{
  "schemaVersion": 1,
  "type": "resource",
  "id": "icon-creator",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "One synthetic icon edit and SVG export succeeded. The exported sample passed limited static pattern checks; library ZIP, PNG and broader privacy behavior remain untested.",
    "reportUrl": "/design-evaluations/resource-icon-creator.json",
    "identity": {
      "target": "https://iconcreator.dev/",
      "version": "Unversioned public page observed 2026-10-19",
      "integrity": "SHA-256 2edb117b41ce5ebdd2accf7a70e286bdc34559a1800e7bc0b4a6af3f46dfdf49 of one initial HTML response (3910 bytes). This does not fingerprint the entire application or its dependencies."
    },
    "environment": [
      "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.",
      "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.",
      "No owner browser profile, account, credentials, purchase, upload, private fixture or service write."
    ],
    "tests": [
      {
        "name": "Icon search and selection",
        "mode": "browser",
        "method": "Search coffee, select the visible Coffee icon and change its primary color to #1E40AF.",
        "result": "pass",
        "observation": "The search displayed nine matching controls; selecting Coffee enabled Undo, and the editor accepted the color."
      },
      {
        "name": "Synthetic SVG export",
        "mode": "browser",
        "method": "Export the single icon as SVG and inspect the downloaded bytes in memory.",
        "result": "pass",
        "observation": "A 1,188-byte SVG included #1E40AF and valid opening/closing SVG markers. SHA-256: ef5e996b0603f9b287f94e993e87d5eee0fec4c5bf6a44e79a1a6c4203291577."
      },
      {
        "name": "Bounded SVG pattern check",
        "mode": "source-review",
        "method": "Scan the exported bytes for script tags, event-handler attributes, foreignObject and external-reference patterns.",
        "result": "pass",
        "observation": "Zero matches were found for each checked pattern. This is not an exhaustive SVG sanitizer or proof that every export is safe."
      },
      {
        "name": "Other export modes",
        "mode": "browser",
        "method": "Export PNG or a whole-library ZIP.",
        "result": "not-run",
        "observation": "Only one SVG was exported; no library job or uploaded asset was used."
      }
    ],
    "security": {
      "scope": "A synthetic icon edit/export, bounded static SVG inspection, passive page observations and the publisher's privacy documentation.",
      "findings": [
        {
          "level": "info",
          "basis": "observed",
          "title": "One inspected output had no matched active-content patterns",
          "detail": "The 1,188-byte sample had no detected script, event-handler, foreignObject or external-reference patterns. The check is limited to this file and these patterns."
        },
        {
          "level": "caution",
          "basis": "documented",
          "title": "Library ZIP exports use server processing",
          "detail": "The privacy page describes a server job that stores design settings and an export record for library ZIP generation. This workflow and the stated retention/link behavior were not verified."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Do not infer local-only processing",
          "detail": "The single export succeeded while non-GET requests were blocked, but GET requests remained allowed and the download URL scheme was not recorded. This does not prove that design data never leaves the browser."
        }
      ],
      "limits": [
        "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.",
        "Request blocking changes application behavior; no secure/safe certification is implied."
      ]
    },
    "practicalCaveats": [
      "Inspect the license of the selected icon pack; one pack's terms do not cover every collection.",
      "Check rendering and accessibility in the final application, especially at small sizes and when icons act as controls."
    ],
    "limits": [
      "One synthetic Coffee icon and one SVG only; no upload, PNG export, library ZIP, account or purchase.",
      "Static patterns are not a full sanitizer; no stored-data, retention, backend or network-payload audit."
    ],
    "sources": [
      {
        "label": "Public icon editor",
        "url": "https://iconcreator.dev/"
      },
      {
        "label": "Publisher privacy documentation",
        "url": "https://iconcreator.dev/privacy"
      }
    ]
  }
}