{
  "schemaVersion": 1,
  "type": "resource",
  "id": "penpot",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "limited",
    "modes": [
      "browser",
      "source-review"
    ],
    "summary": "The public directory narrowed after a wireframe query and opened the Minimalistic Wireframing Kit detail. A hydration error was logged during the visit, while both assertions passed. No design editor, account, import or collaboration workflow was tested.",
    "reportUrl": "/design-evaluations/resource-penpot.json",
    "identity": {
      "target": "https://penpot.app/penpothub/libraries-templates",
      "version": "Unversioned public build observed 2026-10-19",
      "integrity": "Entry-response SHA-256 5c7151767a95f2552e9a44e6cbacd75b7ec0b577a0e4f8ae1b1fd701b39f5685; not whole-application integrity."
    },
    "environment": [
      "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.",
      "Synthetic inputs only; no uploads, purchases, accounts or private data.",
      "Exact allowlisted public HTTPS origins with GET/HEAD; credentials, non-default ports, forms, downloads, service writes, auth/telemetry routes and WebSockets blocked. Restrictions may change page behavior."
    ],
    "tests": [
      {
        "name": "Public application entry",
        "mode": "browser",
        "method": "Load fresh browser document and inspect visible controls",
        "result": "pass",
        "observation": "HTTP 200; 45 sampled button controls, 1 visible inputs. Reachability alone does not establish product functionality."
      },
      {
        "name": "Template-directory search",
        "mode": "browser",
        "method": "Search public library directory for wireframe",
        "result": "pass",
        "observation": "{\"before\":77,\"after\":29,\"matches\":[\"Submit a Library\",\"How to contribute\",\"\",\"\",\"Community wireframes\",\"\",\"\",\"Wireframes kit\",\"\",\"\",\"Minimalistic Wireframing Kit\",\"\"]}"
      },
      {
        "name": "Template detail navigation",
        "mode": "browser",
        "method": "Open observed Minimalistic Wireframing Kit link without importing/downloading",
        "result": "pass",
        "observation": "{\"url\":\"https://penpot.app/penpothub/libraries-templates/minimalistic-wireframing-kit\",\"h1\":[\"Minimalistic Wireframing Kit\"],\"downloadControls\":1,\"limit\":\"No hosted editor, import, account, prototype or export workflow was exercised.\"}"
      },
      {
        "name": "Design workspace runtime",
        "mode": "browser",
        "method": "Edit, prototype or collaborate in a workspace",
        "result": "not-run",
        "observation": "The account-free pass stayed in the public directory; the editor and workspace permissions remain untested."
      }
    ],
    "security": {
      "scope": "Passive inspection of the named public response headers, requested origins and bounded public controls. No exploitation, authentication or backend permission tests.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "The public directory has separate delivery dependencies",
          "detail": "The sampled page requested Plasmic assets/data, Google Fonts and GitHub API resources. The recorded response included HSTS and nosniff; neither those headers nor successful browsing certify the hosted editor or a self-hosted instance."
        },
        {
          "level": "caution",
          "basis": "observed",
          "title": "A browser error remains an inspection limit",
          "detail": "A React 418 hydration error appeared during the public directory/detail run. The search and detail assertions still passed. We did not diagnose its cause or extrapolate it to editor reliability."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Hosting and imported material need their own review",
          "detail": "Choose who administers the workspace, controls access and restores backups. Inspect the selected library/plugin’s terms and data access before introducing it to a private project."
        }
      ],
      "limits": [
        "No account, design editor, self-host installation, imported file, prototype interaction, export, collaboration, MCP or server authorization test.",
        "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification."
      ]
    },
    "practicalCaveats": [
      "Trial the exact component, prototype and handoff workflow in a dedicated workspace before moving production designs.",
      "Document which party owns backups, updates, access removal and external plugin review."
    ],
    "limits": [
      "Public library search and one detail page only; counts include duplicate card links and directory navigation, not unique assets.",
      "No account, design editor, self-host installation, imported file, prototype interaction, export, collaboration, MCP or server authorization test."
    ],
    "sources": [
      {
        "label": "Product capabilities",
        "url": "https://penpot.app/"
      },
      {
        "label": "Self-hosting options",
        "url": "https://penpot.app/self-host"
      },
      {
        "label": "Public library directory",
        "url": "https://penpot.app/penpothub/libraries-templates"
      },
      {
        "label": "Inspected wireframing-kit detail",
        "url": "https://penpot.app/penpothub/libraries-templates/minimalistic-wireframing-kit"
      },
      {
        "label": "Dated repository snapshot source",
        "url": "https://github.com/penpot/penpot"
      },
      {
        "label": "Evaluated public sample",
        "url": "https://penpot.app/penpothub/libraries-templates"
      }
    ]
  }
}