at 0.00032.", "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Prioritise the LCP image, stop lazy-loading above-the-fold hero media, reduce font and script competition, and shorten critical request chains.", "effort": "large" }, { "id": "F06", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-fast-and-stable", "principleCheckId": "efficient-resource-delivery", "guidanceId": "optimize-preload-priority", "guidanceCategory": "performance", "severity": "high", "confidence": "high", "summary": "The pricing page transfers an extraordinary font payload.", "evidence": "The HAR summary records 25,087,774 transferred bytes, of which 21,890,918 bytes are six fonts; four Noto CJK variable fonts alone account for about 21.4 MB.", "artifacts": [ "evidence/pricing.har", "evidence/pricing-summary.json" ], "suggestedFix": "Subset fonts by locale and script, load only the active locale, apply font-display, and avoid shipping SC, TC, JP, and KR font families to every visitor.", "effort": "large" }, { "id": "F07", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-fast-and-stable", "principleCheckId": "trim-unused-and-duplicate-code", "guidanceId": "identify-heavy-scripts", "guidanceCategory": "performance", "severity": "medium", "confidence": "high", "summary": "The page ships substantial unused JavaScript and expensive shared animation code.", "evidence": "Lighthouse estimates 534 KiB of unused JavaScript, including 88.7% of app.js, and reports 4.0 s main-thread work with 1.44 s in script evaluation.", "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Split marketing routes by template, remove unused parsers and animation libraries from the pricing entry, and defer analytics and consent implementation code until needed.", "effort": "large" }, { "id": "F08", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-inclusive", "principleCheckId": "sufficient-contrast", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "high", "confidence": "high", "summary": "Pricing details and supporting copy fail minimum text contrast.", "evidence": "Lighthouse axe-core reports ratios as low as 1.83:1 for fee details and 2.99:1 for multiple card descriptions against white, below the required 4.5:1.", "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Darken secondary text tokens and verify every pricing-card state at 4.5:1 for normal text, including links and disabled-looking copy that remains essential.", "effort": "small" }, { "id": "F09", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-inclusive", "principleCheckId": "structure-and-focus", "guidanceId": "accessibility", "guidanceCategory": "accessibility", "severity": "medium", "confidence": "high", "summary": "The pricing page contains an invalid heading-level jump.", "evidence": "Lighthouse identifies the H4 \"Your world to create\" as an invalid heading-order transition; the page also exposes two separate H1 headings.", "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Use one page-level H1 and derive all section heading levels from document structure rather than visual size.", "effort": "small" }, { "id": "F10", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "follow-best-practices", "principleCheckId": "no-console-errors", "guidanceId": "html", "guidanceCategory": "html", "severity": "low", "confidence": "high", "summary": "The page emits a Cloudflare RUM CORS error during load.", "evidence": "Lighthouse records a blocked XMLHttpRequest to cloudflareinsights.com/cdn-cgi/rum and a corresponding net::ERR_FAILED console error.", "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Correct the RUM endpoint CORS setup or suppress the request when it cannot succeed so production pages load without console errors.", "effort": "small" }, { "id": "F11", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "follow-best-practices", "principleCheckId": "browser-platform-hygiene", "guidanceId": "html", "guidanceCategory": "html", "severity": "low", "confidence": "high", "summary": "Production JavaScript has missing or incomplete source maps.", "evidence": "Lighthouse reports app.js without a source map and several Next.js chunk maps with missing sourcesContent entries.", "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/lighthouse-summary.json" ], "suggestedFix": "Publish valid protected production source maps to the error-monitoring pipeline and ensure chunk maps contain resolvable sources.", "effort": "small" }, { "id": "F12", "pathId": "home", "url": "https://www.patreon.com/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "severity": "high", "confidence": "high", "summary": "Important browser-enforced security policies are absent.", "evidence": "The header probe finds no Content-Security-Policy, no X-Frame-Options or observed frame-ancestors policy, no Permissions-Policy, and HSTS max-age of only 30 days.", "artifacts": [ "evidence/home-headers.json" ], "suggestedFix": "Deploy a nonce- or hash-based CSP with frame-ancestors, extend HSTS after rollout validation, and add a least-privilege Permissions-Policy.", "effort": "large" }, { "id": "F13", "pathId": "home", "url": "https://www.patreon.com/", "principleId": "be-private-and-secure", "principleCheckId": "secure-transport-and-headers", "guidanceId": "security", "guidanceCategory": "security", "severity": "medium", "confidence": "high", "summary": "Two first-party cookies lack Secure and all observed cookies use SameSite=None.", "evidence": "The cookie probe reports analytics_session_id and patreon_currency_pref without Secure; patreon_device_id is retained for 400 days; all five observed cookies have SameSite=None.", "artifacts": [ "evidence/home-cookies.json" ], "suggestedFix": "Set Secure on every HTTPS cookie, use Lax or Strict unless cross-site delivery is required, shorten device identifiers, and document each SameSite=None