Manifest position 368 · CrUX rank bucket 1000

https://nid.naver.com

Partial after retries

57 of 58 atomic checks were judged. End-to-end authentication was blocked because no safe test account/credentials were available.

Attempts

3 / 3

Judged checks

57 / 58

Blocked

Not run

This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.

All 58 atomic check outcomes

Principle / check	Status	Confidence	Evidence or reason
respect-user-preferences `respects-color-scheme`	issues	high	Light/default and dark captures are identical; root color-scheme is normal and no preference CSS was detected. F-001 medium: The sign-in surface forces the same dark palette regardless of the system colour preference.
respect-user-preferences `respects-reduced-motion`	pass	high	Under prefers-reduced-motion: reduce, getAnimations() returned no active animations; the static sign-in flow contains no auto-advance motion.
respect-user-preferences `respects-contrast`	issues	high	Lighthouse directly measured 2.99:1 action-text contrast, and no forced-colors/prefers-contrast adaptation was detected. F-002 high: Primary action text does not meet WCAG contrast requirements.
implement-natural-interactions `view-transitions`	issues	high	Feature inspection found no View Transition CSS and route screenshots show abrupt full-page state changes. F-014 low: Public account-route changes are abrupt and provide no continuity cue.
implement-natural-interactions `scroll-driven-animations`	not-applicable	high	The representative authentication surfaces contain no parallax, scrollytelling, carousel, or scroll-linked motion to implement.
implement-natural-interactions `physical-gestures`	pass	high	The tested surfaces use native scrolling, links, buttons, checkboxes, and text inputs without custom pointer-drag handlers.
provide-guided-navigation `scroll-state-aware-chrome`	not-applicable	high	The short sign-in and recovery views have no sticky/affixed chrome or long-scroll journey requiring scroll-state adaptation.
provide-guided-navigation `anchored-positioning`	not-applicable	high	No tooltip, popover, context menu, or floating anchored overlay appears on the representative views.
provide-guided-navigation `directs-attention`	issues	high	Focused credential fields have no computed outline or replacement shadow, reducing the visual cue for moved keyboard attention. F-003 high: Keyboard focus is not visibly indicated on the credential fields and several icon controls.
maximize-content-reduce-noise `no-intrusive-interruptions`	pass	high	Load screenshots across sign-in, recovery, and sign-up show no popup, interstitial, consent wall, or content-obscuring banner.
maximize-content-reduce-noise `semantic-dismissible-primitives`	pass	high	No modal or transient overlay is present; disclosures on sign-up are embedded controls rather than full-screen custom overlays.
maximize-content-reduce-noise `reduced-chrome`	pass	high	Screenshots show a focused, single-column task surface with minimal branding and no competing promotional chrome.
adapt-to-the-form-factor `responsive-no-horizontal-scroll`	pass	high	At 360x800 the layout primitive measured scrollWidth=clientWidth=360 and zero horizontal overflow; all three public flows fit the viewport.
adapt-to-the-form-factor `component-level-responsiveness`	pass	high	The sign-in form changes from a centered 600px desktop surface to a fluid mobile layout without clipping; the representative component adapts successfully despite no exposed @container rules.
adapt-to-the-form-factor `input-modality-aware`	issues	high	Focus probes found invisible focus on credential inputs and several controls/links are below 44px target size. F-003 high: Keyboard focus is not visibly indicated on the credential fields and several icon controls. F-004 medium: User zoom is disabled and several text links and icon controls are smaller than 44px.
support-core-task-success `clear-purpose-and-primary-action`	pass	high	First-view screenshots clearly label Sign in, Find your ID, and terms agreement, with a visually dominant next action.
support-core-task-success `primary-flow-completion`	blocked	high	End-to-end authentication could not be completed without a valid NAVER test account and credentials; submitting unknown credentials would be unsafe.
support-core-task-success `clear-system-state-and-recovery`	pass	high	Blank sign-in submission focuses the identity field and exposes a role=alert message; Forgot ID is reachable and the 404 view offers a return action.
