Manifest position 394 · CrUX rank bucket 1000
https://bdvenlinea.banvenez.com
Coverage complete
Atomic audit completed across the public login and linked user-management form. Authenticated account pages were not entered because no credentials were supplied; they are explicitly outside the representative unauthenticated scope.
Attempts
3 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | high | The light and dark screenshots are byte-identical (501,542 bytes), the computed color-scheme is normal, and the CSS probe found no prefers-color-scheme rule. F01 medium: The interface ignores the user’s dark color-scheme preference. |
respect-user-preferencesrespects-reduced-motion | pass | high | Under emulated prefers-reduced-motion: reduce, matchMedia was true, the stylesheet probe found a reduced-motion rule, and document.getAnimations() returned none. |
respect-user-preferencesrespects-contrast | pass | high | The prefers-contrast: more screenshot kept the form, text, underlines and button states visible; Lighthouse color contrast passed. |
implement-natural-interactionsview-transitions | issues | high | The CSS probe found no view-transition usage; the Angular recovery route replaces state without a declared transition. F02 low: Route changes do not use View Transitions. |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | No scroll-linked animation, parallax, scrollytelling, carousel, or reveal exists on the two short form views. |
implement-natural-interactionsphysical-gestures | not-applicable | high | The audited login and management forms expose no gesture-driven interaction to which this check applies. |
provide-guided-navigationscroll-state-aware-chrome | not-applicable | high | Neither short form route scrolls or has sticky/affixed chrome that needs scroll-state behavior. |
provide-guided-navigationanchored-positioning | not-applicable | high | No tooltip, popover, menu, or viewport-edge overlay was present in the exercised states. |
provide-guided-navigationdirects-attention | pass | high | The recovery route presents a centered “Gestión de usuarios” title, a linear form, a primary continuation state and a visible Cancel action. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | high | Desktop and mobile load screenshots show the task immediately with no popup, interstitial, consent wall, or content-obscuring banner. |
maximize-content-reduce-noisesemantic-dismissible-primitives | pass | high | No overlay or disclosure required a dialog/popover/details primitive; the observed actions are native links, button and form controls. |
maximize-content-reduce-noisereduced-chrome | pass | high | Mobile dedicates the view to one compact task card; desktop promotional art does not cover or interrupt the login card. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | pass | high | At 360x800, layout measured scrollWidth=clientWidth=360 and 0 horizontal overflow; the mobile screenshot shows a fully contained card. |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | Rendered CSS contains multiple @media width rules but the probe found no @container/container-type usage. F03 low: The cards adapt only through viewport breakpoints, not their containing context. |
adapt-to-the-form-factorinput-modality-aware | issues | high | The probe measured recovery links at only 15px high and the focused input itself had outline:none and no box-shadow. F04 medium: Small link targets and absent input outline weaken touch and keyboard use. |
support-core-task-successclear-purpose-and-primary-action | pass | high | The first viewport identifies “BDVenlínea personas”, presents the Usuario field and Entrar action without competing calls to action. |
support-core-task-successprimary-flow-completion | issues | high | The direct /gestion-usuario discoverability fetch returned 404 even though Angular later painted a form; both public recovery and registration links depend on this route. F05 high: The recovery/new-user route is served with an HTTP 404 and cannot be represented reliably as a successful navigation. |
support-core-task-successclear-system-state-and-recovery | pass | high | Submit/continue controls visibly remain disabled until requirements are met; the management view provides an explicit Cancel action and visible field guidance. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse measured LCP 10.5s, FCP 6.8s, Speed Index 7.8s and performance 0.52; the independent trace measured LCP 3.06s. F06 high: The login is materially slow on a mobile Lighthouse profile. |
be-fast-and-stablevisual-stability | pass | high | Mobile layout and Lighthouse both measured CLS 0 with no observed layout shifts. |
