Manifest position 746 · CrUX rank bucket 1000
https://member.rakuten-sec.co.jp
Coverage complete
The requested member host redirects to the public www homepage. Public entry, login, product, support, account-opening and error-recovery templates were audited; authenticated account/dashboard/trading states were not covered because no credentials were provided.
Attempts
3 / 3
Judged checks
58 / 58
Blocked
0
Not run
0
This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.
All 58 atomic check outcomes
| Principle / check | Status | Confidence | Evidence or reason |
|---|---|---|---|
respect-user-preferencesrespects-color-scheme | issues | medium | Dark emulation leaves the complete homepage white/red and the probe reports colorScheme="normal"; no system-driven dark theme is applied. F01 high: Honours prefers-color-scheme: a usable dark mode exists and is driven by the user's preference (color-scheme / prefers-color-scheme / light-dark()), not hard-coded light only. |
respect-user-preferencesrespects-reduced-motion | pass | medium | Under prefers-reduced-motion: reduce, getAnimations() returned zero active animations and no autoplay media was present. |
respect-user-preferencesrespects-contrast | issues | medium | Lighthouse reports a failing color-contrast audit on the homepage; no forced-colors/high-contrast adaptation was found. F02 medium: Honours prefers-contrast / forced-colors: controls, text and scrollbars remain visible under high-contrast preferences. |
implement-natural-interactionsview-transitions | issues | low | The CSS/runtime probe found no View Transition usage while navigation and content state changes are instant full-page swaps. F03 low: State and route changes use View Transitions (including same-document, cross-document and scroll-driven/staggered) rather than instant, jarring swaps. |
implement-natural-interactionsscroll-driven-animations | not-applicable | high | No scroll-linked parallax, scrollytelling or reveal interaction was present on the representative paths. |
implement-natural-interactionsphysical-gestures | not-applicable | high | No gesture-driven control requiring custom pull/swipe/physics behaviour was present on the sampled public desktop-style paths. |
provide-guided-navigationscroll-state-aware-chrome | pass | medium | Representative pages provide persistent global navigation and breadcrumb/current-section cues without a JS scroll-toggle failure observed. |
provide-guided-navigationanchored-positioning | not-applicable | high | No tooltip or edge-positioned transient menu was exposed in the sampled states, so anchor positioning was not required for an observed control. |
provide-guided-navigationdirects-attention | pass | medium | Breadcrumbs, headings and highlighted primary actions preserve orientation across home, product, login and account-opening paths. |
maximize-content-reduce-noiseno-intrusive-interruptions | pass | medium | No load-time modal, consent wall or full-viewport interstitial obscured content in any initial screenshot. |
maximize-content-reduce-noisesemantic-dismissible-primitives | pass | medium | The DOM contains a native dialog and no ad-hoc full-screen overlay was exposed during load; ordinary disclosures remain inline. |
maximize-content-reduce-noisereduced-chrome | issues | high | The first viewport is dominated by two promotion bands, category chips, a full-width campaign hero and five more campaign tiles before core informational content. F04 medium: Minimise non-content chrome and borders so the content is the focus, not the application frame; expressive/decorative visuals serve the content rather than crowd it. |
adapt-to-the-form-factorresponsive-no-horizontal-scroll | issues | high | At a requested 360x800 viewport Chrome lays out a 1280 CSS-pixel page at 0.28125 scale; layout reports no viewport meta and the page is a shrunken desktop canvas. Login behaves the same. F05 critical: Layout adapts to narrow viewports with no horizontal overflow and no fixed pixel widths forcing a desktop layout on mobile; viewport meta present; fluid scaling and intrinsic sizing rather than brittle breakpoints. |
adapt-to-the-form-factorcomponent-level-responsiveness | issues | high | The platform probe found zero container-query rules, and reused header/login/promotion components remain desktop-sized under a narrow viewport. F06 medium: Components adapt to their container with container queries (incl. anchored container queries) and content/state-based styling where reused at different sizes, not only global viewport breakpoints. |