be-fast-and-stable `good-core-web-vitals`	issues	high	Lighthouse LCP was 3.3s with Speed Index 7.7s and TBT 250ms; independent trace LCP was 3.04s. F-005 high: The mobile sign-in load misses the good LCP range and has a slow visual completion.
be-fast-and-stable `visual-stability`	pass	high	CLS was 0.087 in Lighthouse and 0.094 in the mobile layout observer, both within the good <0.1 range; all images have dimensions.
be-fast-and-stable `efficient-main-thread`	issues	high	Trace and Lighthouse recorded long tasks/TBT, including two tasks over 80ms. F-006 medium: Startup scripting creates avoidable blocking work.
be-fast-and-stable `efficient-resource-delivery`	issues	high	HAR recorded 4.5MB transferred, 3.12MB fonts, uncompressed scripts, missing cache headers, and a three-hop redirect. F-007 high: A simple sign-in view transfers 4.5MB, dominated by four very large font files.
be-fast-and-stable `trim-unused-and-duplicate-code`	issues	high	Lighthouse estimated 268KiB unused JavaScript across passkey, app-scheme, CAPTCHA, and telemetry modules. F-008 medium: The entry page ships substantial JavaScript that is unused during the tested load.
be-inclusive `names-roles-labels`	issues	high	Lighthouse and images inspection found three social-login images lacking alt/decorative semantics. F-009 medium: Three social sign-in images have no alt attribute or decorative semantics.
be-inclusive `sufficient-contrast`	issues	high	Lighthouse measured 2.99:1 contrast on primary action text. F-002 high: Primary action text does not meet WCAG contrast requirements.
be-inclusive `structure-and-focus`	issues	high	Credential inputs and icon controls show no computed focus outline or replacement shadow. F-003 high: Keyboard focus is not visibly indicated on the credential fields and several icon controls.
be-inclusive `legible-text`	pass	high	Desktop/mobile screenshots show readable line lengths, unclipped labels, consistent left alignment, and no text overlap on the tested surfaces.
be-inclusive `zoom-reflow-targets-and-media`	issues	high	Viewport metadata disables scaling and target inspection found multiple sub-44px controls/links. F-004 medium: User zoom is disabled and several text links and icon controls are smaller than 44px.
follow-best-practices `no-console-errors`	pass	high	Lighthouse errors-in-console audit passed with no captured errors.
follow-best-practices `sound-document-and-assets`	pass	high	DOM/Lighthouse confirm HTML doctype, UTF-8 charset, correctly dimensioned SVG images, and no image aspect-ratio problems.
follow-best-practices `browser-platform-hygiene`	pass	high	Lighthouse found no deprecated API, geolocation-on-load, or notification-on-load issue; BFCache no-store behavior is appropriate for a sensitive authentication document.
be-discoverable `title-and-description`	issues	high	The title is descriptive, but DOM, discoverability, and Lighthouse all found no meta description. F-016 low: The public sign-in document has no meta description.
be-discoverable `crawlable-and-mobile-friendly`	pass	high	Links use real href values, viewport metadata is present, robots.txt returns 200 with explicit identity-surface rules, and Lighthouse crawlable-anchor/link-text audits pass.
be-discoverable `canonical-and-indexing-signals`	issues	high	The root uses a three-hop redirect into a parameterized login URL, no canonical link is present, and /sitemap.xml returns 404. F-017 low: The public entry chain has no canonical signal or sitemap endpoint.
be-discoverable `structured-and-shareable-metadata`	not-applicable	high	A private sign-in/account recovery surface is not a shareable article, product, organization, event, or other rich public entity.
be-private-and-secure `secure-transport-and-headers`	issues	high	HTTPS/HSTS/nosniff/frame protection are present, but two cookies lack Secure, SameSite=None is widespread, CSP allows unsafe-inline, and Permissions-Policy is missing. F-010 high: The authentication origin sets cookies without Secure and weakens its otherwise strong security-header posture.
be-private-and-secure `data-minimisation-and-third-parties`	issues	high	Thirty third-party requests across eight origins transfer 3.72MB before authentication. F-011 medium: The sign-in page has a broad third-party and telemetry footprint before authentication.
be-private-and-secure `in-context-permissions-and-modern-auth`	pass	high	Lighthouse found no permission prompts on load, and the page loads a dedicated passkey/WebAuthn module alongside password login.
be-private-and-secure `defensive-browser-policies`	issues	high	HSTS, X-Frame-Options and Referrer-Policy are present, but Permissions-Policy is absent and CSP retains unsafe-inline. F-010 high: The authentication origin sets cookies without Secure and weakens its otherwise strong security-header posture.
