{
  "schemaVersion": 1,
  "type": "resource",
  "id": "realtime-colors",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "A synthetic primary color changed the visible picker value, CSS variable and share URL; the CSS export displayed the same value. The tool still made third-party requests under the account-free guard.",
    "reportUrl": "/design-evaluations/resource-realtime-colors.json",
    "identity": {
      "target": "https://www.realtimecolors.com/",
      "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.",
      "integrity": "Recorded document SHA-256 13d027c8f2249e33ced4d1453f608b0dd12654887bc4138881f6c7354db61824. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service."
    },
    "environment": [
      "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.",
      "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.",
      "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence."
    ],
    "tests": [
      {
        "name": "Public document response",
        "mode": "http",
        "method": "Navigate to the recorded public target in a fresh anonymous browser.",
        "result": "pass",
        "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 13d027c8f2249e33ced4d1453f608b0dd12654887bc4138881f6c7354db61824; this fingerprints only the recorded HTML response."
      },
      {
        "name": "Change the primary role",
        "mode": "browser",
        "method": "Open the visible Primary picker and enter #1e40af in its HEX field.",
        "result": "pass",
        "observation": "The primary value and --primary CSS variable became #1e40af, and the palette share URL changed to include 1e40af."
      },
      {
        "name": "Inspect CSS export",
        "mode": "browser",
        "method": "Open the export panel with Ctrl+E after the color change.",
        "result": "pass",
        "observation": "The visible CSS output included --primary: #1e40af; alongside the other four role values. No download or clipboard read was performed."
      },
      {
        "name": "Primary-source scope review",
        "mode": "source-review",
        "method": "Read the official pages and relevant repository or standard references linked below.",
        "result": "pass",
        "observation": "Reviewed the role-based preview, publisher-reported use, documentation and the website repository’s CC BY-NC-ND license. Generated colors and website source reuse were treated as separate scopes."
      },
      {
        "name": "Broader workflow and assurance coverage",
        "mode": "browser",
        "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.",
        "result": "not-run",
        "observation": "No plugin, local font installation, downloaded archive, full contrast-engine validation, account workflow or repository execution was tested. Initial attempts targeted a hidden input; the final check used the visible HEX control."
      }
    ],
    "security": {
      "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "Network activity despite account-free editing",
          "detail": "The confirmed sample requested 10 origins, including Google font/tag resources and other services. Two analytics POST requests were blocked. The footer’s no-cookies wording should not be read as no external network activity."
        },
        {
          "level": "caution",
          "basis": "observed",
          "title": "Share URLs expose design choices",
          "detail": "The chosen synthetic color appeared in the URL’s colors parameter. Shared links therefore reveal those palette choices and may be retained in browser or service logs."
        },
        {
          "level": "caution",
          "basis": "documented",
          "title": "Palette export and code reuse differ",
          "detail": "The website FAQ permits generated color use, while its linked website-code license is CC BY-NC-ND. Review the actual material and terms before copying or republishing site code."
        }
      ],
      "limits": [
        "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.",
        "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling."
      ]
    },
    "practicalCaveats": [
      "Use the exported values as a starting point for semantic tokens and separately test application states.",
      "The generic pricing and imaginary testimonial sections are visual samples, not product-plan or customer-evidence sources."
    ],
    "limits": [
      "No plugin, local font installation, downloaded archive, full contrast-engine validation, account workflow or repository execution was tested. Initial attempts targeted a hidden input; the final check used the visible HEX control.",
      "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.",
      "Proposed use-case examples in this review were not implemented as a production workflow."
    ],
    "sources": [
      {
        "label": "Live preview, feature explanation and publisher-reported use",
        "url": "https://www.realtimecolors.com/"
      },
      {
        "label": "Project documentation",
        "url": "https://www.realtimecolors.com/docs/about-realtime-colors"
      },
      {
        "label": "Official linked repository",
        "url": "https://github.com/juxtopposed/realtimecolors"
      },
      {
        "label": "Website-code license",
        "url": "https://github.com/juxtopposed/realtimecolors/blob/main/LICENSE.md"
      }
    ]
  }
}