adapt-to-the-form-factorinput-modality-aware | issues | high | Lighthouse fails target-size on both homepage and login; the shrunken desktop UI makes controls especially small on mobile. F07 high: Touch targets are adequately sized and hover-only affordances have a non-hover fallback, and keyboard focus is visible, so the UI works for touch, pointer and keyboard alike. |
support-core-task-successclear-purpose-and-primary-action | pass | medium | Home clearly exposes Login and Account opening; login and account-opening pages state their purpose and next action prominently. |
support-core-task-successprimary-flow-completion | pass | medium | Public navigation reaches product details, login and the first account-opening choice; login offers both password and passkey routes without an avoidable interstitial. |
support-core-task-successclear-system-state-and-recovery | pass | medium | A deliberately invalid URL renders a Japanese 404 explanation and a direct home recovery link. |
be-fast-and-stablegood-core-web-vitals | issues | high | Lighthouse homepage performance is 0.15 with LCP 17.3s and TTI 34.6s; the controlled trace was faster (LCP 1.87s), showing severe variability. F08 critical: Core Web Vitals are in the good range: LCP is fast, interaction latency (INP) is low, and CLS is minimal; work is prioritised and deferred sensibly. |
be-fast-and-stablevisual-stability | issues | high | Mobile layout observation records CLS 0.173 with a 0.170 shift; 87 of 100 audited images lack dimensions. F09 high: No cumulative layout shift from late content (images, banners, fonts) that arrives without reserved space. |
be-fast-and-stableefficient-main-thread | issues | high | Lighthouse reports 6.1s main-thread work and 3.4s JavaScript execution; trace still finds two long tasks and 48ms TBT. F10 high: The main thread is not blocked by long tasks or heavy scripting; work is deferred, chunked, prioritised, or moved off-thread. |
be-fast-and-stableefficient-resource-delivery | issues | high | HAR records 227 requests/3.28MB, seven parser-inserted high-priority stylesheets, blocking scripts, redirects and missing cache headers. F11 high: Critical resources are delivered efficiently: cache headers are useful, render-blocking chains are short, fonts do not block or shift text, HTTP delivery is modern, and network dependency trees do not delay the main content. |
be-fast-and-stabletrim-unused-and-duplicate-code | issues | high | Lighthouse estimates 648KiB unused JavaScript and 111KiB unused CSS; HAR shows 65 scripts and 1.80MB script transfer. F12 high: The page does not ship large unused or duplicated JavaScript/CSS, avoidable legacy bundles, or third-party code that dominates the load without user value. |
be-inclusivenames-roles-labels | issues | high | Lighthouse fails multiple ARIA/name rules and image-alt; the image audit finds 44 missing alts, and login also fails form labels/link names. F13 critical: Interactive elements have accessible names, correct roles, and form fields have labels; images have alt text where meaningful; canvas/expressive content is exposed to assistive technology. |
be-inclusivesufficient-contrast | issues | high | Lighthouse reports insufficient foreground/background contrast on the homepage. F14 high: Text and essential UI meet WCAG colour-contrast minimums against their background. |
be-inclusivestructure-and-focus | issues | high | Homepage has an empty H1, no main landmark, malformed list/ARIA structures and 206 apparently unnamed anchors; login also lacks a main landmark. F15 high: Heading and landmark structure is logical, focus order follows reading order, keyboard focus is always visible, and interactive state survives DOM moves. |
be-inclusivelegible-text | issues | high | The 360px capture shrinks a 1280px desktop canvas to 28%, making body text and controls too small to read comfortably. F16 high: Text is legible and inclusively rendered: comfortable line layout, precise alignment, stable rendering across mixed fonts, no clipping or cramped wrapping that harms comprehension. |
be-inclusivezoom-reflow-targets-and-media | issues | high | Both audited templates omit a viewport meta tag, Lighthouse fails meta-viewport and target-size, and narrow rendering does not reflow. F17 critical: The experience remains usable when zoomed or reflowed, touch targets are large enough, media has captions or equivalents where needed, and the viewport does not prevent user scaling. |
follow-best-practicesno-console-errors | issues | high | Lighthouse reports browser errors logged to the console on both homepage and login. F18 medium: The page loads without console errors or uncaught exceptions. |