be-resilient `progressive-enhancement`	pass	high	Discoverability comparison reports 100% rendered content coverage in raw HTML, isJsShell=false, and title/H1 survive without JavaScript.
be-resilient `resilient-runtime-behaviour`	pass	high	Representative forms and disclosures render without clipped overlays; native links/buttons preserve simple navigation state.
be-resilient `offline-and-installable`	not-applicable	high	Authentication and account recovery intrinsically require an online identity service; no offline completion promise is reasonable.
be-resilient `network-and-http-failure-states`	pass	high	A deliberately invalid route renders a clear error page with explanatory text and a return button rather than a blank shell.
be-internationalised `lang-dir-and-logical-properties`	issues	medium	Language attributes are present, but no logical CSS properties were detected and the English sign-up outline contains Korean headings. F-012 low: The localized account surfaces do not demonstrate writing-mode-resilient layout primitives.
be-internationalised `locale-aware-data`	not-applicable	high	The representative public identity surfaces render no dates, currency, numbers, durations, or calendars requiring locale formatting.
be-internationalised `time-zone-correctness`	not-applicable	high	No time, event, recurrence, or time-zone-dependent data appears in the tested public flows.
be-trustworthy `no-dark-patterns`	pass	high	Stay Signed in is not preselected, terms begin unchecked, optional terms are visibly marked, and recovery/signup actions are plainly labeled.
be-trustworthy `humane-error-handling`	pass	high	Blank submission waits for interaction, focuses the ID field, and exposes “Please enter your ID or phone number” in a role=alert element.
be-trustworthy `trustworthy-input-assistance`	issues	high	The username/phone and password controls both have empty autocomplete values. F-013 high: The sign-in fields omit standard autocomplete tokens.
be-trustworthy `safe-commercial-and-account-flows`	pass	high	Forgot ID/password and sign-up are prominent, optional consent is distinct, IP Security state is explicit, and passkey support is loaded.
be-sustainable `optimised-assets`	pass	high	All three raster-equivalent assets are lightweight SVGs with explicit dimensions and no oversized-image signal.
be-sustainable `no-wasteful-work`	issues	high	The small form loads 4.5MB and 30 third-party requests, including modules unused in the tested entry state. F-007 high: A simple sign-in view transfers 4.5MB, dominated by four very large font files. F-011 medium: The sign-in page has a broad third-party and telemetry footprint before authentication.
be-sustainable `third-party-and-media-budget`	issues	high	The 3.12MB font and 3.72MB third-party footprint is disproportionate to a small form UI. F-015 medium: Font and third-party transfer cost is disproportionate to the small authentication UI.
be-agent-ready `structured-agent-capabilities`	not-applicable	high	No agent-facing surface is intended; exposing authentication actions to agents without an explicit safe delegation design would be inappropriate.
be-agent-ready `on-device-inference`	not-applicable	high	The public identity flows have no summarisation, generation, or language-model task where on-device inference would improve the experience.
be-memory-efficient `no-leak-under-repeated-interaction`	pass	medium	An evaluate probe repeated ten tab/focus cycles and observed zero change in usedJSHeapSize and DOM element count during the interaction window.
be-memory-efficient `bounded-footprint`	pass	medium	The baseline heap summary reported 15.30MB total self size for the authentication page, proportionate to the tested page and without a dominant application object population.
be-memory-efficient `no-detached-dom-or-unbounded-listeners`	pass	medium	Ten repeated tab/focus cycles left the DOM count unchanged at 187; baseline/post summary samples did not show a growing Detached* constructor population.

Provenance

Canonical report: results/atomic/reports/0368-nid_naver_com.json
Report SHA-256: 679ea4ed2540a1da0032fd5a30ea87aafd970e87b810d34000ff3aa8e9f47c4a
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/nid_naver_com/2026-07-27T20-40-53-543Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/nid_naver_com/2026-07-27T20-40-53-543Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7

Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.