{
  "schemaVersion": 1,
  "type": "resource",
  "id": "hyperbrowser-designmd",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "limited",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "The application renders an explicit API-key gate. The empty form stays disabled, and extraction is untested because this evaluation uses no credentials.",
    "reportUrl": "/design-evaluations/resource-hyperbrowser-designmd.json",
    "identity": {
      "target": "https://design-md.hyperbrowser.ai/",
      "version": "Unversioned public page observed 2026-10-19",
      "integrity": "SHA-256 9bd26a5482ecc50c3383b9b5b7399853cf1a39000f030ca9d34559a57ec5d81e of one initial HTML response (5659 bytes). This does not fingerprint the entire application or its dependencies."
    },
    "environment": [
      "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.",
      "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.",
      "No owner browser profile, account, credentials, purchase, upload, private fixture or service write."
    ],
    "tests": [
      {
        "name": "Public application load",
        "mode": "browser",
        "method": "Navigate to the documented application in a fresh context.",
        "result": "pass",
        "observation": "HTTP 200; DESIGNMD and Hyperbrowser API key controls rendered."
      },
      {
        "name": "Empty credential boundary",
        "mode": "browser",
        "method": "Inspect input type and Save key state without entering a value.",
        "result": "pass",
        "observation": "One password-type field was present and Save key was disabled."
      },
      {
        "name": "Extraction and export",
        "mode": "browser",
        "method": "Stop at the visible credential boundary.",
        "result": "not-run",
        "observation": "No API key, website extraction or generated file was used."
      }
    ],
    "security": {
      "scope": "Unauthenticated initial interface, HTTPS response metadata and observed request origins.",
      "findings": [
        {
          "level": "info",
          "basis": "observed",
          "title": "Credential entry is an explicit boundary",
          "detail": "The initial view requires a key and masks its entry. Only the application origin was requested during this initial sample; this does not establish where a submitted key is stored or sent."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Scope a key before connecting it",
          "detail": "Use the service's documented key permissions and usage controls before entering a credential. The account-free test did not assess storage, rotation, billing exposure or target-URL access."
        }
      ],
      "limits": [
        "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.",
        "Request blocking changes application behavior; no secure/safe certification is implied."
      ]
    },
    "practicalCaveats": [
      "Budget for an API-backed workflow rather than assuming a keyless public converter.",
      "Do not infer the output specification is implemented merely because the specification is linked."
    ],
    "limits": [
      "Credential handling and backend calls were not exercised.",
      "Current extraction capabilities remain a documentation gap."
    ],
    "sources": [
      {
        "label": "Public key gate",
        "url": "https://design-md.hyperbrowser.ai/"
      },
      {
        "label": "Specification linked by the application",
        "url": "https://github.com/google-labs-code/design.md"
      }
    ]
  }
}