{ "schemaVersion": 2, "reviewedOn": "2026-10-19", "methodology": "https://ionbin.com/design/methodology/", "scope": "Account-free evaluations combine public source review, bounded browser or HTTP checks, and isolated local fixtures where stated. Each review names its executed scope and gaps. No authenticated workflows, paid access, private uploads or security certification. Principle fixtures illustrate implementation checks, not empirical validation. Examples remain proposed applications.", "resources": [ { "id": "refero-styles", "title": "Refero Styles", "url": "https://styles.refero.design/", "category": "Design systems", "kind": "Design reference library", "summary": "Turn a visual reference into a starting system an agent can read.", "whatItIs": "Refero publishes website style references as DESIGN.md files, including typography, color, spacing and components. The useful output is a set of design decisions to inspect before an agent starts building.", "whenUseful": "You have a clear visual direction but need to explain it consistently across several screens.", "example": "Select a reference with similar information density, then map its type and spacing choices onto your own brand tokens.", "expectedResult": "A reviewed design brief with explicit token choices.", "cautions": [ "A reference brand’s identity is not permission to reproduce its logos, imagery or complete interface.", "Extracted styles do not establish keyboard behavior, contrast compliance or conversion performance." ], "requirements": [ "A browser and an editor for reviewing the downloaded design file." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://styles.refero.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The public Linear reference opened with color, typography, spacing and guideline sections. This is a usable style-reference browsing result; no downloaded DESIGN.md was executed.", "reportUrl": "/design-evaluations/resource-refero-styles.json", "identity": { "target": "https://styles.refero.design/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:97ded592e5aa6d3d1a45a20b31ddcaf84f00df1d0e8261bd9bdda26e0e26fc96 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://styles.refero.design/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Website Styles & DESIGN.md Library | Refero Styles”. 42 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Linear midnight precision instrument link to https://styles.refero.design/style/90ce5883-bb24-4466-93f7-801cd617b0d1.", "result": "pass", "observation": "The destination returned 200; title: “Linear design system | Refero Styles”. 3 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Refero Styles attempted requests to 3 additional hosts, including www.googletagmanager.com, images.refero.design, t0.gstatic.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Review the reference tokens against your own brand before using them in an agent prompt. The sample exposes visual choices, not the original product’s behavior." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "4 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Review the reference tokens against your own brand before using them in an agent prompt. The sample exposes visual choices, not the original product’s behavior.", "A reference brand’s identity is not permission to reproduce its logos, imagery or complete interface." ], "limits": [ "DESIGN.md download completeness, extraction accuracy, account features and MCP access were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://styles.refero.design/" }, { "label": "Observed sample or category", "url": "https://styles.refero.design/style/90ce5883-bb24-4466-93f7-801cd617b0d1" } ] } }, { "id": "fudge", "title": "Fudge", "url": "https://fudge.design/", "category": "Design systems", "kind": "AI design workspace", "summary": "Bring references, website feedback and design work into a conversational workspace.", "whatItIs": "Fudge now presents a conversational design workspace with a message field, file attachment control and links to a workspace and integrations. The earlier design.withfudge.com address redirects here; DESIGN.md extraction and token exports are not established by the current public interface.", "whenUseful": "A team needs to turn references and design feedback into a more concrete direction before implementation.", "example": "Start with an approved public reference and three spacing or hierarchy questions; confirm the workspace's data handling and output options before submitting real project material.", "expectedResult": "A clearer design brief; generated output and export availability still need a separate account-based check.", "cautions": [ "The visible workspace does not establish supported design-file exports or generated-code quality.", "The public page loads several analytics and marketing services; review data handling before entering confidential material." ], "requirements": [ "A browser; Google and email sign-in options are offered for an account.", "Permission to share any reference URL, file or design content submitted to the workspace." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The current workspace and account menu were inspected in a fresh browser. No message, file, account or integration workflow was submitted." ], "sources": [ { "label": "Current public workspace", "url": "https://fudge.design/" }, { "label": "Earlier address; redirect checked", "url": "https://design.withfudge.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser", "source-review" ], "summary": "The current workspace and account menu render; the earlier address redirects successfully. Message processing, attachments and integrations remain outside this account-free test.", "reportUrl": "/design-evaluations/resource-fudge.json", "identity": { "target": "https://fudge.design/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 63c5fa67aa2c0c4a727718eb5fd279e45548b0523cd84322ad2bd37ac07c5c27 of one initial HTML response (13718 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Current address and redirect", "mode": "browser", "method": "Open fudge.design and design.withfudge.com in separate fresh browser contexts.", "result": "pass", "observation": "Both ended at fudge.design with HTTP 200 and the current workspace UI." }, { "name": "Account boundary", "mode": "browser", "method": "Open Account menu without typing an email or choosing a provider.", "result": "pass", "observation": "An account dialog offered Google sign-in and an email-code flow." }, { "name": "Message and attachment processing", "mode": "browser", "method": "Do not submit messages or files; inspect the public controls only.", "result": "not-run", "observation": "A message textarea and attachment control were visible, but no processing or output was tested." } ], "security": { "scope": "Public workspace navigation, response headers, request destinations and the unsubmitted account menu.", "findings": [ { "level": "caution", "basis": "observed", "title": "Public page contacts multiple third parties", "detail": "The initial page requested analytics/marketing origins including Clarity, PostHog, Google Tag Manager and Reddit-related hosts. Non-GET requests were blocked; no prompt or file was submitted. This reveals a broader page data-flow surface, not a finding about uploaded-content retention." }, { "level": "caution", "basis": "advice", "title": "Inspect data sharing before using real work", "detail": "Check which reference files, URLs and agent integrations are shared with the service and its subprocessors before bringing private projects into the workspace." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Treat the current product as a workspace; confirm a specific export format before building a workflow around it.", "Account-menu access is not evidence that a generation or integration succeeds." ], "limits": [ "No account, prompt response, attachment, agent connection, export or workspace-permission test.", "The write-blocking browser guard can alter analytics and other application behavior." ], "sources": [ { "label": "Current public workspace", "url": "https://fudge.design/" }, { "label": "Earlier address; redirect checked", "url": "https://design.withfudge.com/" } ] } }, { "id": "designmd-me", "title": "DesignMD", "url": "https://designmd.me/", "category": "Design systems", "kind": "Design system extractor", "summary": "Inspect a website’s visual system before drafting new screens.", "whatItIs": "DesignMD describes a website-to-design-system workflow: a URL becomes a DESIGN.md file, an HTML specimen and a Figma import. Use those outputs as a starting inventory to compare with the site before adopting its visual decisions.", "whenUseful": "You have an approved public reference and want concrete style values to review.", "example": "Extract an owned marketing site, compare heading sizes with the live page, and remove accidental one-off colors before adopting the result.", "expectedResult": "A corrected token inventory and implementation brief.", "cautions": [ "The publisher’s claims of exact extraction were not independently tested.", "A crawl can miss authenticated states, responsive behavior and interaction semantics; use public, authorized inputs." ], "requirements": [ "A public website URL; generation and optional exports may require service access." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Current primary documentation describes extraction from websites. No generation, export or account workflow was tested." ], "sources": [ { "label": "Primary product page", "url": "https://designmd.me/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The Discover route opened a public collection of design systems, with reference images loading. The URL-to-design-system generator remained outside the test.", "reportUrl": "/design-evaluations/resource-designmd-me.json", "identity": { "target": "https://designmd.me/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:898ec88e2f1a3885af8b397cb2edfbd9b9c5d208ba548f286ca74b5b42412ef3 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://designmd.me/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “DesignMD — Generate DESIGN.md Files with AI”. 6 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Discover link to https://designmd.me/discover.", "result": "pass", "observation": "The destination returned 200; title: “Discover design systems — DesignMD | DesignMD”. 13 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "DesignMD attempted requests to 3 additional hosts, including www.googletagmanager.com, www.google.com, api.designmd.me. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use Discover to inspect an existing reference before deciding whether to submit a site for extraction." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use Discover to inspect an existing reference before deciding whether to submit a site for extraction.", "The publisher’s claims of exact extraction were not independently tested." ], "limits": [ "No URL was submitted, no generation credit used and no HTML or Figma export produced; account and export requirements remain unverified.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://designmd.me/" }, { "label": "Observed sample or category", "url": "https://designmd.me/discover" } ] } }, { "id": "designmd-supply", "title": "designmd.supply", "url": "https://www.designmd.supply/", "category": "Design systems", "kind": "Design system extractor", "summary": "Create a design brief from a public website’s available visual data.", "whatItIs": "The public tool combines Context.dev brand information, screenshots and markup into a DESIGN.md document. A linked repository makes the implementation available for inspection, but no generator was run in this review.", "whenUseful": "You need a first pass at an owned site’s colors, typography and component language.", "example": "Compare the generated brief for a public documentation site with three actual page states, then annotate gaps.", "expectedResult": "An editable style brief with known omissions.", "cautions": [ "The workflow uses a third-party data service; public input does not mean the processing stays on your machine.", "Generated instructions should be reviewed before an agent receives them, particularly external links and commands." ], "requirements": [ "A public domain and a review step; self-hosting requirements are outside this check." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://www.designmd.supply/" }, { "label": "Official linked repository", "url": "https://github.com/context-dot-dev/designmd-supply" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The public Apple guide opened in Chromium and loaded reference images. A separate HTTP client received 429, so browser access and automated-fetch access differ.", "reportUrl": "/design-evaluations/resource-designmd-supply.json", "identity": { "target": "https://www.designmd.supply/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:7fa234e75cffd7e0827de5e22f7c9f3c36f7fbfdceb889aafd16e326c40d931c — initial HTTP 429 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "blocked", "observation": "The standalone client received 429 at https://www.designmd.supply/. The fresh browser check is reported separately; this is not evidence that the site is offline." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “designmd.supply”. 85 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Apple apple.com · Technology link to https://www.designmd.supply/guides/apple.com.", "result": "pass", "observation": "The destination returned 200; title: “apple.com — designmd.supply”. 6 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "designmd.supply attempted requests to 2 additional hosts, including cdn.databuddy.cc, media.brand.dev. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "An existing guide can be inspected without generating a new one. Generated guidance still needs a token, asset-rights and instruction review." