Showing 57 of 57 versioned checks.
The listed elements fail an axe rule with serious or critical impact, creating a specific automated barrier for affected assistive technology users that requires remediation and manual confirmation.
The listed elements fail an axe rule with minor or moderate impact, reducing accessibility for the affected interaction or content even though automated checks cover only part of WCAG.
Content or controls extend beyond the observed mobile viewport, forcing horizontal navigation and potentially leaving important interface regions difficult to reach or perceive.
Crawlers and machine readers that do not execute the full client application receive too little observed text to identify the page purpose reliably.
OAI SearchBot is instructed not to crawl the observed site, so its search product cannot retrieve these pages through compliant crawling while the block remains.
PerplexityBot is instructed not to crawl the observed site, so Perplexity cannot retrieve these pages through that compliant crawler while the block remains.
No standardized discoverability loss can be inferred; the observed site only lacks an optional experimental summary for machine readers that choose to use it.
The observed lockfile selects a version covered by a published vulnerability record; actual application impact depends on whether the affected package behavior is reachable in the deployed path.
The observed flow may let a requester choose the amount or currency used to create a payment instead of binding the charge to a server controlled product price.
The observed handler can process an event without proving that Stripe signed the exact raw payload, so a crafted request may reach payment or entitlement state changes.
Visible elements move by more than the observed stability budget while the page loads, which can disrupt reading position or cause a user to activate the wrong control.
Real Chrome users experienced delayed visual feedback after an interaction on the measured page or origin.
The observed load entered an error path, so dependent interface state or client functionality may remain incomplete even though the sensitive error message was not retained.
The largest visible content element appears after the 2.5 second lab threshold, delaying when the observed page presents its primary content to the user.
The requested asset or endpoint did not complete successfully during the observed load, so content, styling, data or functionality that depends on it may be missing.
The observed mobile lab profile combines enough loading and main thread delay to fall into Lighthouse's poor range, indicating a materially slow first experience under that profile.
Long tasks blocked the main thread beyond the observed lab budget, delaying browser responses to input during the measured loading period.
The cookie may persist an identifier before the visitor has made a consent choice. The observation is a technical signal for review, not a legal compliance verdict.
The request may transmit device or usage data before the visitor has made a consent choice. The observation is a technical signal for review, not a legal compliance verdict.
Repeated or adversarial requests through the observed call path can consume provider tokens, cost and worker time without the visible code enforcing a per request output ceiling.
The observed calls identify a client reachable API surface that must enforce its own authorization and abuse controls; the inventory alone does not establish a vulnerability.
The observed cookie is not restricted to encrypted requests, so a later HTTP request within its scope could transmit its value without TLS.
Client side JavaScript can read the observed session like cookie, increasing the consequence of a script injection or compromised third party script.
The observed cookie relies on browser default cross site behavior instead of an explicit policy, making request forgery exposure harder to reason about consistently.
A sandboxed or local document represented by the null origin may be allowed to read this response with user credentials, widening access beyond named trusted origins.
Any client covered by the observed unconditional rule can read or change the governed Firebase paths without an authentication, owner or tenant condition.
Browsers receiving this response are not instructed to enforce HTTPS on later visits, so an HTTP entry point remains dependent on its redirect being reached without interference.
The observed response gives the browser no enforcing resource policy to constrain injected scripts or other active content if an injection path exists.
Without the observed nosniff directive, a browser may interpret a response differently from its declared media type, increasing exposure to content type confusion.
The observed response leaves referrer disclosure to browser defaults, which can send more source URL information to another origin than the product intends.
The observed page does not restrict which sites may embed it, leaving visible controls available for deceptive framing and clickjacking scenarios.
The observed response does not apply an explicit least privilege policy to browser capabilities, so documents and embedded contexts retain the browser default feature access.
The referenced active resource can be blocked by the browser or, if loaded over HTTP, altered on the network path before it runs in the HTTPS page.
Every database role covered by the observed policy can select or target every row for the operations to which that policy applies, without an owner or tenant predicate.
Every database role covered by the observed write policy can create or change rows without the policy constraining the new owner or tenant values.
Unqualified objects used by the observed privileged function can resolve through a mutable search path, allowing a conflicting object to run with the function owner's rights where an attacker can influence that path.
If the table created by the observed migration is reachable through Data API grants, row access has no Row Level Security boundary to separate users or tenants.
If the detected pattern is a valid credential, every party with snapshot access can use its remaining provider permissions until the credential is revoked.
Every party with repository access can copy the observed private key material and, if a deployed trust relationship still accepts it, impersonate its signer or exercise its cryptographic role.
If the observed key is still valid, every party with repository access can call Stripe APIs with its permissions and potentially read or change payment resources.
If the observed token is still valid, every party with repository access can reuse it against source control resources allowed by its scopes.
If the observed key is still valid, every party with repository access can submit provider requests charged to it and access its granted model or project capabilities.
If the observed service role credential is still valid, every party with repository access can use it to bypass Row Level Security and exercise its privileged Supabase data access.
If the observed service account credential is still valid, every party with repository access can authenticate as that account and use its Firebase or Google Cloud permissions outside client Security Rules.
Anyone able to retrieve the observed public asset can obtain the credential and exercise whatever provider permissions it still carries until it is revoked.
The observed public environment assignment can cause the build tool to embed the server credential in client assets retrievable by every application visitor.
The validated public source map can reveal original file structure, names and implementation details to any visitor, increasing the exposed implementation context available for further analysis.
The reported source location uses an operation associated with the named weakness; if untrusted data reaches the observed path, that operation can produce the behavior described by the engine evidence.
Content and any data exchanged with the observed document travel without transport encryption and can be read or altered by an intermediary on the network path.
The observed document provides no valid preferred URL signal, so equivalent URL variants can be interpreted and consolidated inconsistently by crawlers.
The server delivered content lacks a primary heading that communicates the page topic to users, assistive technology and content parsers.
Compliant search crawlers are instructed not to include the observed page in their index, which prevents intended organic discovery while the directive remains active.
Clients and crawlers relying on the observed server response receive no page specific title signal, which can make the document harder to identify and distinguish.
The page provides no authored summary in the observed metadata, so search systems must derive any result description from other page content.
Crawlers receive no site wide policy or sitemap reference from the conventional endpoint, so crawl guidance must come from other signals.
Machine readers receive no valid JSON LD entity or relationship data from the observed response and must infer structure from visible content alone.
Crawlers lack the observed URL inventory that a sitemap supplies, which can delay discovery of pages not reached reliably through internal links.