follow-best-practicessound-document-and-assets | issues | high | Although doctype/UTF-8 are valid, Lighthouse finds incorrect image aspect ratios and the image audit finds 87 missing dimensions and 95 legacy-format images. F19 high: Valid doctype and charset, images sized with correct aspect ratio, no deprecated APIs misused, and CSS/HTML are well structured and not needlessly repetitive. (HTTPS, CSP and permission hygiene are judged under be-private-and-secure, not here.) |
follow-best-practicesbrowser-platform-hygiene | issues | high | Lighthouse reports a deprecated API, inspector issues, BFCache blockers on login and substantial legacy/unused code. F20 medium: The page uses the platform cleanly: no deprecated APIs, no avoidable BFCache blockers, no broken source maps or inspector issues, no stale vulnerable libraries, no paste-prevention on inputs, and no notification/geolocation prompts on load. |
be-discoverabletitle-and-description | issues | high | Homepage metadata is descriptive, but the primary login template has no meta description. F21 medium: The page has a unique, descriptive <title> and a meta description. |
be-discoverablecrawlable-and-mobile-friendly | issues | high | Raw content is crawlable, but both homepage and login omit viewport metadata and Lighthouse fails mobile viewport/link-name checks. F22 high: Links are crawlable (real href), there is a viewport meta tag, robots does not block indexing, and link text is descriptive. |
be-discoverablecanonical-and-indexing-signals | pass | medium | Homepage/product expose canonicals; robots.txt is successful and points to a sitemap, and sampled public pages return content. |
be-discoverablestructured-and-shareable-metadata | issues | high | Homepage has Open Graph tags but no JSON-LD despite representing a financial-services organization; the account page has placeholder description "Site Description". F23 medium: Where the page represents an article, product, organization, event, place or other rich entity, structured data and share-preview metadata accurately describe the visible content. |
be-private-and-securesecure-transport-and-headers | issues | high | HTTPS/HSTS are present, but CSP and nosniff are absent; 5 cookies are not Secure and all 14 sampled cookies use SameSite=None. F24 critical: Served over HTTPS with a sensible Content-Security-Policy and secure, SameSite cookies; no mixed content or obvious transport/header smells. |
be-private-and-securedata-minimisation-and-third-parties | issues | high | Tracker capture finds 42 third-party origins and five known tracker families; HAR attributes 122 requests and 1.78MB to third parties. F25 critical: No over-collection of user data, no leaky third parties, and analytics/background data collection is minimised and batched rather than chatty or session-wide by default. |
be-private-and-securein-context-permissions-and-modern-auth | pass | medium | No permission prompt appeared on load, and the primary login visibly offers passkey authentication alongside passwords. |
be-private-and-securedefensive-browser-policies | issues | high | The main response lacks clickjacking protection, Referrer-Policy and Permissions-Policy as well as CSP; only HSTS is present. F26 critical: Browser-enforced defenses are configured where appropriate: HSTS, clickjacking protection (frame-ancestors / X-Frame-Options), Trusted Types for XSS-sensitive apps, origin isolation, privacy-preserving third-party cookie posture, and sensible Referrer-Policy / Permissions-Policy. |
be-resilientprogressive-enhancement | pass | medium | Discoverability comparison reports 86% raw-HTML coverage, no empty SPA mount and title/description available without JavaScript. |
be-resilientresilient-runtime-behaviour | pass | medium | Product, support, login and account-opening templates rendered stable usable initial states; no clipped overlay or blank shell was observed. |
be-resilientoffline-and-installable | not-applicable | high | This regulated brokerage and authentication experience is intrinsically online; an installable/offline transaction flow is not an appropriate expectation. |
be-resilientnetwork-and-http-failure-states | pass | medium | The tested 404 route gives an explicit explanation and a recovery link instead of a blank shell. |
be-internationalisedlang-dir-and-logical-properties | issues | high | Public pages set lang=ja, but the separate account-opening application has no document language; no explicit direction is set. F27 medium: Correct lang and dir attributes, logical CSS properties (inline/block) rather than physical left/right, and translation-ready markup so the layout and reading order survive other languages and writing modes. |