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "An existing guide can be inspected without generating a new one. Generated guidance still needs a token, asset-rights and instruction review.", "The workflow uses a third-party data service; public input does not mean the processing stays on your machine." ], "limits": [ "No domain was submitted to the generator; Context.dev processing, extraction fidelity, quotas and generated-file safety were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.designmd.supply/" }, { "label": "Observed sample or category", "url": "https://www.designmd.supply/guides/apple.com" } ] } }, { "id": "hyperbrowser-designmd", "title": "Hyperbrowser DESIGNMD", "url": "https://design-md.hyperbrowser.ai/", "category": "Design systems", "kind": "Design system extractor", "summary": "A DESIGNMD interface that requires a Hyperbrowser API key before the workflow opens.", "whatItIs": "Hyperbrowser DESIGNMD now loads an API-key gate rather than only a boot screen. The public interface links to Hyperbrowser and the DESIGN.md specification, but extraction and export behavior cannot be established without a key.", "whenUseful": "Consider it when researching extraction options, after confirming the tool’s current behavior.", "example": "Try an owned public demo in a separate evaluation and compare extracted values with browser-computed styles.", "expectedResult": "A candidate to evaluate, not a confirmed extraction result.", "cautions": [ "A masked API-key field does not establish secure storage or restricted downstream use.", "Extraction accuracy, generated files and JavaScript-rendered target-page support were not tested." ], "requirements": [ "A Hyperbrowser API key is required by the visible initial interface.", "A review of key scope, storage and service data handling before supplying credentials or private URLs." ], "reviewStatus": "partial", "reviewedOn": "2026-10-19", "reviewNotes": [ "The public application returned HTTP 200 and displayed a password-type API-key field. Save key was disabled while empty; no key was entered." ], "sources": [ { "label": "Public key gate", "url": "https://design-md.hyperbrowser.ai/" }, { "label": "Specification linked by the application", "url": "https://github.com/google-labs-code/design.md" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser", "source-review" ], "summary": "The application renders an explicit API-key gate. The empty form stays disabled, and extraction is untested because this evaluation uses no credentials.", "reportUrl": "/design-evaluations/resource-hyperbrowser-designmd.json", "identity": { "target": "https://design-md.hyperbrowser.ai/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 9bd26a5482ecc50c3383b9b5b7399853cf1a39000f030ca9d34559a57ec5d81e of one initial HTML response (5659 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Public application load", "mode": "browser", "method": "Navigate to the documented application in a fresh context.", "result": "pass", "observation": "HTTP 200; DESIGNMD and Hyperbrowser API key controls rendered." }, { "name": "Empty credential boundary", "mode": "browser", "method": "Inspect input type and Save key state without entering a value.", "result": "pass", "observation": "One password-type field was present and Save key was disabled." }, { "name": "Extraction and export", "mode": "browser", "method": "Stop at the visible credential boundary.", "result": "not-run", "observation": "No API key, website extraction or generated file was used." } ], "security": { "scope": "Unauthenticated initial interface, HTTPS response metadata and observed request origins.", "findings": [ { "level": "info", "basis": "observed", "title": "Credential entry is an explicit boundary", "detail": "The initial view requires a key and masks its entry. Only the application origin was requested during this initial sample; this does not establish where a submitted key is stored or sent." }, { "level": "caution", "basis": "advice", "title": "Scope a key before connecting it", "detail": "Use the service's documented key permissions and usage controls before entering a credential. The account-free test did not assess storage, rotation, billing exposure or target-URL access." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Budget for an API-backed workflow rather than assuming a keyless public converter.", "Do not infer the output specification is implemented merely because the specification is linked." ], "limits": [ "Credential handling and backend calls were not exercised.", "Current extraction capabilities remain a documentation gap." ], "sources": [ { "label": "Public key gate", "url": "https://design-md.hyperbrowser.ai/" }, { "label": "Specification linked by the application", "url": "https://github.com/google-labs-code/design.md" } ] } }, { "id": "designmd-ai", "title": "DESIGN.md community library", "url": "https://designmd.ai/", "category": "Design systems", "kind": "Design reference library", "summary": "Start with a portable design brief, then make it your own.", "whatItIs": "This community library provides downloadable DESIGN.md systems with browsable tags and examples. It is useful as a structured starting point, provided someone checks how the instructions fit the actual product.", "whenUseful": "You need a coherent visual proposal before building a prototype.", "example": "Choose a restrained dashboard system, replace its brand choices, and write the empty, loading and error states it does not cover.", "expectedResult": "A project-specific system file with reviewed constraints.", "cautions": [ "Community submissions vary in authorship and completeness; a download is not an accessibility review.", "Inspect embedded instructions and linked assets, and confirm reuse terms before incorporating them." ], "requirements": [ "A browser and a compatible text-based design workflow." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://designmd.ai/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Genesis detail opened with its legacy-format label and separate color, typography, spacing and component sections. Public design-system browsing worked.", "reportUrl": "/design-evaluations/resource-designmd-ai.json", "identity": { "target": "https://designmd.ai/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:c4642d80daf852ca2786c7cd5ea30f23d9e2430ba305e35ea9ffa005d27b81b2 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://designmd.ai/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “DESIGN.md - Design Systems for AI Coding”. 84 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Genesis chef 11.8k 4.2k 37 link to https://designmd.ai/chef/genesis.", "result": "pass", "observation": "The destination returned 200; title: “Genesis by @chef | DESIGN.md”. 4 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared default-src, script-src, style-src, font-src, img-src, connect-src, frame-ancestors; it also contained unsafe-inline. X-Frame-Options was DENY. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "DESIGN.md community library attempted requests to 8 additional hosts, including static.cloudflareinsights.com, fonts.googleapis.com, api.fontshare.com, avatars.githubusercontent.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Check the format label and individual author/license before bringing a community system into a project." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "8 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Check the format label and individual author/license before bringing a community system into a project.", "Community submissions vary in authorship and completeness; a download is not an accessibility review." ], "limits": [ "No file was installed or executed, and uploads, account features, CLI and MCP workflows were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://designmd.ai/" }, { "label": "Observed sample or category", "url": "https://designmd.ai/chef/genesis" } ] } }, { "id": "typeui", "title": "TypeUI", "url": "https://www.typeui.sh/", "category": "Design systems", "kind": "AI design toolkit", "summary": "Give an agent structured design guidance and prompts.", "whatItIs": "TypeUI’s current offering spans design skills, UI prompts, brand kits and shared design systems, with MCP integrations. A separate analytics product makes the choice about both design workflow and, when enabled, measurement.", "whenUseful": "You want repeatable design guidance for an existing codebase and can review each proposed change.", "example": "Use one settings-page prompt with your established tokens, then inspect labels, errors and keyboard navigation before accepting the screen.", "expectedResult": "A reviewable UI proposal that follows an existing system.", "cautions": [ "MCP access and analytics collection add different permission and data-handling questions; evaluate them separately.", "Publisher claims of better conversion or privacy were not validated, and no account or integration was connected." ], "requirements": [ "Compatible coding tools and the relevant service access; analytics requires a separate setup decision." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://www.typeui.sh/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The Atlas design-skill preview opened with details and overview content. The browser worked despite a 429 response to the separate HTTP client.", "reportUrl": "/design-evaluations/resource-typeui.json", "identity": { "target": "https://www.typeui.sh/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:426684f52364914a4954dacdf33acbdd8e2704b8b07b8057d9e2f8cefd2442a9 — initial HTTP 429 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "blocked", "observation": "The standalone client received 429 at https://www.typeui.sh/. The fresh browser check is reported separately; this is not evidence that the site is offline." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Build better UI with AI using Codex, Claude & Cursor | TypeUI”. 83 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed View Preview link to https://www.typeui.sh/design-skills/atlas.", "result": "pass", "observation": "The destination returned 200; title: “Atlas Design Skill File | TypeUI”. 4 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "TypeUI attempted requests to 1 additional host, including assets.typeui.sh. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Inspect the preview as design guidance first. Creative skills, analytics and MCP access have different data and permission boundaries." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Inspect the preview as design guidance first. Creative skills, analytics and MCP access have different data and permission boundaries.", "MCP access and analytics collection add different permission and data-handling questions; evaluate them separately." ], "limits": [ "No skill was installed, agent connected, analytics script deployed or paid plan purchased; generated UI quality and account permissions remain untested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.typeui.sh/" }, { "label": "Observed sample or category", "url": "https://www.typeui.sh/design-skills/atlas" } ] } }, { "id": "aura", "title": "Aura", "url": "https://www.aura.build/", "category": "Design systems", "kind": "Website builder", "summary": "Explore and edit a complete page before exporting its implementation.", "whatItIs": "Aura’s primary template documentation describes editable landing-page designs with HTML, CSS and React export. Treat it as a website-building workflow rather than assuming it only produces a design-system file.", "whenUseful": "You need a concrete marketing prototype and a path to inspect its code.", "example": "Remix an approved template for a product overview, replace sample claims, and audit the exported form and mobile layout.", "expectedResult": "A page draft with code available for engineering review.", "cautions": [ "Template export does not verify backend behavior, SEO outcomes or accessibility.", "Review template-specific reuse rights and keep confidential project details out of prompts until data handling is cleared." ], "requirements": [ "A browser and builder access; export availability depends on the selected workflow." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://www.aura.build/" }, { "label": "Primary template and export documentation", "url": "https://www.aura.build/templates" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The Templates link resolved to Aura’s public template route and displayed HTML, CSS and React template guidance. This confirms navigation to the public catalog, not editing or export.", "reportUrl": "/design-evaluations/resource-aura.json", "identity": { "target": "https://www.aura.build/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:18fc5a884f975e79b4c1315b412b298eab204ba0bae63c3c1ddd13e3ece35ae2 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.aura.build/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Create Beautiful Landing Pages with AI | Aura”. 2 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Templates link to https://www.aura.build/browse.", "result": "pass", "observation": "The destination returned 200; title: “Edit & Export Aura Templates for HTML, CSS & React | Aura”. 2 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared frame-ancestors, object-src, base-uri. X-Frame-Options was DENY. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Aura attempted requests to 8 additional hosts, including cdn.jsdelivr.net, fonts.googleapis.com, www.googletagmanager.com, cloud.umami.is. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Check an actual template’s responsive states and license before relying on its advertised export format." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "7 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Check an actual template’s responsive states and license before relying on its advertised export format.", "Template export does not verify backend behavior, SEO outcomes or accessibility." ], "limits": [ "No prompt was submitted, editor session created, template purchased or code exported. Only two page images had decoded during the bounded visit; catalog completeness was not established.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.aura.build/" }, { "label": "Observed sample or category", "url": "https://www.aura.build/browse/components" } ] } }, { "id": "neuform", "title": "Neuform", "url": "https://neuform.ai/", "category": "Design systems", "kind": "AI interface builder", "summary": "Browse interface references and use authenticated remix workflows to explore a design direction.", "whatItIs": "Neuform offers public interface references alongside prompting and remix tools for landing pages, app screens and broader visual systems. Its current FAQ distinguishes public browsing from remixing, saving and private workspaces, which require an account.", "whenUseful": "You want to compare interface directions before committing to an implementation.", "example": "Browse a public reference close to your product's task, then list the layout decisions worth testing. Confirm account, export and ownership terms before trying a remix with project material.", "expectedResult": "A reference-backed design direction, with generated output quality still to test.", "cautions": [ "No generated page, remix, saved project or export was tested.", "Treat the result as a design direction that still needs implementation, accessibility and content review." ], "requirements": [ "A browser for public inspiration and documentation.", "An account for remix, saved projects and private workspaces, according to the current FAQ." