Manifest position 875 · CrUX rank bucket 1000

https://retail.sbi.bank.in

Coverage complete

Coverage-complete public-surface audit. Authenticated banking, real registration, transfers, and any flow requiring credentials, CAPTCHA completion, OTP, or personal data were intentionally not exercised.

Attempts

2 / 3

Judged checks

58 / 58

Blocked

Not run

This report has no published overall score. Blocked and not-run checks are not passes. A coverage-complete report means every check has a judged outcome; it does not mean every check passed.

All 58 atomic check outcomes

Principle / check	Status	Confidence	Evidence or reason
respect-user-preferences `respects-color-scheme`	issues	high	The dark-mode screenshot is pixel-identical to the light screenshot; the probe reports color-scheme "normal" and a white body background while prefers-color-scheme: dark matches. F01 medium: The login experience ignores the user’s dark-color preference.
respect-user-preferences `respects-reduced-motion`	pass	high	evaluate under prefers-reduced-motion: reduce found zero active animations on the public entry state.
respect-user-preferences `respects-contrast`	pass	high	forced-colors/high-contrast screenshot retained visible text, borders, input outlines and focus affordances.
implement-natural-interactions `view-transitions`	issues	high	The rendered DOM and CSS probe found no authored view-transition rules or calls; attempted Open Now navigation remained on the welcome state without a visual continuity cue. F02 low: State and route changes do not use View Transitions.
implement-natural-interactions `scroll-driven-animations`	not-applicable	high	No scroll-linked animation was present on the representative pages, so there is no implementation to classify.
implement-natural-interactions `physical-gestures`	not-applicable	high	No gesture-driven carousel, swipe, pull, or drag interaction was present in the public representative paths.
provide-guided-navigation `scroll-state-aware-chrome`	issues	high	The privacy page is 9,307 CSS pixels tall at 360px, while its screenshot and DOM show only a static logo header and no progress, section navigation, or scroll-state response. F03 low: Long content has no position-aware navigation or progress affordance.
provide-guided-navigation `anchored-positioning`	not-applicable	high	No tooltip or viewport-edge transient overlay was exposed in the tested public states, so anchor behavior was not applicable.
provide-guided-navigation `directs-attention`	pass	high	The page provides a skip-to-main-content link, visible keyboard outline, descriptive recovery links and clear visual hierarchy.
maximize-content-reduce-noise `no-intrusive-interruptions`	pass	high	Desktop and mobile load screenshots show core content immediately with no interstitial or obscuring consent wall.
maximize-content-reduce-noise `semantic-dismissible-primitives`	pass	high	DOM inspection found native dialog elements for modal states and no load-time custom full-screen overlay.
maximize-content-reduce-noise `reduced-chrome`	pass	high	First-viewport screenshots prioritize login/account actions and content, with a compact header and no ad chrome.
adapt-to-the-form-factor `responsive-no-horizontal-scroll`	pass	high	All 360px layout captures reported scrollWidth=clientWidth=360 and zero horizontal overflow.
adapt-to-the-form-factor `component-level-responsiveness`	issues	high	The CSSOM probe found zero @container rules across the loaded application despite the login and content-card components being reused in materially different widths. F04 low: Components adapt only at page/viewport level, not at their container boundary.
adapt-to-the-form-factor `input-modality-aware`	issues	high	The rendered target probe measured Get Help and WhatsApp at 14px high, footer and recovery links at 16–21px high, and A-/A/A+ controls only 9–17px wide. F05 medium: Several primary links and text-size controls have undersized hit areas.
support-core-task-success `clear-purpose-and-primary-action`	pass	high	The first viewport clearly identifies YONO SBI, existing-user login, registration, activation and account-opening actions.