be-internationalisedlocale-aware-data | pass | medium | Sampled Japanese public/product content presents Japanese labels and locally formatted financial text consistently. |
be-internationalisedtime-zone-correctness | not-applicable | high | No cross-time-zone event scheduling or user-entered time concept appeared in the representative public paths. |
be-trustworthyno-dark-patterns | pass | medium | No confirmshaming, forced continuity, disguised control or consent wall was observed in the sampled public, login or account-opening states. |
be-trustworthyhumane-error-handling | issues | high | Submitting the visible login form empty produced no invalid controls, alert role or visible error message; login inputs are not required. F28 high: Forms prevent and recover from mistakes humanely: validate after interaction (not prematurely), give clear required-field feedback, announce errors accessibly, and signal invalid fields visibly rather than blaming the user. |
be-trustworthytrustworthy-input-assistance | issues | high | Login ID has no autocomplete token and password uses generic autocomplete="on" instead of username/current-password. F29 high: Input is assisted, not obstructed: correct autocomplete tokens so address, payment, sign-in and sign-up fields autofill, and inputs are highlighted/sized to help the user rather than trip them up. |
be-trustworthysafe-commercial-and-account-flows | pass | medium | Account opening states three steps and distinguishes Rakuten members/non-members; login offers passkeys and recovery/security guidance. |
be-sustainableoptimised-assets | issues | high | Of 100 images, 95 use legacy formats, 58 lack srcset, 39 below-fold images are not lazy and 8 are oversized. F30 high: Images and decorative assets are optimised and served at appropriate resolutions; decorative pseudo-element imagery and heavy decorative images are resolution-optimised rather than oversized. |
be-sustainableno-wasteful-work | issues | high | The load starts 227 requests including 52 fetch/XHR requests and many duplicate advertising destinations before user interaction. F31 high: Background work and fetching are not wasteful: background processing is efficient and de-prioritised, and the lightest technique that achieves the result is preferred over heavy or redundant work. |
be-sustainablethird-party-and-media-budget | issues | high | Third parties account for 1.78MB; Google Tag Manager/destination scripts alone dominate the largest transfer list while campaign imagery adds substantial decorative weight. F32 high: Third-party scripts, fonts, video, audio, animation and heavy media are proportionate to the user value they provide; autoplay or background media is avoided unless essential and resource use is cached or deferred where possible. |
be-agent-readystructured-agent-capabilities | not-applicable | high | No declared agent-facing surface was found; emerging WebMCP exposure is optional and high-risk financial actions should not be inferred from scraping. |
be-agent-readyon-device-inference | not-applicable | high | No user task on the sampled public/login paths called for on-device language-model or summarisation functionality. |
be-memory-efficientno-leak-under-repeated-interaction | pass | medium | After ten full-page scroll down/up cycles, snapshot self size rose only 0.67MB (1.7%) and node count 0.6%; this does not show unbounded retained growth in the exercised interaction. |
be-memory-efficientbounded-footprint | issues | medium | Baseline snapshot has 719,381 nodes and 39.1MB self size, growing to 723,804 nodes/39.8MB after repeated scrolling; this is heavy for a public landing page. F33 medium: Heap size and DOM node count are reasonable for what the page is; the footprint is proportionate rather than bloated. |
be-memory-efficientno-detached-dom-or-unbounded-listeners | pass | medium | Before/after heap summaries show no Detached* constructor among the retained top constructors and only modest aggregate growth after ten scroll cycles. |
Provenance
Canonical report: results/atomic/reports/0746-member_rakuten-sec_co_jp.json
Report SHA-256: efa410c32edefabcb0ca068d3be754b1e5c4e22d73a844f07a8b7a4789cbbb81
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/member_rakuten-sec_co_jp/2026-07-28T06-23-24-886Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/member_rakuten-sec_co_jp/2026-07-28T06-23-24-886Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7
Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.