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The public application and account controls rendered. Current primary FAQ content confirms the public/account boundary; no authentication or generation was attempted." ], "sources": [ { "label": "Public application", "url": "https://neuform.ai/" }, { "label": "Current account and workflow FAQ", "url": "https://neuform.ai/faq" }, { "label": "Public privacy-policy route", "url": "https://neuform.ai/privacy" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser", "source-review" ], "summary": "Public reference cards and authentication controls render, and the FAQ documents the account boundary. Remixing and generation were not run.", "reportUrl": "/design-evaluations/resource-neuform.json", "identity": { "target": "https://neuform.ai/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 b7219584bdd495451fd7949395a66df47c7b76a7bebc6e10c4a8cc0daa2556b5 of one initial HTML response (6499 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Public application", "mode": "browser", "method": "Open the homepage in a fresh browser context.", "result": "pass", "observation": "HTTP 200; reference cards, remix controls and Google/email sign-in options were visible." }, { "name": "Account requirements", "mode": "source-review", "method": "Read the current primary FAQ.", "result": "pass", "observation": "The FAQ states public browsing is available without signing in and remix/save/private workspace functions require an account." }, { "name": "Generation", "mode": "browser", "method": "Do not invoke remix, authentication or save controls.", "result": "not-run", "observation": "No model output, export fidelity or private-project behavior was tested." } ], "security": { "scope": "Public frontend destinations and primary documentation about account access; no authenticated state.", "findings": [ { "level": "info", "basis": "observed", "title": "Public frontend uses hosted services", "detail": "The page requested a Supabase origin, Google-hosted assets, an icon API and analytics/affiliate script origins. No private design data was entered." }, { "level": "caution", "basis": "advice", "title": "Separate reference browsing from private generation", "detail": "Confirm which prompts, references and outputs become public or remain private before using a real project. The public FAQ's feature boundaries are not a tenant-isolation test." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "The FAQ supports a broader interface-builder description than a landing-page-only label.", "Public reference browsing does not validate generated HTML, app behavior or design-system consistency." ], "limits": [ "No account, prompt, generation, remix, export or subscription workflow.", "Non-GET traffic was blocked; source documentation and interactive frontend behavior were assessed separately." ], "sources": [ { "label": "Public application", "url": "https://neuform.ai/" }, { "label": "Current account and workflow FAQ", "url": "https://neuform.ai/faq" }, { "label": "Public privacy-policy route", "url": "https://neuform.ai/privacy" } ] } }, { "id": "open-design", "title": "OpenDesign", "url": "https://open-design.ai/", "category": "Design systems", "kind": "Design workspace", "summary": "Use a shared design system while iterating on working prototypes.", "whatItIs": "OpenDesign describes a collaborative workspace where coding agents create HTML prototypes, teams comment and work can be exported. Its current product includes local agents and cloud/team options, so the chosen workflow determines where project data travels.", "whenUseful": "You want designers and engineers to review the same interactive prototype.", "example": "Build a synthetic settings flow with an approved system, gather comments, and inspect the revised HTML before handoff.", "expectedResult": "A prototype plus traceable feedback and implementation files.", "cautions": [ "Local-first does not guarantee every path stays local: model providers, cloud workspaces and share links change the data boundary.", "No installation, provider connection or export workflow was tested; inspect repository permissions and dependencies before use." ], "requirements": [ "A supported environment and an agent or cloud account; provider and sharing choices need explicit review." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits.", "Current primary documentation includes cloud and team-sharing options; do not assume all processing is local." ], "sources": [ { "label": "Primary product page", "url": "https://open-design.ai/" }, { "label": "Official linked repository", "url": "https://github.com/nexu-io/open-design" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The Showcase opened an account-free collection of website, app, slide and graphic examples; 27 page images decoded during the visit.", "reportUrl": "/design-evaluations/resource-open-design.json", "identity": { "target": "https://open-design.ai/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:e23709155a662f024b0c20993b98d502e8895368f0d5878f172130261d92345f — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://open-design.ai/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “OpenDesign — Best Open Source Claude Design Alternative”. 79 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed public sample link to https://open-design.ai/showcase/.", "result": "pass", "observation": "The destination returned 200; title: “AI Design Examples: Websites, Apps, Slides & Graphics | OpenDesign”. 27 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "OpenDesign attempted requests to 5 additional hosts, including us-assets.i.posthog.com, www.googletagmanager.com, api.github.com, static.cloudflareinsights.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "The showcase is useful for comparing output styles. It does not establish which local, cloud or model-provider path produced a particular example." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "9 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "The showcase is useful for comparing output styles. It does not establish which local, cloud or model-provider path produced a particular example.", "Local-first does not guarantee every path stays local: model providers, cloud workspaces and share links change the data boundary." ], "limits": [ "No workspace or provider connection was created, no agent was run and no collaboration or export flow was exercised.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://open-design.ai/" }, { "label": "Observed sample or category", "url": "https://open-design.ai/showcase/" } ] } }, { "id": "tastefile", "title": "Tastefile", "url": null, "category": "Design systems", "kind": "Design system extractor", "summary": "Two distinct Tastefile products still need an identity decision.", "whatItIs": "usetastefile.com offers a Figma-CSS or website-reference workflow and a built-in design.md example. tastefile.ai presents a different coding-agent-history workflow; the @tastefile_ai identity could not be independently tied to either publisher, so no confirmed visit link is assigned.", "whenUseful": "Use it as an identification lead when an existing frame should guide a new screen.", "example": "Confirm the publisher first, then compare a synthetic frame’s CSS values with the resulting design file.", "expectedResult": "A confirmed product identity before any design data is submitted.", "cautions": [ "The built-in example at usetastefile.com attempted a generation POST; its local-looking interface is not proof that the whole workflow stays in the browser.", "The similarly named tastefile.ai product exposes an installation command, which was neither run nor treated as an instruction." ], "requirements": [ "Confirm the intended publisher before submitting designs or connecting agent history.", "Review the exact workflow's network behavior and data permissions." ], "reviewStatus": "unverified", "reviewedOn": "2026-10-19", "reviewNotes": [ "Both candidate sites rendered. The usetastefile.com built-in example populated 783 CSS characters and displayed a design.md preview, while an attempted generation POST was blocked by the test guard. Publisher attribution remains unresolved." ], "sources": [ { "label": "Candidate CSS/design.md product; attribution unconfirmed", "url": "https://usetastefile.com/" }, { "label": "Different Tastefile workflow", "url": "https://tastefile.ai/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "unresolved", "modes": [ "http", "browser", "source-review" ], "summary": "Both candidate sites work as public pages, but their relationship to @tastefile_ai remains unconfirmed. The built-in example attempted a backend generation request that the guard blocked.", "reportUrl": "/design-evaluations/resource-tastefile.json", "identity": { "target": "Candidate only; attribution unresolved: https://usetastefile.com/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 688400241e741966e626d8e664814478fc256b2069d93ef5047b34cb85f02d36 of one initial HTML response (234016 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Candidate identities", "mode": "browser", "method": "Open usetastefile.com and tastefile.ai in separate fresh contexts.", "result": "pass", "observation": "Both returned HTTP 200 and described distinct workflows." }, { "name": "Built-in example", "mode": "browser", "method": "Click Try an example without entering user material; keep non-GET traffic blocked.", "result": "pass", "observation": "The editor populated 783 CSS characters and showed a preview labeled design.md with 160 lines." }, { "name": "Generation request boundary", "mode": "browser", "method": "Observe requests during the built-in sample.", "result": "blocked", "observation": "POST /api/generate was attempted and blocked before transmission. The displayed preview does not establish successful backend generation." }, { "name": "Publisher attribution", "mode": "source-review", "method": "Compare public identities and search the exact handle without using an account.", "result": "blocked", "observation": "No primary association between @tastefile_ai and either candidate domain was established." } ], "security": { "scope": "Both public candidate pages and the built-in sample's attempted network behavior.", "findings": [ { "level": "caution", "basis": "observed", "title": "Example action attempts a generation request", "detail": "Even the built-in sample initiated POST /api/generate at usetastefile.com. The guard prevented that request. A preview still appeared, so its presence cannot prove that remote generation succeeded or that processing is entirely local." }, { "level": "caution", "basis": "documented", "title": "The other candidate has a different data surface", "detail": "tastefile.ai publicly frames its workflow around coding-agent history and an installation command. That is materially different from pasting Figma CSS; no installer or history access was tested." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Resolve the publisher identity before recommending an installation or submitting design material.", "Treat the built-in output as a demonstration until generation and data handling are verified." ], "limits": [ "No custom CSS, website URL, file, agent history, credential or installation was submitted.", "Candidate functionality does not resolve the original identity ambiguity." ], "sources": [ { "label": "Candidate CSS/design.md product; attribution unconfirmed", "url": "https://usetastefile.com/" }, { "label": "Different Tastefile workflow", "url": "https://tastefile.ai/" } ] } }, { "id": "ui-skills", "title": "UI Skills", "url": "https://www.ui-skills.com/", "category": "Tokens & playbooks", "kind": "Design playbook", "summary": "Turn broad polish requests into focused review tasks.", "whatItIs": "UI Skills curates design-engineering guidance and skills across accessibility, interaction, motion and visual systems. Its current catalog also offers CLI and MCP access, which should be evaluated separately from reading the playbooks.", "whenUseful": "A first implementation works, but its states and interaction details need a structured review.", "example": "Choose a narrow form-review guide and record defects with reproduction steps instead of asking an agent to redesign everything.", "expectedResult": "A prioritized UI issue list with observable acceptance criteria.", "cautions": [ "Curated skills can come from different authors and carry different permissions or executable helpers.", "The catalog was read; its CLI, MCP and individual skills were not installed or evaluated here." ], "requirements": [ "A concrete screen or component and permission-scoped access for any later agent workflow." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Public search returned nine accessibility-related links. Pinned skill text was inspected as data; no skill was installed or asked to edit a project." ], "sources": [ { "label": "Primary product page", "url": "https://www.ui-skills.com/" }, { "label": "Official linked repository", "url": "https://github.com/ibelick/ui-skills" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser", "source-review" ], "summary": "Public search returned nine accessibility-related links. Pinned skill text was inspected as data; no skill was installed or asked to edit a project.", "reportUrl": "/design-evaluations/resource-ui-skills.json", "identity": { "target": "https://github.com/ibelick/ui-skills", "version": "747a47fdb6b405e5cbf268f7c410123930455157", "integrity": "sha256:fea3322f36d58fdafafce2aef56e4556dd2ac7b20876b7dff7d8be7f25fa597f" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 4 captured button labels; 1 inputs; 0 canvases." }, { "name": "Skill search", "mode": "browser", "method": "Open search, type accessibility and inspect result links", "result": "pass", "observation": "Search dialog returned 9 visible links for the synthetic query; no skill was invoked." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. Also inspected the named pinned skill text as untrusted data. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "documented", "title": "Skill text can authorize project changes only through its host", "detail": "The reviewed accessibility and component-canvas instructions describe code review, edits and preview boundaries. Their usefulness and safety still depend on the agent permissions and the project supplied to it." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "Search functionality does not establish that an agent will find or repair accessibility defects." ] }, "practicalCaveats": [ "Treat the selected SKILL.md as third-party instructions and review its requested tools before adding it to a host.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "Search functionality does not establish that an agent will find or repair accessibility defects.