support-core-task-success `primary-flow-completion`	issues	high	Direct navigation to the linked savings-account landing URL returned to /registration/welcome, and an attempted Open Now activation remained on the welcome URL and state. F06 high: The prominent Open Now account-opening path does not reach its advertised journey.
support-core-task-success `clear-system-state-and-recovery`	issues	high	After activating Login with all fields empty, the page text was unchanged, :invalid returned no controls, and the four aria-live regions remained empty. F07 high: Submitting the empty login state provides no visible or programmatic recovery feedback.
be-fast-and-stable `good-core-web-vitals`	issues	high	Lighthouse measured LCP 12.3s, FCP 6.3s, TBT 670ms and a performance score of 0.38; the independent trace measured FCP/LCP 5.08s and TBT 182.68ms. F08 high: The primary banking entry page is slow to become useful.
be-fast-and-stable `visual-stability`	pass	high	Measured CLS was 0.066 on the entry page and 0.043 on privacy, both below the 0.1 good threshold.
be-fast-and-stable `efficient-main-thread`	issues	high	Lighthouse found 575KiB of unused JavaScript, 2.1s JavaScript execution, a 650ms maximum potential FID, and 670ms TBT; the trace recorded a 232.68ms long task. F09 medium: Large, mostly unused JavaScript blocks the main thread.
be-fast-and-stable `efficient-resource-delivery`	issues	high	HAR recorded 131 requests and 1.91MB transferred, including 37 scripts/1.31MB and 216KB fonts; Lighthouse estimated 1.27s redirect savings and found a font-display delay. F10 medium: The load has an expensive redirect and an oversized dependency chain.
be-fast-and-stable `trim-unused-and-duplicate-code`	issues	high	Lighthouse found 575KiB of unused JavaScript, 2.1s JavaScript execution, a 650ms maximum potential FID, and 670ms TBT; the trace recorded a 232.68ms long task. F09 medium: Large, mostly unused JavaScript blocks the main thread.
be-inclusive `names-roles-labels`	pass	high	Lighthouse scored entry accessibility 1.00; form probes found labels/ARIA names for primary username, password and captcha controls.
be-inclusive `sufficient-contrast`	pass	high	Lighthouse reported no contrast failures and forced-colors retained essential UI visibility.
be-inclusive `structure-and-focus`	issues	high	The privacy page jumps from one H1 to eleven H6 headings and Lighthouse failed heading-order; the welcome page uses three H1 elements plus empty H2/H5/H6 elements. F11 medium: Heading hierarchy is not logical on key pages.
be-inclusive `legible-text`	issues	high	At 360px the text is confined to an approximately 209px-wide inset card, causing the page to extend to 9,307px and forcing excessive wrapping. F12 low: The mobile privacy policy is needlessly narrow and laborious to read.
be-inclusive `zoom-reflow-targets-and-media`	issues	high	Mobile layouts had zero horizontal overflow, but the target-size probe found many visible actions only 14–21px high and text-size controls as narrow as 9px. F29 medium: Reflow works, but touch target sizing does not meet an inclusive baseline.
follow-best-practices `no-console-errors`	pass	high	Lighthouse errors-in-console and inspector-issues audits both passed.
follow-best-practices `sound-document-and-assets`	issues	high	Lighthouse identified three carousel images rendered around 0.67 aspect ratio although their natural ratios are 1.01–1.14. F13 low: Three security-practice images are distorted.
follow-best-practices `browser-platform-hygiene`	issues	high	Lighthouse found a deprecated unload listener in polyfills, an IndexedDB event preventing BFCache restoration, and missing source maps for three large first-party bundles. F14 medium: The app carries deprecated and navigation-hostile platform behavior.
be-discoverable `title-and-description`	issues	high	Both welcome and privacy routes use the same title “YONO SBI”; DOM and Lighthouse found no meta description. F15 medium: Public pages have generic titles and no meta descriptions.
be-discoverable `crawlable-and-mobile-friendly`	issues	high	Discoverability measured 1% raw/rendered content coverage and isJsShell=true; crawler screenshot is blank. Lighthouse found 20 anchors without valid destinations and robots.txt returned application HTML with 17 parse errors. F16 high: The public entry page is effectively empty to non-JavaScript crawlers and many links are not crawlable.
