{
  "schemaVersion": 1,
  "type": "resource",
  "id": "neuform",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "limited",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "Public reference cards and authentication controls render, and the FAQ documents the account boundary. Remixing and generation were not run.",
    "reportUrl": "/design-evaluations/resource-neuform.json",
    "identity": {
      "target": "https://neuform.ai/",
      "version": "Unversioned public page observed 2026-10-19",
      "integrity": "SHA-256 b7219584bdd495451fd7949395a66df47c7b76a7bebc6e10c4a8cc0daa2556b5 of one initial HTML response (6499 bytes). This does not fingerprint the entire application or its dependencies."
    },
    "environment": [
      "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.",
      "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.",
      "No owner browser profile, account, credentials, purchase, upload, private fixture or service write."
    ],
    "tests": [
      {
        "name": "Public application",
        "mode": "browser",
        "method": "Open the homepage in a fresh browser context.",
        "result": "pass",
        "observation": "HTTP 200; reference cards, remix controls and Google/email sign-in options were visible."
      },
      {
        "name": "Account requirements",
        "mode": "source-review",
        "method": "Read the current primary FAQ.",
        "result": "pass",
        "observation": "The FAQ states public browsing is available without signing in and remix/save/private workspace functions require an account."
      },
      {
        "name": "Generation",
        "mode": "browser",
        "method": "Do not invoke remix, authentication or save controls.",
        "result": "not-run",
        "observation": "No model output, export fidelity or private-project behavior was tested."
      }
    ],
    "security": {
      "scope": "Public frontend destinations and primary documentation about account access; no authenticated state.",
      "findings": [
        {
          "level": "info",
          "basis": "observed",
          "title": "Public frontend uses hosted services",
          "detail": "The page requested a Supabase origin, Google-hosted assets, an icon API and analytics/affiliate script origins. No private design data was entered."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Separate reference browsing from private generation",
          "detail": "Confirm which prompts, references and outputs become public or remain private before using a real project. The public FAQ's feature boundaries are not a tenant-isolation test."
        }
      ],
      "limits": [
        "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.",
        "Request blocking changes application behavior; no secure/safe certification is implied."
      ]
    },
    "practicalCaveats": [
      "The FAQ supports a broader interface-builder description than a landing-page-only label.",
      "Public reference browsing does not validate generated HTML, app behavior or design-system consistency."
    ],
    "limits": [
      "No account, prompt, generation, remix, export or subscription workflow.",
      "Non-GET traffic was blocked; source documentation and interactive frontend behavior were assessed separately."
    ],
    "sources": [
      {
        "label": "Public application",
        "url": "https://neuform.ai/"
      },
      {
        "label": "Current account and workflow FAQ",
        "url": "https://neuform.ai/faq"
      },
      {
        "label": "Public privacy-policy route",
        "url": "https://neuform.ai/privacy"
      }
    ]
  }
}