{
  "schemaVersion": 1,
  "type": "resource",
  "id": "fudge",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "limited",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "The current workspace and account menu render; the earlier address redirects successfully. Message processing, attachments and integrations remain outside this account-free test.",
    "reportUrl": "/design-evaluations/resource-fudge.json",
    "identity": {
      "target": "https://fudge.design/",
      "version": "Unversioned public page observed 2026-10-19",
      "integrity": "SHA-256 63c5fa67aa2c0c4a727718eb5fd279e45548b0523cd84322ad2bd37ac07c5c27 of one initial HTML response (13718 bytes). This does not fingerprint the entire application or its dependencies."
    },
    "environment": [
      "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.",
      "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.",
      "No owner browser profile, account, credentials, purchase, upload, private fixture or service write."
    ],
    "tests": [
      {
        "name": "Current address and redirect",
        "mode": "browser",
        "method": "Open fudge.design and design.withfudge.com in separate fresh browser contexts.",
        "result": "pass",
        "observation": "Both ended at fudge.design with HTTP 200 and the current workspace UI."
      },
      {
        "name": "Account boundary",
        "mode": "browser",
        "method": "Open Account menu without typing an email or choosing a provider.",
        "result": "pass",
        "observation": "An account dialog offered Google sign-in and an email-code flow."
      },
      {
        "name": "Message and attachment processing",
        "mode": "browser",
        "method": "Do not submit messages or files; inspect the public controls only.",
        "result": "not-run",
        "observation": "A message textarea and attachment control were visible, but no processing or output was tested."
      }
    ],
    "security": {
      "scope": "Public workspace navigation, response headers, request destinations and the unsubmitted account menu.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Public page contacts multiple third parties",
          "detail": "The initial page requested analytics/marketing origins including Clarity, PostHog, Google Tag Manager and Reddit-related hosts. Non-GET requests were blocked; no prompt or file was submitted. This reveals a broader page data-flow surface, not a finding about uploaded-content retention."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Inspect data sharing before using real work",
          "detail": "Check which reference files, URLs and agent integrations are shared with the service and its subprocessors before bringing private projects into the workspace."
        }
      ],
      "limits": [
        "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.",
        "Request blocking changes application behavior; no secure/safe certification is implied."
      ]
    },
    "practicalCaveats": [
      "Treat the current product as a workspace; confirm a specific export format before building a workflow around it.",
      "Account-menu access is not evidence that a generation or integration succeeds."
    ],
    "limits": [
      "No account, prompt response, attachment, agent connection, export or workspace-permission test.",
      "The write-blocking browser guard can alter analytics and other application behavior."
    ],
    "sources": [
      {
        "label": "Current public workspace",
        "url": "https://fudge.design/"
      },
      {
        "label": "Earlier address; redirect checked",
        "url": "https://design.withfudge.com/"
      }
    ]
  }
}