be-fast-and-stableefficient-main-thread | issues | high | Lighthouse measured 258ms TBT; the trace also recorded a 51.27ms long task. F07 medium: Startup scripting exceeds the good responsiveness budget. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR identified seven parser-inserted classic scripts without async/defer plus render-blocking CSS; trace FCP was 3.06s and Lighthouse FCP 6.8s. F08 high: Parser-blocking scripts and a slow dependency chain delay the login UI. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimated 613KiB unused JavaScript: 446,638 bytes in main (72%); it also found 24KiB unused CSS (98%). F09 high: The page ships a large amount of unused JavaScript and CSS. |
be-inclusivenames-roles-labels | issues | high | The images primitive and Lighthouse both found /assets/login/logo.png without alt; Lighthouse accessibility was 0.81. F10 medium: The visible brand logo has no text alternative. |
be-inclusivesufficient-contrast | pass | high | Lighthouse/axe color-contrast audit passed, and screenshots show readable text against white/light-gray surfaces. |
be-inclusivestructure-and-focus | issues | high | The DOM/evaluate probes found zero h1-h6 elements; the input’s focused outline and box-shadow were both none. F11 medium: The public views have no heading hierarchy and weak focus treatment. |
be-inclusivelegible-text | pass | high | Desktop and mobile screenshots show unclipped Spanish labels and error text with comfortable line lengths and no horizontal overflow. |
be-inclusivezoom-reflow-targets-and-media | issues | high | At 360px the layout reflowed without overflow, but the two links measured only 15px high, well below a comfortable touch target. F12 medium: Recovery and registration links have undersized touch targets. |
follow-best-practicesno-console-errors | issues | high | Lighthouse recorded a CORS error and ERR_FAILED for https://bdv81mjs.staticmon.com/tun/bdv81mjs/input/. F13 medium: A third-party monitoring request produces console and network errors. |
follow-best-practicessound-document-and-assets | issues | high | The image is 1832px wide but displays at about 307px, has no width/height attributes, no srcset, and uses PNG. F14 medium: The logo asset lacks intrinsic dimensions and is much larger than displayed. |
follow-best-practicesbrowser-platform-hygiene | pass | high | Lighthouse found no deprecated API, geolocation-on-load or notification-on-load failure; no paste-prevention handler was observed. |
be-discoverabletitle-and-description | issues | high | DOM and Lighthouse found a title but no meta[name=description]. F15 medium: The page has no meta description. |
be-discoverablecrawlable-and-mobile-friendly | issues | high | The explicit /robots.txt fetch returned HTTP 404 with the app shell body. Links and viewport metadata otherwise passed. F16 medium: The site has no valid robots.txt. |
be-discoverablecanonical-and-indexing-signals | issues | high | /sitemap.xml returned 404, no canonical or hreflang was present, and direct /gestion-usuario returned HTTP 404. F17 high: Indexing signals conflict with application routing. |
be-discoverablestructured-and-shareable-metadata | issues | high | The probe found no Open Graph tags and no JSON-LD despite visible BDVenlínea product branding. F18 low: The branded public service has no social-preview or structured entity metadata. |
be-private-and-securesecure-transport-and-headers | issues | high | HTTPS is used, but headers found no CSP, HSTS or nosniff; cookies found five cookies without Secure and every observed cookie had SameSite=None. F19 critical: A banking login omits core security headers and sets insecure cookies. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | Trackers found 10 third-party origins and three known trackers; HAR recorded 16 third-party requests and 352,659 transferred bytes, including DoubleClick and Google audiences. F20 high: The login sends data to a broad tracking and monitoring footprint before authentication. |
be-private-and-securein-context-permissions-and-modern-auth | issues | high | Lighthouse confirmed no permission prompts on load, but the login exposes only a username-first flow and the probe found no WebAuthn/credential capability use. F21 high: The authentication entry shows no phishing-resistant sign-in option. |
be-private-and-securedefensive-browser-policies | issues | high | Headers found no HSTS, clickjacking protection, Referrer-Policy, Permissions-Policy, or CSP frame-ancestors. F22 critical: Browser-enforced defenses are absent on a high-risk authentication origin. |
be-resilientprogressive-enhancement | issues | high | Discoverability measured 0% raw-to-rendered content coverage; crawler screenshots show a blank page while the browser screenshots contain both forms. F23 high: Core login and recovery content disappear without JavaScript. |