exception.", "effort": "small" }, { "id": "F14", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-private-and-secure", "principleCheckId": "data-minimisation-and-third-parties", "guidanceId": "privacy", "guidanceCategory": "privacy", "severity": "medium", "confidence": "high", "summary": "The public page has a broad third-party and analytics footprint.", "evidence": "The HAR records 27 third-party requests and 2.35 MB from third-party origins; the tracker probe observes Google Tag Manager, Google Analytics, Sentry, and ten third-party origins.", "artifacts": [ "evidence/home-trackers.json", "evidence/pricing.har", "evidence/pricing-summary.json" ], "suggestedFix": "Gate non-essential tags until consent, remove duplicate telemetry, self-host essential assets where justified, and batch minimal analytics events.", "effort": "medium" }, { "id": "F15", "pathId": "create", "url": "https://www.patreon.com/create", "principleId": "be-private-and-secure", "principleCheckId": "in-context-permissions-and-modern-auth", "guidanceId": "passkeys", "guidanceCategory": "security", "severity": "medium", "confidence": "medium", "summary": "The visible creator signup offers federated identity and passwords but no phishing-resistant passkey path.", "evidence": "The signup DOM exposes Google, Apple, Facebook, email, and current-password controls; no WebAuthn or passkey action is present in the audited entry state.", "artifacts": [ "evidence/create-desktop.png" ], "suggestedFix": "Add passkey creation and authentication as a first-class option, retaining federated sign-in and password recovery as compatible fallbacks.", "effort": "large" }, { "id": "F16", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-discoverable", "principleCheckId": "canonical-and-indexing-signals", "guidanceId": "html", "guidanceCategory": "html", "severity": "medium", "confidence": "high", "summary": "Public marketing pages omit canonical URLs.", "evidence": "Both rendered probes and the 200 raw pricing HTML contain no rel=canonical, although 20 hreflang links, search-allowing robots rules, and a sitemap are present.", "artifacts": [ "evidence/raw-summary.json", "evidence/robots.txt" ], "suggestedFix": "Emit a self-referencing canonical for every indexable marketing template and keep canonical, hreflang, sitemap, and redirect targets consistent.", "effort": "small" }, { "id": "F17", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-discoverable", "principleCheckId": "structured-and-shareable-metadata", "guidanceId": "html", "guidanceCategory": "html", "severity": "low", "confidence": "high", "summary": "The pricing and organization surfaces have social metadata but no structured data.", "evidence": "The rendered and raw probes find seven Open Graph tags and zero JSON-LD blocks on the pricing template.", "artifacts": [ "evidence/raw-summary.json", "evidence/home-probe.json" ], "suggestedFix": "Add accurate Organization and service or offer structured data that matches the visible pricing content, and validate it with a structured-data tester.", "effort": "small" }, { "id": "F18", "pathId": "pricing", "url": "https://www.patreon.com/pricing", "principleId": "be-sustainable", "principleCheckId": "optimised-assets", "guidanceId": "deliver-optimized-decorative-images", "guidanceCategory": "performance", "severity": "medium", "confidence": "high", "summary": "Hero and decorative images waste more than a megabyte on mobile.", "evidence": "Lighthouse estimates 1,354 KiB savings: the PNG hero wastes about 749 KiB and a 95x95 animated logo transfers about 639 KiB.", "artifacts": [ "evidence/pricing-lighthouse.json", "evidence/pricing-summary.json" ], "suggestedFix": "Serve AVIF or WebP hero variants sized to the rendered breakpoint, compress the animated logo aggressively, and avoid lazy-loading the above-the-fold LCP image.", "effort": "medium" } ], "taskList": [ { "id": "T01", "title": "Stop shipping all CJK font families and prioritise the true LCP asset", "priority": 1, "findingIds": [ "F05", "F06" ], "guidanceId": "optimize-preload-priority", "status": "open" }, { "id": "T02", "title": "Restore WCAG contrast in pricing cards and high-contrast consent states", "priority": 2, "findingIds": [ "F02", "F08" ], "guidanceId": "accessibility", "status": "open" }, { "id": "T03", "title": "Deploy CSP, clickjacking protection, stronger HSTS, and Permissions-Policy", "priority": 3, "findingIds": [ "F12" ], "guidanceId": "security", "status": "open" }, { "id": "T04", "title": "Correct cookie flags and minimise the analytics footprint", "priority": 4, "findingIds": [ "F13", "F14" ], "guidanceId": "privacy", "status": "open" }, { "id": "T05", "title": "Split route JavaScript and replace main-thread scroll animation infrastructure", "priority": 5, "findingIds": [ "F03", "F07" ], "guidanceId": "identify-heavy-scripts", "status": "open" }, { "id": "T06", "title": "Optimise responsive hero and decorative media", "priority": 6, "findingIds": [ "F18" ], "guidanceId": "deliver-optimized-decorative-images", "status": "open" }, { "id": "T07", "title": "Add passkey registration and authentication", "priority": 7, "findingIds": [ "F15" ], "guidanceId": "passkeys", "status": "open" }, { "id": "T08", "title": "Fix canonical, structured metadata, and heading hierarchy", "priority": 8, "findingIds": [ "F09", "F16", "F17" ], "guidanceId": "html", "status": "open" }, { "id": "T09", "title": "Make consent compact on mobile without weakening choice", "priority": 9, "findingIds": [ "F04" ], "guidanceId": "light-dismiss-a-dialog", "status": "open" }, { "id": "T10", "title": "Add dark-scheme tokens and declare color-scheme", "priority": 10, "findingIds": [ "F01" ], "guidanceId": "dark-mode", "status": "open" }, { "id": "T11", "title": "Repair telemetry CORS and production source maps", "priority": 11, "findingIds": [ "F10", "F11" ], "guidanceId": "html", "status": "open" } ], "budget": { "pathCount": 6, "auditPasses": 1 }, "agent": "pi", "runId": "2026-07-28T11-20-19-819Z" }