be-discoverable `canonical-and-indexing-signals`	issues	high	DOM probes found no canonical, Open Graph, or structured metadata; sitemap.xml returned the same 89KB Angular shell rather than a sitemap, and the entry performs a 307 cross-host redirect. F17 medium: Canonical, sitemap, and share/entity metadata are absent or invalid.
be-discoverable `structured-and-shareable-metadata`	issues	high	DOM probes found no canonical, Open Graph, or structured metadata; sitemap.xml returned the same 89KB Angular shell rather than a sitemap, and the entry performs a 307 cross-host redirect. F17 medium: Canonical, sitemap, and share/entity metadata are absent or invalid.
be-private-and-secure `secure-transport-and-headers`	issues	high	The cookies audit found TLTSID without Secure or HttpOnly and with SameSite=None; CSP allows unsafe-inline for script and style. HTTPS, HSTS, nosniff and X-Frame-Options are present. F18 high: A banking entry page sets an insecure cookie and weakens its CSP.
be-private-and-secure `data-minimisation-and-third-parties`	issues	high	Trackers found Google Tag Manager plus Firebase services; HAR recorded 130 cross-origin requests relative to the requested host and gtag requests with id=undefined. The privacy page states “We do not use cookies” although TLTSID is set. F19 high: Tracking and background calls are neither minimal nor accurately disclosed.
be-private-and-secure `in-context-permissions-and-modern-auth`	issues	high	Lighthouse failed geolocation-on-start at polyfills code; the sign-in DOM exposes username/password with no WebAuthn/passkey affordance and the password field lacks current-password autocomplete. F20 high: The page requests location on load and exposes only password authentication.
be-private-and-secure `defensive-browser-policies`	issues	high	The cookies audit found TLTSID without Secure or HttpOnly and with SameSite=None; CSP allows unsafe-inline for script and style. HTTPS, HSTS, nosniff and X-Frame-Options are present. F18 high: A banking entry page sets an insecure cookie and weakens its CSP.
be-resilient `progressive-enhancement`	issues	high	Raw HTML contains only one content token while the rendered page contains 139; discoverability reports 1% coverage and the no-JS crawler screenshot is blank. F21 high: The public content and navigation disappear without JavaScript.
be-resilient `resilient-runtime-behaviour`	issues	high	During the representative direct-route capture, Terms of Service displayed only “403 ERROR – The request could not be satisfied,” without SBI navigation, retry, contact, or return actions; later HEAD requests were intermittent, reinforcing the need for robust handling. F23 high: A linked legal route can fail as a generic 403 with no recovery.
be-resilient `offline-and-installable`	issues	high	DOM probes found no web app manifest. The browser supports service workers, but no install surface or captured offline fallback was exposed. F22 low: The app-like banking experience has no installability or explicit offline fallback metadata.
be-resilient `network-and-http-failure-states`	issues	high	During the representative direct-route capture, Terms of Service displayed only “403 ERROR – The request could not be satisfied,” without SBI navigation, retry, contact, or return actions; later HEAD requests were intermittent, reinforcing the need for robust handling. F23 high: A linked legal route can fail as a generic 403 with no recovery.
be-internationalised `lang-dir-and-logical-properties`	pass	high	The document declares lang=en, loads en_US locale resources, and its mobile layouts preserve reading order without overflow; no bidi content was present to require an explicit dir override.
be-internationalised `locale-aware-data`	not-applicable	high	The audited public pages displayed no dates, currencies, durations, or locale-sensitive numbers to format.
be-internationalised `time-zone-correctness`	not-applicable	high	The audited public pages contained no event scheduling or time-zone-sensitive data.
