{
  "schemaVersion": 1,
  "type": "resource",
  "id": "deck-gallery",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "limited",
    "modes": [
      "http",
      "browser"
    ],
    "summary": "The OK COOL TikTok Trend Report detail opened with preview imagery and related decks. Public preview access worked; sign-in and pricing options remained visible.",
    "reportUrl": "/design-evaluations/resource-deck-gallery.json",
    "identity": {
      "target": "https://www.deck.gallery/",
      "version": "Unversioned public page observed on 2026-10-19",
      "integrity": "sha256:3d45888e591e6bb7dbc21c8d4389feaab6c0e71bb61a8cb171f586e1df5690f3 — initial HTTP 200 response body only; not whole-application integrity."
    },
    "environment": [
      "Chromium 155.0.8059.82, 1365×900 desktop viewport.",
      "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.",
      "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.",
      "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification."
    ],
    "tests": [
      {
        "name": "Public HTTP response",
        "mode": "http",
        "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.",
        "result": "pass",
        "observation": "The standalone client received 200 at https://www.deck.gallery/. This establishes response delivery only."
      },
      {
        "name": "Fresh browser entry",
        "mode": "browser",
        "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.",
        "result": "pass",
        "observation": "The document returned 200 and identified itself as “Deck.gallery - Beautifully designed decks, curated”. 257 image elements were present; no account was used."
      },
      {
        "name": "Observed public sample or navigation",
        "mode": "browser",
        "method": "Follow the observed Report OK COOL TikTok Trend Report 2024 link to https://www.deck.gallery/ok-cool-chaos-2024/.",
        "result": "pass",
        "observation": "The destination returned 200; title: “OK COOL TikTok Trend Report 2024 - Deck.gallery”. 18 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark."
      }
    ],
    "security": {
      "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.",
      "findings": [
        {
          "level": "info",
          "basis": "observed",
          "title": "Public response protections",
          "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared default-src, script-src, style-src, font-src, img-src, connect-src, frame-src, frame-ancestors, base-uri, form-action, object-src, upgrade-insecure-requests, worker-src; it also contained unsafe-inline. X-Frame-Options was DENY. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Request surface in the anonymous visit",
          "detail": "Deck.gallery attempted requests to 5 additional hosts, including static.cloudflareinsights.com, images.deck.gallery, guests.pikapod.net, clerk.deck.gallery. Host counts include requests stopped by the test guard; they do not establish what data a service retained."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Before using this reference",
          "detail": "Use the preview to study pacing and hierarchy, and verify access and rights before planning to reuse or redistribute deck material."
        }
      ],
      "limits": [
        "No authentication, authorization, tenant separation, data retention or backend handling was tested.",
        "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.",
        "9 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic."
      ]
    },
    "practicalCaveats": [
      "Use the preview to study pacing and hierarchy, and verify access and rights before planning to reuse or redistribute deck material.",
      "A polished deck is not evidence that its claims or business outcomes are valid."
    ],
    "limits": [
      "No full deck was downloaded, membership purchased or private material supplied. Full-slide availability and reported business outcomes were not tested.",
      "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs."
    ],
    "sources": [
      {
        "label": "Public resource entry",
        "url": "https://www.deck.gallery/"
      },
      {
        "label": "Observed sample or category",
        "url": "https://www.deck.gallery/ok-cool-chaos-2024/"
      }
    ]
  }
}