be-resilientresilient-runtime-behaviour | pass | high | The observed cards and controls stay within both desktop and mobile viewports; no cut-off overlay or fragile async control was present. |
be-resilientoffline-and-installable | issues | medium | A valid manifest and active ngsw-worker exist, but CacheStorage showed the application-shell cache empty; only three favicon/isologo assets were cached. F24 medium: The installable shell does not show evidence of a cached offline application fallback. |
be-resilientnetwork-and-http-failure-states | issues | high | A direct fetch of /gestion-usuario returned 404 while JavaScript rendered the management form; no route error or recovery explanation was shown. F25 high: HTTP route failure is masked by a rendered form rather than handled intentionally. |
be-internationalisedlang-dir-and-logical-properties | not-applicable | high | The audited public service is deliberately Spanish/Venezuelan and exposes no alternate-language or bidirectional surface; internationalised layout was not an applicable product intent. |
be-internationalisedlocale-aware-data | not-applicable | high | No dates, numbers, currencies, durations, or calendar data are shown or entered on the audited unauthenticated routes. |
be-internationalisedtime-zone-correctness | not-applicable | high | No time, event, recurrence, or time-zone concept exists on the audited unauthenticated routes. |
be-trustworthyno-dark-patterns | pass | high | The exercised public states show no confirmshaming, forced continuity, disguised advertising, preselected consent, or blocked cancellation. |
be-trustworthyhumane-error-handling | issues | high | The first screenshot of /gestion-usuario already displays “Complete la cédula, sin caracteres especiales” while the field is untouched and empty. F26 medium: The management form shows an error before the user interacts. |
be-trustworthytrustworthy-input-assistance | issues | high | The DOM probe reported autocomplete="off" on the username input. F27 medium: The username field explicitly disables autofill. |
be-trustworthysafe-commercial-and-account-flows | issues | high | The public UI exposes username-first authentication only; both “forgot” and “new client” links use /gestion-usuario, and no passkey capability was detected. F28 high: Account entry/recovery lacks modern reauthentication and clear differentiated entry points. |
be-sustainableoptimised-assets | issues | high | The logo’s natural width is 1832px versus a 307px display width, with PNG, no srcset and no intrinsic dimensions. F29 medium: The login logo is oversized and not responsively encoded. |
be-sustainableno-wasteful-work | issues | high | HAR transferred 1.18MB across 37 requests; Lighthouse estimated 613KiB unused JS, while analytics/monitoring requests fire before any user action. F30 high: The tiny login performs disproportionate background and startup work. |
be-sustainablethird-party-and-media-budget | issues | high | Sixteen third-party requests transferred 352,659 bytes; GTM/gtag alone transferred about 285KiB and known trackers included Analytics and DoubleClick. F31 high: Third-party code consumes a large share of the login budget. |
be-agent-readystructured-agent-capabilities | not-applicable | high | This sensitive consumer-banking login exposes no declared agent-facing product surface; scraping or transaction tools would be inappropriate without explicit intent and safeguards. |
be-agent-readyon-device-inference | not-applicable | high | The login and account-recovery forms have no summarisation, generation, or other inference task where on-device AI would improve the experience. |
be-memory-efficientno-leak-under-repeated-interaction | pass | medium | A same-session probe repeated input/change interaction 10 times: DOM nodes stayed at 104 and JS heap rose only about 224KB (16.03MB to 16.25MB), with no continued growth observed. |
be-memory-efficientbounded-footprint | pass | medium | The loaded form used about 17.55MB V8 self-size in the heap summary and 104 live DOM elements, proportionate to this small Angular view. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | The heap summary’s largest constructors contained no Detached* population, and the repeated interaction kept DOM nodes fixed at 104. |
Provenance
Canonical report: results/atomic/reports/0394-bdvenlinea_banvenez_com.json
Report SHA-256: 261c8270925bd16be4bf3f7404cf358c31887c8644c5b86d109dc5efd862a0a9
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/bdvenlinea_banvenez_com/2026-07-27T21-26-10-983Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/bdvenlinea_banvenez_com/2026-07-27T21-26-10-983Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.