{
  "schemaVersion": 1,
  "type": "resource",
  "id": "coolors",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "The public generator produced a different five-color palette when Space was pressed. Hosted advertising and analytics requests were present, and non-GET requests were blocked throughout.",
    "reportUrl": "/design-evaluations/resource-coolors.json",
    "identity": {
      "target": "https://coolors.co/generate",
      "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.",
      "integrity": "Recorded document SHA-256 6c596bcd87ddb8c94e10143eacbbc2716cefe320815560c2927bdeb34f5d2ed7. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service."
    },
    "environment": [
      "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.",
      "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.",
      "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence."
    ],
    "tests": [
      {
        "name": "Public document response",
        "mode": "http",
        "method": "Navigate to the recorded public target in a fresh anonymous browser.",
        "result": "pass",
        "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 6c596bcd87ddb8c94e10143eacbbc2716cefe320815560c2927bdeb34f5d2ed7; this fingerprints only the recorded HTML response."
      },
      {
        "name": "Generate a palette",
        "mode": "browser",
        "method": "Dismiss the welcome and tutorial overlays, focus the page and press Space once.",
        "result": "pass",
        "observation": "The five-color URL changed from 393d3f-d5bbb1-9cc4b2-c98ca7-e76d83 to c4bbb8-f5b0cb-dc6acf-745c97-39375b. All five resulting codes appeared in the page, and the tutorial was no longer visible."
      },
      {
        "name": "Primary-source scope review",
        "mode": "source-review",
        "method": "Read the official pages and relevant repository or standard references linked below.",
        "result": "pass",
        "observation": "The fresh browser reached the product homepage and recorded its publisher-reported scale claim. A text-fetch attempt failed earlier; that access difference does not contradict the successful browser sample."
      },
      {
        "name": "Broader workflow and assurance coverage",
        "mode": "browser",
        "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.",
        "result": "not-run",
        "observation": "Palette locking, image extraction, AI functions, saved projects, account permissions, payments and downloaded exports were not tested."
      }
    ],
    "security": {
      "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Third-party hosted surface",
          "detail": "The final generator sample requested 16 origins including advertising, analytics, authentication assets and CDNs. Seven POST requests, including analytics and challenge traffic, were blocked. Account-free operation is not evidence of zero tracking."
        },
        {
          "level": "caution",
          "basis": "observed",
          "title": "Rapid color changes carry a warning",
          "detail": "The welcome screen displayed a warning about flashing colors and photosensitive seizures. This sample generated one palette; no rapid flashing or photosensitivity assessment was performed."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Uploads and accounts have separate risks",
          "detail": "This review used no images, credentials or saved palettes. Inspect the relevant privacy and retention terms before using image extraction or account storage with business materials."
        }
      ],
      "limits": [
        "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.",
        "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling."
      ]
    },
    "practicalCaveats": [
      "Generate slowly enough to compare deliberate candidates; the tool’s own warning makes rapid repeated changes unsuitable for some people.",
      "Assign semantic roles and run pair-specific contrast checks before using the palette in a product."
    ],
    "limits": [
      "Palette locking, image extraction, AI functions, saved projects, account permissions, payments and downloaded exports were not tested.",
      "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.",
      "Proposed use-case examples in this review were not implemented as a production workflow.",
      "The publisher-linked privacy policy was not retrievable through the text-fetch path; no retention or privacy-policy assurance is made."
    ],
    "sources": [
      {
        "label": "Product and publisher-reported scale",
        "url": "https://coolors.co/"
      },
      {
        "label": "Public palette generator",
        "url": "https://coolors.co/generate"
      },
      {
        "label": "Privacy policy",
        "url": "https://coolors.co/privacy-policy",
        "scope": "Publisher-linked policy destination; text retrieval returned 403 in this pass, so policy contents were not reviewed."
      }
    ]
  }
}