be-trustworthy `no-dark-patterns`	issues	high	The visible policy says “We do not use cookies on our web site,” while CDP observed TLTSID and the page loads GTM and Firebase services. F24 high: The privacy statement contradicts observed site behavior.
be-trustworthy `humane-error-handling`	issues	high	Activating Login on empty fields produced no visible message, no native invalid controls and no populated alert/live region. F28 high: Login validation does not help the user understand or correct omissions.
be-trustworthy `trustworthy-input-assistance`	issues	high	Username uses autocomplete=off and the password field has no autocomplete token; fields have no stable names in the rendered form probe. F25 high: The sign-in form disables or omits standard password-manager assistance.
be-trustworthy `safe-commercial-and-account-flows`	issues	high	Open Now advertises account creation, but both activation evidence and direct routing failed to leave the welcome page, with no explanation or alternative. F26 high: The advertised new-account action is not a dependable, transparent account flow.
be-sustainable `optimised-assets`	issues	high	Lighthouse identified three carousel images rendered around 0.67 aspect ratio although their natural ratios are 1.01–1.14. HAR measured 1.91MB/131 requests; Lighthouse estimated 575KiB unused JavaScript and 40KiB unused CSS, while malformed GTM id=undefined requests and multiple Firebase calls occur before interaction. F13 low: Three security-practice images are distorted. F27 medium: The entry route transfers and executes substantial work with little immediate value.
be-sustainable `no-wasteful-work`	issues	high	HAR measured 1.91MB/131 requests; Lighthouse estimated 575KiB unused JavaScript and 40KiB unused CSS, while malformed GTM id=undefined requests and multiple Firebase calls occur before interaction. F27 medium: The entry route transfers and executes substantial work with little immediate value.
be-sustainable `third-party-and-media-budget`	issues	high	Trackers found Google Tag Manager plus Firebase services; HAR recorded 130 cross-origin requests relative to the requested host and gtag requests with id=undefined. The privacy page states “We do not use cookies” although TLTSID is set. HAR measured 1.91MB/131 requests; Lighthouse estimated 575KiB unused JavaScript and 40KiB unused CSS, while malformed GTM id=undefined requests and multiple Firebase calls occur before interaction. F19 high: Tracking and background calls are neither minimal nor accurately disclosed. F27 medium: The entry route transfers and executes substantial work with little immediate value.
be-agent-ready `structured-agent-capabilities`	not-applicable	high	This sensitive banking entry point exposes no declared agent-facing surface; emerging WebMCP capability is not assumed appropriate without an explicit safety model.
be-agent-ready `on-device-inference`	not-applicable	high	No summarisation or language-model task is part of the tested login, legal-content, or account-opening paths.
be-memory-efficient `no-leak-under-repeated-interaction`	pass	high	After 20 password-visibility toggles, heap self-size fell from 767,808 to 764,300 bytes; closures stayed at 1,803 and node count changed only +12.
be-memory-efficient `bounded-footprint`	pass	high	Heap summary reported 26,499 nodes and 767,808 bytes of self size, proportionate for the tested entry state.
be-memory-efficient `no-detached-dom-or-unbounded-listeners`	pass	high	Before/after summaries showed stable closure count and no Detached* constructor in top populations; total self-size did not grow after repetition.

Provenance

Canonical report: results/atomic/reports/0875-retail_sbi_bank_in.json
Report SHA-256: e348dd26e054b65c9538c3788eaa2e7e0b0c88c73f1f865a3bf062210971cd46
Local retained report: runs/2026-07-17T17-27-24-856Z/atomic-reports/retail_sbi_bank_in/2026-07-27T03-48-17-014Z/report.json
Local evidence root: runs/2026-07-17T17-27-24-856Z/atomic-reports/retail_sbi_bank_in/2026-07-27T03-48-17-014Z
Catalog SHA-256: sha256:78ccfdb2d483f4c57d9dafed80fd86c6265585a56457c8dcfddc254b80fb44d7

Raw screenshots, HARs, traces, heaps, and other browser artifacts are retained at the local evidence root and intentionally are not committed. Artifact paths in the canonical report are relative to that root.