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://www.ui-skills.com/" }, { "label": "Pinned upstream revision", "url": "https://github.com/ibelick/ui-skills/tree/747a47fdb6b405e5cbf268f7c410123930455157" } ] } }, { "id": "design-system-checklist", "title": "Design System Checklist", "url": "https://www.designsystemchecklist.com/", "category": "Tokens & playbooks", "kind": "Checklist", "summary": "Review what a design system needs beyond colors and buttons.", "whatItIs": "This open-source checklist organizes work across design language, foundations, components and maintenance. It gives a team a way to identify missing decisions before similar screens develop different rules.", "whenUseful": "A product is growing from a few screens into a repeatable interface system.", "example": "Review the current form components, mark missing error and disabled states, and assign owners to the gaps.", "expectedResult": "A scoped backlog of system decisions and component work.", "cautions": [ "Checking a box is not evidence that a component works for users.", "Adapt the checklist to the product and verify accessibility with actual implementation tests." ], "requirements": [ "A component inventory and people who can own unresolved decisions." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://www.designsystemchecklist.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Foundations category opened with color, layout, typography, elevation and motion sections. Public checklist navigation worked without an account.", "reportUrl": "/design-evaluations/resource-design-system-checklist.json", "identity": { "target": "https://www.designsystemchecklist.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:ba212416fbf59856e9d97af63f08b0d7c074a0eaf8058e04a2fadee1f33bbf18 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.designsystemchecklist.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Design System Checklist”. 0 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Foundations 0/26 link to https://www.designsystemchecklist.com/category/foundations.", "result": "pass", "observation": "The destination returned 200; title: “Design System Checklist”. 0 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Design System Checklist attempted requests to 2 additional hosts, including vitals.vercel-insights.com, designsystemchecklist.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Turn each relevant checklist item into a test or owner decision. Navigating the checklist does not validate the system being reviewed." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "6 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Turn each relevant checklist item into a test or owner decision. Navigating the checklist does not validate the system being reviewed.", "Checking a box is not evidence that a component works for users." ], "limits": [ "Checkbox persistence, sharing and collaborative state were not changed or tested; no component implementation was audited.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.designsystemchecklist.com/" }, { "label": "Observed sample or category", "url": "https://www.designsystemchecklist.com/category/foundations" } ] } }, { "id": "designsystems-one", "title": "DesignSystems.one", "url": "https://www.designsystems.one/", "category": "Tokens & playbooks", "kind": "Design reference library", "summary": "Compare published systems and inspect their design foundations.", "whatItIs": "DesignSystems.one indexes real design systems, guides and tools, with token and agent-oriented resources. It helps explain how systems are organized; each linked system remains the authority for its own implementation and license.", "whenUseful": "You need to decide how to document tokens, patterns and component ownership.", "example": "Compare the documentation structure of two relevant systems, then write a smaller outline suited to your own product.", "expectedResult": "A documentation plan grounded in real examples.", "cautions": [ "A directory entry does not mean the original system can be copied or that its tokens suit your brand.", "Scanner and generator tools were not run; verify their data flow before using private inputs." ], "requirements": [ "A browser and a clear question about your own system." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://www.designsystems.one/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The IBM Carbon entry opened with origin, governance and token sections. The directory can support a public, account-free comparison of design-system structure.", "reportUrl": "/design-evaluations/resource-designsystems-one.json", "identity": { "target": "https://www.designsystems.one/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:66b477afd357e18c98ea76882ad1020f86121c9fb63ce41a9bbad36aaa751ba5 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.designsystems.one/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “DesignSystems.one | Design Systems, Explained — Gallery, Guides & Tools”. 18 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Carbon link to https://www.designsystems.one/design-systems/carbon-design.", "result": "pass", "observation": "The destination returned 200; title: “IBM Carbon Design System | DesignSystems.one”. 2 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "DesignSystems.one attempted requests to 6 additional hosts, including api.fontshare.com, datafa.st, getmayfly.com, www.google.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Follow the original system documentation before adopting tokens or interpreting an agent-readiness score." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Follow the original system documentation before adopting tokens or interpreting an agent-readiness score.", "A directory entry does not mean the original system can be copied or that its tokens suit your brand." ], "limits": [ "No scanner, generator, agent integration or upstream design-system package was run; directory rankings were not independently reproduced.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.designsystems.one/" }, { "label": "Observed sample or category", "url": "https://www.designsystems.one/design-systems/carbon-design" } ] } }, { "id": "open-props", "title": "Open Props", "url": "https://open-props.style/", "category": "Tokens & playbooks", "kind": "CSS tokens", "summary": "Replace repeated visual guesses with a named CSS scale.", "whatItIs": "Open Props supplies CSS custom properties for values such as spacing, color, shadows and motion. Its pieces can be adopted selectively, which makes it useful when a product needs consistent values without replacing its component architecture.", "whenUseful": "Your CSS contains near-duplicate sizes and shadows with no shared meaning.", "example": "Map a small spacing and radius subset to semantic project tokens, then refactor one card and one form.", "expectedResult": "A controlled token layer with fewer arbitrary values.", "cautions": [ "A token palette does not guarantee usable contrast or appropriate animation.", "Remote CDN imports create a network dependency; review versioning, packaging and any normalization styles before adopting them." ], "requirements": [ "CSS custom-property support and a deliberate mapping to project tokens." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Open Props 1.7.23 resolved the tested spacing, radius, color and responsive type tokens. Five local checks passed; a raw spin token kept moving under reduced motion until the consuming CSS added a media guard." ], "sources": [ { "label": "Primary product page", "url": "https://open-props.style/" }, { "label": "Official linked repository", "url": "https://github.com/argyleink/open-props/blob/main/src/props.animations.css" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture", "source-review" ], "summary": "Open Props 1.7.23 resolved the tested spacing, radius, color and responsive type tokens. Five local checks passed; a raw spin token kept moving under reduced motion until the consuming CSS added a media guard.", "reportUrl": "/design-evaluations/resource-open-props.json", "identity": { "target": "open-props", "version": "1.7.23", "integrity": "sha512-+xyrJmxV9QUBFbSwPROYhOg/FLXry+uuPr4R+B5EaE4556Oc18/8ZC/fL5A+/lbRSwNvA0Alh+C0KpyFWLmLZg==" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables.", "Synthetic local inputs only. Package/skill source inspected before execution; no install lifecycle scripts run.", "Local package/CSS browser fixtures block real network. Variate additionally uses Node filesystem permissions and a no-network preload." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 20 inputs; 0 canvases." }, { "name": "Token application", "mode": "local-fixture", "method": "Apply size-4, radius-2 and blue-6 to a synthetic element", "result": "pass", "observation": "{\"padding\": \"20px\", \"borderRadius\": \"5px\", \"color\": \"rgb(34, 139, 230)\", \"fontSize\": \"16px\"}" }, { "name": "Fluid font scale", "mode": "local-fixture", "method": "Measure font-size-fluid-1 at 320 and1280px viewports", "result": "pass", "observation": "{\"small\": 16, \"large\": 24}" }, { "name": "Color-scheme shadow token", "mode": "local-fixture", "method": "Switch emulated color scheme and read shadow-color", "result": "pass", "observation": "{\"light\": \"220 3% 15%\", \"dark\": \"220 40% 2%\"}" }, { "name": "Inline noise asset", "mode": "local-fixture", "method": "Apply noise-1 and inspect resolved background URL", "result": "pass", "observation": "{\"dataSvg\": true, \"outboundRequests\": 0}" }, { "name": "Reduced motion requires consumer guard", "mode": "local-fixture", "method": "Compare raw spin token with an authored no-preference media wrapper", "result": "pass", "observation": "{\"normal\": [{\"id\": \"unguarded\", \"running\": 1}, {\"id\": \"guarded\", \"running\": 1}], \"reduced\": [{\"id\": \"unguarded\", \"running\": 1}, {\"id\": \"guarded\", \"running\": 0}], \"interpretation\": \"Observed raw animation token keeps running. The consumer media wrapper stops its own animation; this is not a claim of automatic library motion suppression.\"}" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. Also inspected pinned source and the specified synthetic fixture outputs. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Animation tokens need a motion policy", "detail": "The same spin token ran under reduced motion. The authored no-preference wrapper stopped its own animation, showing that the consumer must decide when motion is appropriate." }, { "level": "info", "basis": "observed", "title": "Inspected package and isolated run", "detail": "The pinned package declares no runtime dependencies; registry SHA512 matched. The synthetic browser fixture made zero outbound requests. This does not establish all possible package behavior." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "Only the pinned compiled CSS and representative tokens were exercised; no complete token-build, contrast or browser-compatibility audit." ] }, "practicalCaveats": [ "Map tokens into your own semantic names and add explicit reduced-motion rules before using animation tokens.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "Only the pinned compiled CSS and representative tokens were exercised; no complete token-build, contrast or browser-compatibility audit.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://open-props.style/" }, { "label": "Exact evaluated registry archive", "url": "https://registry.npmjs.org/open-props/-/open-props-1.7.23.tgz" } ] } }, { "id": "utopia", "title": "Utopia", "url": "https://utopia.fyi/", "category": "Tokens & playbooks", "kind": "Responsive design calculator", "summary": "Make type and spacing scale between defined limits.", "whatItIs": "Utopia provides a fluid design approach and calculators for type, space and grids. Designers specify small- and large-screen endpoints, and the browser interpolates between them instead of relying on a separate value at every width.", "whenUseful": "An editorial or marketing layout needs a controlled rhythm across screen sizes.", "example": "Set a modest heading range, apply the generated values, and check long titles at narrow widths and enlarged text.", "expectedResult": "A bounded responsive scale that can be inspected in the page.", "cautions": [ "Fluid sizing can still produce cramped layouts or inadequate text resizing.", "Test actual content, zoom and browser settings; a calculator does not replace responsive QA." ], "requirements": [ "Chosen minimum and maximum values plus a CSS implementation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The public viewport slider changed its preview from 210 to 767 pixels. This confirms that sample interaction; it does not validate every generated type or spacing scale." ], "sources": [ { "label": "Primary product page", "url": "https://utopia.fyi/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The public viewport slider changed its preview from 210 to 767 pixels. This confirms that sample interaction; it does not validate every generated type or spacing scale.", "reportUrl": "/design-evaluations/resource-utopia.json", "identity": { "target": "https://utopia.fyi/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:aa6d29ad9f952590252528431137833483d0801d1a157a4fc60160afd9ecfa58" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 0 captured button labels; 2 inputs; 0 canvases." }, { "name": "Fluid preview slider", "mode": "browser", "method": "Move viewport slider between its minimum and maximum values and compare rendered preview state", "result": "pass", "observation": "[{\"value\":\"210\",\"widths\":[210]},{\"value\":\"767\",\"widths\":[767]}]" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Preview width is not a readability check", "detail": "The slider changed the rendered preview width. That says nothing about text zoom, long translated labels or a chosen scale meeting your reading needs." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No complete calculator-export round trip or font-dependent readability study was performed." ] }, "practicalCaveats": [ "Choose minimum and maximum values with real content, then test the resulting CSS at zoom and narrow widths.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No complete calculator-export round trip or font-dependent readability study was performed.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://utopia.fyi/" } ] } }, { "id": "rauno-interfaces", "title": "Rauno Web Interface Guidelines", "url": "https://interfaces.rauno.me/", "category": "Tokens & playbooks", "kind": "Interaction checklist", "summary": "Inspect the small behaviors that make a page easier to use.", "whatItIs": "Rauno Freiberg’s living guidelines collect details across interaction, typography, motion and layout. The document acknowledges subjective judgments and does not duplicate the WAI-ARIA specification.", "whenUseful": "The main flow works and you need a targeted craft review.", "example": "Check whether labels focus inputs, controls submit correctly and decorative layers intercept clicks.", "expectedResult": "A concrete list of interaction fixes.", "cautions": [ "Some advice, including broad autocomplete restrictions, needs contextual judgment rather than literal adoption.", "Use current accessibility guidance and user needs when a stylistic preference conflicts with familiar browser behavior." ], "requirements": [ "An implemented interface and a way to test its actual states." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://interfaces.rauno.me/" }, { "label": "Official linked repository", "url": "https://github.com/raunofreiberg/interfaces/blob/main/README.md" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The guidelines loaded and the Accessibility section could be brought into view. This confirms that the document is navigable, not that its recommendations certify an implementation.", "reportUrl": "/design-evaluations/resource-rauno-interfaces.json", "identity": { "target": "https://interfaces.rauno.me/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:2ee97ef75073cc321d604f40cd6a47f7a0023a64c167e53363e1f8d0382d1ade — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://interfaces.rauno.me/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Web Interface Guidelines”. 0 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Bring the “Accessibility” section into view.", "result": "pass", "observation": "The section was visible after navigation; scroll position was 1998px." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Observed host boundary", "detail": "The initial Rauno Web Interface Guidelines browser visit attempted requests only to interfaces.rauno.me. This does not cover later features, server-side processing or a complete session." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the recommendations alongside current platform semantics and accessibility requirements; resolve advice that depends on the component’s context." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the recommendations alongside current platform semantics and accessibility requirements; resolve advice that depends on the component’s context.", "Some advice, including broad autocomplete restrictions, needs contextual judgment rather than literal adoption." ], "limits": [ "No component was built from the guidance and no keyboard, assistive-technology or cross-browser implementation test was performed.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://interfaces.rauno.me/" } ] } }, { "id": "ui-playbook", "title": "UI Playbook", "url": "https://uiplaybook.dev/", "category": "Tokens & playbooks", "kind": "Component behavior reference", "summary": "Specify how an interaction should work before choosing its appearance.", "whatItIs": "UI Playbook documents a compact set of UI components, including buttons, fields, notifications and popovers. Use it to structure questions about behavior and states rather than treating the site as a complete application kit.", "whenUseful": "A team agrees on a visual mockup but not on input, validation or feedback behavior.", "example": "Write the expected field label, hint, error and submission states for a simple account form.", "expectedResult": "A component behavior specification for implementation and testing.", "cautions": [ "The collection is limited and some entries are marked as upcoming.", "Cross-check complex accessibility behavior with current platform guidance; documentation alone does not validate your component." ], "requirements": [ "A defined interaction and an implementation team or editor." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://uiplaybook.dev/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Tooltip detail opened with functionality, implementation, examples and accessibility sections. The public component reference is readable without an account.", "reportUrl": "/design-evaluations/resource-ui-playbook.json", "identity": { "target": "https://uiplaybook.dev/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:93c3dc11cc805d556bcb0159fcbd4c80cc10fc3af1f4483c22d3756aee042e07 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://uiplaybook.dev/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “UI Playbook”. 2 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Tooltip label link to https://uiplaybook.dev/play/tooltip.", "result": "pass", "observation": "The destination returned 200; title: “UI Playbook — Tooltip”. 0 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "UI Playbook attempted requests to 3 additional hosts, including www.googletagmanager.com, avatars2.githubusercontent.com, avatar.tobi.sh. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Treat the tooltip page as a behavior checklist; test your own focus, escape and touch behavior separately." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "6 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Treat the tooltip page as a behavior checklist; test your own focus, escape and touch behavior separately.", "The collection is limited and some entries are marked as upcoming." ], "limits": [ "The tooltip example itself was not triggered, and no component package, screen reader or application implementation was tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://uiplaybook.dev/" }, { "label": "Observed sample or category", "url": "https://uiplaybook.dev/play/tooltip" } ] } }, { "id": "if-patterns", "title": "IF Design Patterns Catalogue", "url": "https://catalogue.projectsbyif.com/", "category": "Tokens & playbooks", "kind": "Trust design patterns", "summary": "Make data access and automated decisions understandable.", "whatItIs": "IF curates service-design patterns concerned with trust, information and user control. Current examples include explaining AI capabilities, changing outputs and controlling the level of automation.", "whenUseful": "You are designing permissions, consent, account access or an AI-assisted workflow.", "example": "Add a plain-language preview of what an assistant can change, then provide a review step and a way to change the automation level.", "expectedResult": "A more explicit permission and control flow to test.", "cautions": [ "These are design patterns, not proof of legal compliance or user trust.", "A clear screen cannot compensate for hidden backend access or ineffective controls." ], "requirements": [ "A map of the real data flow, permissions and available user controls." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary product page", "url": "https://catalogue.projectsbyif.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The capabilities-and-limitations pattern opened with description, advantages, limitations and examples. Pattern browsing worked without submitting information.", "reportUrl": "/design-evaluations/resource-if-patterns.json", "identity": { "target": "https://catalogue.projectsbyif.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:ed57a6c386c40261dab9da210a9a8c9a30bb6b5c32c70d30baa8f6e6b087673b — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://catalogue.projectsbyif.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Design Patterns Catalogue”. 203 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Show capabilities and limitations link to https://catalogue.projectsbyif.com/patterns/show-capabilities-and-limitations.", "result": "pass", "observation": "The destination returned 200; title: “Show capabilities and limitations | Patterns Catalogue”. 4 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared default-src, script-src, style-src, font-src, img-src, connect-src, form-action, base-uri, object-src, frame-ancestors, upgrade-insecure-requests; it also contained unsafe-inline. X-Frame-Options was DENY. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "IF Design Patterns Catalogue attempted requests to 1 additional host, including plausible.io. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the pattern to make an AI feature’s boundaries legible, then test the explanation with the people who must rely on it." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the pattern to make an AI feature’s boundaries legible, then test the explanation with the people who must rely on it.", "These are design patterns, not proof of legal compliance or user trust." ], "limits": [ "No service using the pattern was implemented; consent, authentication, backend permissions and legal compliance were not assessed.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://catalogue.projectsbyif.com/" }, { "label": "Observed sample or category", "url": "https://catalogue.projectsbyif.com/patterns/show-capabilities-and-limitations" } ] } }, { "id": "shadcn-ui", "title": "shadcn/ui", "url": "https://ui.shadcn.com/", "category": "Components", "kind": "Component foundation", "summary": "Build an owned component layer with documented starting patterns.", "whatItIs": "shadcn/ui provides composable components whose source can become part of your project. That gives a team control over visual and behavioral changes, together with responsibility for maintaining those changes.", "whenUseful": "You are building a React product that needs consistent forms, dialogs and navigation.", "example": "Create one settings form, map its tokens to the brand, and exercise validation, focus and submission states.", "expectedResult": "A maintainable component foundation and a tested first workflow.", "cautions": [ "Owning the copied source means tracking upstream fixes yourself.", "Accessible defaults can be broken by changed markup, missing labels or custom focus behavior." ], "requirements": [ "A supported project stack; review the selected registry items and dependencies." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The homepage alert-dialog sample opened and closed with Escape after its exit transition. The test did not install registry items into an application." ], "sources": [ { "label": "Primary product documentation", "url": "https://ui.shadcn.com/" }, { "label": "Official linked repository", "url": "https://github.com/shadcn-ui/ui" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The homepage alert-dialog sample opened and closed with Escape after its exit transition. The test did not install registry items into an application.", "reportUrl": "/design-evaluations/resource-shadcn-ui.json", "identity": { "target": "https://ui.shadcn.com/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:b3a1393ef031ed1d26dd1b9c760daf0b8ecaeb02400b2003dd1b57b69a37d405" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 45 captured button labels; 19 inputs; 0 canvases." }, { "name": "Demo alert-dialog keyboard cycle", "mode": "browser", "method": "Activate the public alert-dialog demo and dismiss with Escape", "result": "pass", "observation": "Visible dialogs opened=1, after Escape=0." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "One dialog is a narrow accessibility sample", "detail": "The observed dialog keyboard cycle succeeded. Focus order, assistive-technology announcements and the behavior of other registry items remain separate checks." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No CLI execution, dependency audit, full focus-trap test or screen-reader session." ] }, "practicalCaveats": [ "Inspect the exact registry item and dependencies before copying it, then retest the dialog inside your own layout.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No CLI execution, dependency audit, full focus-trap test or screen-reader session.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://ui.shadcn.com/" } ] } }, { "id": "coss-ui", "title": "coss ui", "url": "https://coss.com/ui", "category": "Components", "kind": "Component foundation", "summary": "Start from Base UI-backed product components.", "whatItIs": "The current coss ui catalog describes a component library built on Base UI. Its inventory covers common product interactions, including command menus, date pickers, comboboxes and chat composers.", "whenUseful": "You need a coherent starting point for a React application with many stateful controls.", "example": "Prototype a scheduling settings screen and verify how the date picker, form labels and confirmation states work together.", "expectedResult": "A consistent application screen ready for integration review.", "cautions": [ "A library’s component inventory does not establish suitability for your application’s framework versions or data flows.", "Integrating a library still requires keyboard, screen-reader and state-management checks in your application." ], "requirements": [ "A compatible React stack and review of each component’s setup documentation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. A documented accordion responded to Enter with aria-expanded false → true → false. This was the hosted sample, not a local Base UI integration." ], "sources": [ { "label": "Primary product documentation", "url": "https://coss.com/ui" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "A documented accordion responded to Enter with aria-expanded false → true → false. This was the hosted sample, not a local Base UI integration.", "reportUrl": "/design-evaluations/resource-coss-ui.json", "identity": { "target": "https://coss.com/ui/docs/components/accordion", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:23a635fbf6fed1a3261f527395fdacca655526368d7d0edbc5419411eccf7ca9" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 3 captured button labels; 0 inputs; 0 canvases." }, { "name": "Accordion keyboard toggle", "mode": "browser", "method": "Focus the first accordion trigger; press Enter twice and inspect aria-expanded", "result": "pass", "observation": "aria-expanded false -> true -> false; label What is Base UI?." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "State semantics were observed in one accordion", "detail": "The tested trigger exposed its expanded state and accepted keyboard activation. That result does not transfer automatically to every copied component or customized wrapper." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No local install, full accordion key-map review or assistive-technology test." ] }, "practicalCaveats": [ "Keep the trigger semantics and keyboard behavior when adapting the component; test content that changes height or wraps.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No local install, full accordion key-map review or assistive-technology test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://coss.com/ui" }, { "label": "Evaluated public sample", "url": "https://coss.com/ui/docs/components/accordion" } ] } }, { "id": "reui", "title": "ReUI", "url": "https://reui.io/components", "category": "Components", "kind": "Advanced components", "summary": "Use documented patterns for dense product interfaces.", "whatItIs": "ReUI publishes shadcn/ui-oriented components and examples for React and Tailwind CSS. The catalog includes data grids, filters, calendars, Kanban and Gantt views, making it relevant when basic primitives do not finish the job.", "whenUseful": "A workflow requires sorting, filtering or scheduling rather than another static card.", "example": "Prototype a work queue with a small synthetic dataset, then test keyboard selection, empty results and loading errors.", "expectedResult": "A realistic interaction prototype for a complex screen.", "cautions": [ "A working demo does not establish behavior at production data volumes.", "ReUI can extend an existing primitive layer; reconcile tokens and shared components instead of assuming universal incompatibility." ], "requirements": [ "React and Tailwind compatibility plus the chosen component’s dependencies." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Searching the component directory for accordion reduced visible component links from 207 to 121. The remaining count includes persistent navigation; data-grid and scheduling behavior were not tested." ], "sources": [ { "label": "Primary product documentation", "url": "https://reui.io/components" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Searching the component directory for accordion reduced visible component links from 207 to 121. The remaining count includes persistent navigation; data-grid and scheduling behavior were not tested.", "reportUrl": "/design-evaluations/resource-reui.json", "identity": { "target": "https://reui.io/components", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:46ea9816261252498ab36de1cc8a94f752080ba1b4b5f6bc437a73335a3ec51e" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 3 inputs; 0 canvases." }, { "name": "Component search filtering", "mode": "browser", "method": "Type accordion into the component search and count visible component links", "result": "pass", "observation": "Visible component links 207 -> 121; no account or install." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Directory filtering does not exercise data access", "detail": "The public search narrowed the directory without submitting application data. Sorting, pagination permissions and server data validation are outside this sample." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No premium access, local install, data-grid mutation, large-data performance or backend integration." ] }, "practicalCaveats": [ "Choose one actual grid or scheduling example and test its state model with synthetic records before connecting a backend.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No premium access, local install, data-grid mutation, large-data performance or backend integration.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://reui.io/components" } ] } }, { "id": "component-gallery", "title": "The Component Gallery", "url": "https://component.gallery/", "category": "Components", "kind": "Component reference", "summary": "Compare several real implementations of the same interaction.", "whatItIs": "The Component Gallery organizes examples from published design systems by component type. It helps expose naming, structure and behavior choices before a team commits to one implementation.", "whenUseful": "You need to decide whether a pattern should be a popover, tooltip, disclosure or dialog.", "example": "Compare three disclosure patterns, note their keyboard expectations, and write a specification for your own content.", "expectedResult": "A reasoned component choice with source references.", "cautions": [ "Links to implementations do not transfer their licenses or validate every example.", "A screenshot hides focus, announcements and error states; inspect the original system before adopting behavior." ], "requirements": [ "A specific interaction question and access to the linked system documentation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The public search returned a visible accordion reference after entering the query. This evaluates browsing the reference collection, not the linked design systems." ], "sources": [ { "label": "Primary product documentation", "url": "https://component.gallery/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The public search returned a visible accordion reference after entering the query. This evaluates browsing the reference collection, not the linked design systems.", "reportUrl": "/design-evaluations/resource-component-gallery.json", "identity": { "target": "https://component.gallery/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:09e360a9b5be2c0dd39bc4c823e97b700b0f1f7da065a4ffa556ad279c54d421" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 6 captured button labels; 1 inputs; 0 canvases." }, { "name": "Component reference search", "mode": "browser", "method": "Open search, enter accordion and inspect rendered results", "result": "pass", "observation": "1 visible accordion result links after search." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "advice", "title": "References cross implementation boundaries", "detail": "A gallery result can point to a different publisher, codebase and set of terms. A successful search is not evidence that those implementations share an accessibility or security standard." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "Only one public search was exercised; linked components were not installed or audited." ] }, "practicalCaveats": [ "Use a reference to compare behavior, then inspect the chosen system and its own documentation.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "Only one public search was exercised; linked components were not installed or audited.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://component.gallery/" } ] } }, { "id": "21st-dev", "title": "21st", "url": "https://21st.dev/", "category": "Components", "kind": "Component registry", "summary": "Find concrete React examples and prompts for a UI draft.", "whatItIs": "21st presents a library of React components, templates and shadcn themes with agent-oriented prompts. It is a discovery layer whose individual contributions still need code, dependency and rights review.", "whenUseful": "You want to compare ready-made approaches to a particular section.", "example": "Select one pricing comparison block, inspect its source and replace all sample offers before testing the narrow layout.", "expectedResult": "A reviewable component draft tailored to actual requirements.", "cautions": [ "Registry or MCP access is a software supply path; inspect what an agent will install or modify.", "Community authors, dependency requirements and reuse terms can differ between entries." ], "requirements": [ "A compatible React project and a review process for third-party code or prompts." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. A public Hover Button detail exposed one preview frame and one code block. The sample was reachable without an account; the component was not installed or functionally exercised inside that frame." ], "sources": [ { "label": "Primary product documentation", "url": "https://21st.dev/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "A public Hover Button detail exposed one preview frame and one code block. The sample was reachable without an account; the component was not installed or functionally exercised inside that frame.", "reportUrl": "/design-evaluations/resource-21st-dev.json", "identity": { "target": "https://21st.dev/@serafimcloud/components/hover-button", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:9bd7ba4c482e8b7e9cc93613da50b8f1dc4c10e60f8a20bf7bd54c8bfa8f53b5" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 27 captured button labels; 0 inputs; 1 canvases." }, { "name": "Public component detail", "mode": "browser", "method": "Load the linked Hover Button detail and inspect preview availability", "result": "pass", "observation": "Detail rendered 1 child frames and 1 code blocks; preview label false. No component installed or bookmark saved." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Community preview code needs its own review", "detail": "A preview frame was present on the public detail. Its availability does not validate the component source, dependencies or execution permissions in your project." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No iframe isolation audit, component installation, paid content or authenticated registry workflow." ] }, "practicalCaveats": [ "Review the individual author, license, imports and external requests before importing a community component.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No iframe isolation audit, component installation, paid content or authenticated registry workflow.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://21st.dev/" }, { "label": "Evaluated public sample", "url": "https://21st.dev/@serafimcloud/components/hover-button" } ] } }, { "id": "aceternity-ui", "title": "Aceternity UI", "url": "https://ui.aceternity.com/", "category": "Components", "kind": "Animated components", "summary": "Use a deliberate visual effect on a marketing surface.", "whatItIs": "Aceternity UI publishes React, Tailwind CSS and Motion components, blocks and templates. Its animated heroes and presentation pieces can give a page a specific treatment when the content and interaction remain readable.", "whenUseful": "You need an expressive product presentation and have room to evaluate its cost.", "example": "Add one animated feature treatment, preserve a static reading order, and compare its mobile and reduced-motion versions.", "expectedResult": "A distinctive section with a usable fallback.", "cautions": [ "Animation and visual density can consume performance and attention budgets.", "Inspect the selected component’s license, dependencies and semantics; no component was installed or benchmarked here." ], "requirements": [ "React, Tailwind and relevant motion dependencies plus performance and accessibility testing." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The 3D-card detail disclosed a visible code block. This confirmed code access, but did not verify the pointer effect, GPU cost or touch behavior." ], "sources": [ { "label": "Primary product documentation", "url": "https://ui.aceternity.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The 3D-card detail disclosed a visible code block. This confirmed code access, but did not verify the pointer effect, GPU cost or touch behavior.", "reportUrl": "/design-evaluations/resource-aceternity-ui.json", "identity": { "target": "https://ui.aceternity.com/components/3d-card-effect", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:75a8a353af2753c8392ec794627a5d9c9964a11fdb417267d033c467991a49d9" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 6 captured button labels; 0 inputs; 0 canvases." }, { "name": "3D-card sample disclosure", "mode": "browser", "method": "Inspect public 3D-card preview and open code tab when exposed", "result": "pass", "observation": "0 preview frames; 1 visible code blocks after disclosure. Pointer effect not assumed from code visibility." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Code disclosure is not an interaction test", "detail": "The bounded sample confirmed that the code could be read. It did not establish that the 3D treatment works with keyboard input, touch or reduced motion." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No local copy, pointer-effect assertion, device frame-rate measurement or full motion-accessibility test." ] }, "practicalCaveats": [ "Keep the card content and primary action usable without the perspective effect.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No local copy, pointer-effect assertion, device frame-rate measurement or full motion-accessibility test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://ui.aceternity.com/" }, { "label": "Evaluated public sample", "url": "https://ui.aceternity.com/components/3d-card-effect" } ] } }, { "id": "react-bits", "title": "React Bits", "url": "https://reactbits.dev/", "category": "Components", "kind": "Animated components", "summary": "Adapt animated source components to a defined visual system.", "whatItIs": "React Bits offers animated components and backgrounds as editable source, with JavaScript or TypeScript and CSS or Tailwind options. The range is useful for controlled experiments rather than a substitute for a complete product system.", "whenUseful": "A page needs a specific text, background or interaction treatment.", "example": "Try a single title effect using approved copy, then verify the title remains readable without animation.", "expectedResult": "An isolated visual treatment that can be removed or tuned.", "cautions": [ "Decorative text effects can harm readability or duplicate screen-reader output.", "A source install still brings dependency and maintenance work; repository access failed during this check although the official link was visible." ], "requirements": [ "A compatible React project and review of the selected installation path." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Selecting Dune changed the live background preset’s aria-checked state; two canvases were present. Visual quality and frame rate were not scored." ], "sources": [ { "label": "Primary product documentation", "url": "https://reactbits.dev/" }, { "label": "Official repository link; retrieval failed", "url": "https://github.com/DavidHDev/react-bits" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Selecting Dune changed the live background preset’s aria-checked state; two canvases were present. Visual quality and frame rate were not scored.", "reportUrl": "/design-evaluations/resource-react-bits.json", "identity": { "target": "https://reactbits.dev/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:111a26d11bcdfbe543e924982c34a1500096d99701244bb7304bb5030f25a998" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 19 captured button labels; 0 inputs; 2 canvases." }, { "name": "Background preset selection", "mode": "browser", "method": "Choose Dune in the live homepage background sample", "result": "pass", "observation": "Preset aria-checked changed=true; canvases=2. Rendering quality and frame rate not scored." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Canvas motion sits outside CSS-only checks", "detail": "The live sample used canvases. Counting CSS or Web Animations API animations cannot establish whether those canvases stop drawing under reduced motion." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No local install, WebGL fallback test, memory profiling or physical-device performance test." ] }, "practicalCaveats": [ "Inspect the selected effect’s render loop, cleanup and motion fallback, especially before using it behind text.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No local install, WebGL fallback test, memory profiling or physical-device performance test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://reactbits.dev/" } ] } }, { "id": "magic-ui", "title": "Magic UI", "url": "https://magicui.design/", "category": "Components", "kind": "Animated components", "summary": "Add a small set of motion components to a product presentation.", "whatItIs": "Magic UI provides animated React components and effects using TypeScript, Tailwind CSS and Motion. Its public page positions the library alongside shadcn/ui and separates components from Pro blocks and templates.", "whenUseful": "You have a working page and want one purposeful attention cue.", "example": "Use a modest reveal for a feature demonstration, then verify keyboard access and an immediate static version.", "expectedResult": "A controlled animated component within the existing page.", "cautions": [ "Library compatibility does not guarantee that several effects will share timing, semantics or acceptable cost.", "Check the terms for the specific component or template; this review makes no blanket free-access claim." ], "requirements": [ "React, TypeScript/Tailwind compatibility and the relevant motion dependencies." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Activating a public testimonial control created a YouTube embed. This tested the site’s media launcher only; library components and playback completion were not tested." ], "sources": [ { "label": "Primary product documentation", "url": "https://magicui.design/" }, { "label": "Official linked repository", "url": "https://github.com/magicuidesign/magicui" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "Activating a public testimonial control created a YouTube embed. This tested the site’s media launcher only; library components and playback completion were not tested.", "reportUrl": "/design-evaluations/resource-magic-ui.json", "identity": { "target": "https://magicui.design/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:6ffc2aaf464d85f13d2d7c83b1344781ef887585ba084ccf46ff8062c2662587" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 14 captured button labels; 0 inputs; 0 canvases." }, { "name": "Public media preview activation", "mode": "browser", "method": "Activate a testimonial Play control and inspect the embedded player", "result": "pass", "observation": "YouTube embedded players 0 -> 1. This tests public media activation only; playback completion and library components were not tested." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Media previews add a third-party dependency", "detail": "The tested control introduced a YouTube iframe. Embedding such media in your own site introduces a separate provider and data-flow decision." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No component installation, authenticated templates, complete media playback or reduced-motion guarantee." ] }, "practicalCaveats": [ "Evaluate the specific component you want to ship; a working marketing-page preview does not establish its runtime behavior.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No component installation, authenticated templates, complete media playback or reduced-motion guarantee.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://magicui.design/" } ] } }, { "id": "hover-dev", "title": "Hover.dev", "url": "https://www.hover.dev/", "category": "Components", "kind": "Animated components", "summary": "Explore interaction treatments with visible code examples.", "whatItIs": "Hover.dev provides animated components and templates for React, Tailwind CSS and Motion. Its library spans small controls and larger sections, so first decide which interaction actually needs emphasis.", "whenUseful": "A button or navigation state needs clearer feedback within an existing interface.", "example": "Adapt one hover treatment to focus-visible and touch states, then verify that the action still reads as a button.", "expectedResult": "One consistent feedback pattern across input methods.", "cautions": [ "Hover alone cannot communicate essential information to keyboard or touch users.", "Effects may need additional dependencies and reduced-motion behavior; public examples were reviewed without installation." ], "requirements": [ "A compatible frontend stack and a defined interaction to improve." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The public CODE control revealed two code blocks. The test confirmed access to example code, not the behavior of a copied component." ], "sources": [ { "label": "Primary product documentation", "url": "https://www.hover.dev/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The public CODE control revealed two code blocks. The test confirmed access to example code, not the behavior of a copied component.", "reportUrl": "/design-evaluations/resource-hover-dev.json", "identity": { "target": "https://www.hover.dev/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:1df48d9173a5bf24e783a5d852607d25cd5e904c0e4ba0cee788322728d69d06" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 18 captured button labels; 1 inputs; 0 canvases." }, { "name": "Component code disclosure", "mode": "browser", "method": "Open the public CODE tab of the visible example", "result": "pass", "observation": "2 visible preformatted code blocks. No paid component accessed." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "advice", "title": "Example code remains application code", "detail": "Reading a demo does not inspect every event handler, dependency or external endpoint that a copied component could use." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No paid content, local component execution, cross-browser interaction or performance measurement." ] }, "practicalCaveats": [ "Review the exact snippet and keep essential button or navigation feedback available to keyboard and touch users.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No paid content, local component execution, cross-browser interaction or performance measurement.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://www.hover.dev/" } ] } }, { "id": "great-ui", "title": "Great UI", "url": "https://www.great-ui.com/", "category": "Components", "kind": "Component collection", "summary": "Find a compact component starting point for a small interface.", "whatItIs": "Great UI presents a curated set of React/Tailwind components with live examples. It can help a small prototype move forward, provided the team checks the component behavior rather than relying on the site’s accessibility description.", "whenUseful": "You need a limited UI surface and can inspect each adopted piece.", "example": "Build a small team page with one accordion and check heading order, focus and expanded states.", "expectedResult": "A focused page draft with a manageable component inventory.", "cautions": [ "The publisher’s accessible-components claim was not independently tested.", "Decide how copied components will share tokens and receive maintenance; adding a second collection is an integration choice, not a universal prohibition." ], "requirements": [ "React/Tailwind compatibility and ownership of the copied implementation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Selecting Accordion changed the homepage showcase text. No expanded-state controls were exposed in that showcase, so accordion keyboard behavior remains unverified." ], "sources": [ { "label": "Primary product documentation", "url": "https://www.great-ui.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "Selecting Accordion changed the homepage showcase text. No expanded-state controls were exposed in that showcase, so accordion keyboard behavior remains unverified.", "reportUrl": "/design-evaluations/resource-great-ui.json", "identity": { "target": "https://www.great-ui.com/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:e306a0c6fcf7e4049b9a1cc8a13980b937d01d6775abe2c478af93696dc48fa2" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 13 captured button labels; 0 inputs; 2 canvases." }, { "name": "Component showcase selection", "mode": "browser", "method": "Select Accordion in the homepage component chooser and inspect the selected showcase", "result": "pass", "observation": "Selected showcase text changed=true; 0 expanded-state controls exposed. This confirms the chooser, not accordion keyboard behavior." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "A showcase selection is not component validation", "detail": "The chooser changed its visible content, but the probe did not reach an interactive accordion. The missing assertion is a coverage limit, not proof that the library’s accordion is broken." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No component installation, actual accordion activation, screen-reader testing or complete component audit." ] }, "practicalCaveats": [ "Open and test the specific component implementation before relying on the collection’s accessibility description.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No component installation, actual accordion activation, screen-reader testing or complete component audit.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://www.great-ui.com/" } ] } }, { "id": "variate", "title": "Variate", "url": "https://github.com/Nutlope/variate", "category": "Components", "kind": "Design exploration skill", "summary": "Compare four coded directions for one component.", "whatItIs": "Variate’s repository describes a compact skill for generating four design variations through coding agents. The value is a structured comparison of alternatives before choosing a direction, rather than accumulating competing styles.", "whenUseful": "The team cannot agree on the hierarchy or composition of a component.", "example": "Generate four synthetic dashboard-header proposals within the same tokens, then compare legibility and task priority.", "expectedResult": "A selected direction with a reason for the choice.", "cautions": [ "The skill can cause an agent to edit project files; review its instructions and scope before running it.", "No skill was installed or executed in this catalog review, and variation quality was not scored." ], "requirements": [ "A supported coding agent, a controlled project and a narrow design brief." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Seven pinned CLI fixture checks passed: baseline preservation, switching, manual-edit adoption, unknown-position refusal, warning output and status. No model generated designs and no sidecar or hooks ran." ], "sources": [ { "label": "Primary product documentation", "url": "https://github.com/Nutlope/variate" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture", "source-review" ], "summary": "Seven pinned CLI fixture checks passed: baseline preservation, switching, manual-edit adoption, unknown-position refusal, warning output and status. No model generated designs and no sidecar or hooks ran.", "reportUrl": "/design-evaluations/resource-variate.json", "identity": { "target": "Nutlope/variate", "version": "3a82377d2e13160d879de18b40b323287f1636d9", "integrity": "cb108762649907a649eb56852dc1797311b0d402074fffaa8b081e7330180e5a" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables.", "Synthetic local inputs only. Package/skill source inspected before execution; no install lifecycle scripts run.", "Local package/CSS browser fixtures block real network. Variate additionally uses Node filesystem permissions and a no-network preload." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 25 captured button labels; 1 inputs; 0 canvases." }, { "name": "Preserved baseline", "mode": "local-fixture", "method": "Register synthetic existing file with four positions", "result": "pass", "observation": "Variant1 bytes equal the original synthetic file." }, { "name": "Variant switch", "mode": "local-fixture", "method": "Select authored variant2 and read target bytes", "result": "pass", "observation": "Target file matches variant2." }, { "name": "Manual edit preservation", "mode": "local-fixture", "method": "Change target fixture, then switch to baseline", "result": "pass", "observation": "Unmatched manual edit retained as variant5 before baseline restored." }, { "name": "Unknown variant refusal", "mode": "local-fixture", "method": "Request absent position99", "result": "pass", "observation": "Exit3; target unchanged." }, { "name": "Export contract warning", "mode": "local-fixture", "method": "Check a variant missing the baseline Button export", "result": "pass", "observation": "Missing export is reported; checker exit remains0 even with warnings." }, { "name": "Parser boundary", "mode": "local-fixture", "method": "Check syntactically invalid variant without a project parser", "result": "pass", "observation": "CLI explicitly reports NOT parsed and returns0; this is not a successful build." }, { "name": "Derived status", "mode": "local-fixture", "method": "Read JSON status after restore", "result": "pass", "observation": "{\"positions\": 5, \"live\": 1, \"port\": null}" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. Also inspected pinned source and the specified synthetic fixture outputs. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Checker success is not build success", "detail": "The CLI returned exit code 0 while reporting a missing export. Without a project parser it explicitly reported NOT parsed, including for the invalid-syntax fixture. Read warnings and run the project build." }, { "level": "caution", "basis": "documented", "title": "The full workflow can rewrite project files and run a local server", "detail": "The inspected skill describes variant replacement, a sidecar and host hooks. The fixture exercised file operations only; it did not evaluate sidecar authorization, host hooks or generated design quality." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No model-quality comparison, live sidecar, token/origin enforcement, hooks, framework injection, path-link/junction behavior or cleanup command test." ] }, "practicalCaveats": [ "Use a disposable branch and explicit project root. Keep ordinary backups, run the actual compiler and review each generated variant before choosing it.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No model-quality comparison, live sidecar, token/origin enforcement, hooks, framework injection, path-link/junction behavior or cleanup command test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://github.com/Nutlope/variate" }, { "label": "Pinned upstream revision", "url": "https://github.com/Nutlope/variate/tree/3a82377d2e13160d879de18b40b323287f1636d9" } ] } }, { "id": "uiverse", "title": "Uiverse", "url": "https://uiverse.io/", "category": "Components", "kind": "Community components", "summary": "Find individual HTML and CSS treatments to inspect and adapt.", "whatItIs": "Uiverse is a community collection of UI elements with code-oriented formats including HTML/CSS, Tailwind and React. It is useful for finding a specific detail, while the receiving product still needs coherent tokens and behavior.", "whenUseful": "A custom card, switch or button needs a concrete starting example.", "example": "Inspect a switch’s markup, replace its decorative values with project tokens, and test it with a keyboard.", "expectedResult": "A small adapted component with understood behavior.", "cautions": [ "Community code varies in quality, accessibility and dependency needs.", "Do not treat a gallery’s reuse summary as a substitute for the selected item’s license and attribution details." ], "requirements": [ "A frontend implementation and willingness to inspect the selected snippet." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The fresh browser received a Cloudflare 403 challenge. No component sample or copy workflow could be exercised in this pass." ], "sources": [ { "label": "Primary product documentation", "url": "https://uiverse.io/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "blocked", "modes": [ "http", "browser" ], "summary": "The fresh browser received a Cloudflare 403 challenge. No component sample or copy workflow could be exercised in this pass.", "reportUrl": "/design-evaluations/resource-uiverse.json", "identity": { "target": "https://uiverse.io/", "version": "Unversioned public page checked 2026-10-19", "integrity": "Unavailable: the initial browser pass did not retain response-body bytes or a hash." }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "blocked", "observation": "HTTP 403; 1 captured button labels; 0 inputs; 0 canvases." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "The access block leaves component behavior unknown", "detail": "The response was an access challenge in this checker. It is not evidence that Uiverse is offline, unsafe or unavailable to an ordinary visitor." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No challenge bypass was attempted. Component runtime, dependencies, keyboard behavior and copy output remain untested." ] }, "practicalCaveats": [ "Inspect the selected author’s snippet and license when access is available; do not treat the collection as a single audited package.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No challenge bypass was attempted. Component runtime, dependencies, keyboard behavior and copy output remain untested.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://uiverse.io/" } ] } }, { "id": "uiable", "title": "UIAble", "url": "https://uiable.com/", "category": "Components", "kind": "Component system", "summary": "Start from shadcn-based blocks and complete interface examples.", "whatItIs": "UIAble describes a structured shadcn-based system with components, blocks, templates and dashboards. Its primary page now identifies Base UI, TypeScript, React/Next.js and Tailwind compatibility.", "whenUseful": "You need reusable application patterns beyond isolated controls.", "example": "Prototype a synthetic operations dashboard, then reconcile the imported blocks with your established form and navigation components.", "expectedResult": "A coherent dashboard draft with a defined component source.", "cautions": [ "A complete-looking dashboard can still lack permissions, loading states and trustworthy data behavior.", "Review the selected product’s access and reuse terms; demos and paid templates can have different conditions." ], "requirements": [ "A supported stack and the relevant component or template access." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The first available demo checkbox toggled false → true → false using Space. No form was submitted and no package was installed." ], "sources": [ { "label": "Primary product documentation", "url": "https://uiable.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The first available demo checkbox toggled false → true → false using Space. No form was submitted and no package was installed.", "reportUrl": "/design-evaluations/resource-uiable.json", "identity": { "target": "https://uiable.com/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:91313396ec47d0691c6645ef38b57fecdb2d0e16f4d7e1a7ba1eb0bd95c505e2" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 15 inputs; 0 canvases." }, { "name": "Demo checkbox state", "mode": "browser", "method": "Toggle the first visible checkbox on and back off without submitting forms", "result": "pass", "observation": "Checkbox false -> true -> false; no form submitted." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Demo state is separate from a real form", "detail": "The keyboard interaction changed local checkbox state. Validation, saved preferences and authorization behind a production form were not involved." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No paid templates, local install, form submission, backend permission or full accessibility test." ] }, "practicalCaveats": [ "Retest labels, error messages and persistence after connecting a copied control to your application.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No paid templates, local install, form submission, backend permission or full accessibility test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://uiable.com/" } ] } }, { "id": "mapcn", "title": "mapcn", "url": "https://www.mapcn.dev/", "category": "Components", "kind": "Map components", "summary": "Put map interactions inside a React product.", "whatItIs": "mapcn provides React map components built on MapLibre and styled with Tailwind. Its examples offer a concrete way to explore location interfaces while separating the UI layer from map data and tile services.", "whenUseful": "A product needs locations, routes or place selection alongside ordinary application controls.", "example": "Display synthetic service locations and provide a synchronized text list for people who cannot use the map.", "expectedResult": "A location interface with a non-map route to the same information.", "cautions": [ "Tile requests and location queries may expose usage or location data to providers.", "Map data attribution, provider quotas and keyboard alternatives need separate review; no map runtime or network behavior was tested." ], "requirements": [ "React, MapLibre-compatible setup and an appropriate map-data/tile provider." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The basic-map sample exposed a tabindex=0 canvas that retained focus after ArrowRight. Camera movement was not verified, so this is an input-affordance check rather than a complete map test." ], "sources": [ { "label": "Primary product documentation", "url": "https://www.mapcn.dev/" }, { "label": "Official linked repository", "url": "https://github.com/AnmolSaini16/mapcn" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The basic-map sample exposed a tabindex=0 canvas that retained focus after ArrowRight. Camera movement was not verified, so this is an input-affordance check rather than a complete map test.", "reportUrl": "/design-evaluations/resource-mapcn.json", "identity": { "target": "https://www.mapcn.dev/docs/basic-map", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:93d5e6380763cc55a893d7f7a57ddad8a518b4123dd22ca1baa511c2d9dd6abb" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 4 captured button labels; 0 inputs; 0 canvases." }, { "name": "Map canvas and keyboard affordance", "mode": "browser", "method": "Inspect loaded map canvas, then focus it and press ArrowRight", "result": "pass", "observation": "Map canvas tabindex=0, retained focus after ArrowRight=true. Camera movement not verified; public tile hosts recorded separately." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Map delivery depends on external data providers", "detail": "The public sample fetched map assets from provider hosts recorded in the evidence. Tiles, styles and map services need their own terms, availability and privacy review." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No geolocation permission, private coordinates, routing request, measured camera change, local install or offline fallback." ] }, "practicalCaveats": [ "Provide a non-map route to essential location information and review the exact tile provider before production use.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No geolocation permission, private coordinates, routing request, measured camera change, local install or offline fallback.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://www.mapcn.dev/" }, { "label": "Evaluated public sample", "url": "https://www.mapcn.dev/docs/basic-map" } ] } }, { "id": "gooey-toast", "title": "gooey-toast", "url": "https://goey-toast.vercel.app/", "category": "Components", "kind": "Notification component", "summary": "Represent an asynchronous action with a changing toast.", "whatItIs": "The primary documentation describes morphing React notifications with promise tracking, actions and configurable timing. The published package spelling is goey-toast even though the product heading uses gooey-toast.", "whenUseful": "A short save or background action needs feedback alongside its persistent state.", "example": "Connect a synthetic save to pending, success and failure messages, with a visible recovery action for errors.", "expectedResult": "A notification sequence tied to real operation results.", "cautions": [ "A transient toast must not be the only record of a failed or consequential action.", "Test announcements, dismissal, reduced motion and focus; the readable evidence came from the primary page’s indexed documentation, not a runtime run." ], "requirements": [ "React, react-dom and framer-motion peer dependencies according to the primary documentation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "The direct public page rendered during this pass. Its Success demo produced notification UI with semantic status nodes. No local package install, real backend action or full accessibility audit was performed." ], "sources": [ { "label": "Primary product documentation", "url": "https://goey-toast.vercel.app/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The public Success demo increased semantic notification nodes from two to four and displayed success text. This was a synthetic notification, not a real save or asynchronous backend workflow.", "reportUrl": "/design-evaluations/resource-gooey-toast.json", "identity": { "target": "https://goey-toast.vercel.app/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:a19f3f88c740372597be59c8fe5b420404082c170a26f97f56054815a44bec5f" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 6 inputs; 0 canvases." }, { "name": "Success notification display", "mode": "browser", "method": "Trigger Success and observe a rendered live/status notification", "result": "pass", "observation": "Semantic notification nodes 2 -> 4; success text detected=true." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "A toast is not proof that an operation succeeded", "detail": "The demo produced notification UI without an underlying business action. Connect success and error states to verified application results, and retain important status outside a disappearing toast." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No local package install, screen-reader session, promise failure integration or real backend action." ] }, "practicalCaveats": [ "Test notification lifetime, keyboard recovery and persistent error handling in the application that will use it.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No local package install, screen-reader session, promise failure integration or real backend action.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures.", "Dismissal, auto-expiry and notification lifetime were not exercised; the sample covers display after activating Success." ], "sources": [ { "label": "Primary public resource", "url": "https://goey-toast.vercel.app/" } ] } }, { "id": "60fps", "title": "60fps", "url": "https://60fps.design/", "category": "Motion & effects", "kind": "Motion reference", "summary": "Study motion as a sequence of states.", "whatItIs": "60fps collects interface animation references from mobile and web products, with shots, storyboards and related resources. It helps reveal how one state leads to the next rather than showing only the final screen.", "whenUseful": "You need a reference for a transition, onboarding moment or feedback sequence.", "example": "Annotate the start, interruption and end states of one reference, then recreate only the behavior needed for your flow.", "expectedResult": "A motion specification with a clear purpose.", "cautions": [ "A gallery name is not a measured frame-rate guarantee.", "References do not establish code reuse rights or accessibility; test the actual implementation." ], "requirements": [ "A browser and a specific interaction to study." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The first public motion-reference video played and progressed beyond one second with readyState 4. This tests playback, not the performance of the interface shown in the clip." ], "sources": [ { "label": "Primary product documentation", "url": "https://60fps.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The first public motion-reference video played and progressed beyond one second with readyState 4. This tests playback, not the performance of the interface shown in the clip.", "reportUrl": "/design-evaluations/resource-60fps.json", "identity": { "target": "https://60fps.design/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:3cfcff2d28794e1038763182730732347a50b5e6789e9eadffccb4d2390fbc95" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 0 inputs; 1 canvases." }, { "name": "Motion reference playback", "mode": "browser", "method": "Play the first public video and read playback progress", "result": "pass", "observation": "[{\"paused\":false,\"time\":1.160605,\"ready\":4},{\"paused\":true,\"time\":0,\"ready\":0},{\"paused\":true,\"time\":0,\"ready\":0}]" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "A recorded example is not a performance benchmark", "detail": "Successful video playback does not establish frame rate, battery impact or motion accessibility of the original product." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No download/reuse rights determination, original-product execution or device performance audit." ] }, "practicalCaveats": [ "Translate the interaction states into your own implementation and test pause, reduced motion and task completion there.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No download/reuse rights determination, original-product execution or device performance audit.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://60fps.design/" } ] } }, { "id": "appmotion", "title": "Appmotion", "url": "https://appmotion.design/", "category": "Motion & effects", "kind": "Motion reference", "summary": "A historically documented motion gallery whose current address returns a host error page.", "whatItIs": "The creator's App Motion launch post links appmotion.design and describes a mobile-motion gallery. The current address returned a Framer site-not-found page in this review, so the historical identity is supported but a working collection could not be evaluated.", "whenUseful": "Keep it on a research shortlist for onboarding, tab changes and list feedback.", "example": "Confirm the gallery is available, then document one state transition relevant to a synthetic app flow.", "expectedResult": "A source to verify before using it in a brief.", "cautions": [ "The observed 404 does not establish a permanent shutdown or why the site is unavailable.", "Historical clips would still need source attribution and permission before reuse." ], "requirements": [ "A working current publisher endpoint before using this as a live reference library." ], "reviewStatus": "partial", "reviewedOn": "2026-10-19", "reviewNotes": [ "The maker's launch post confirms the original address. Two fresh browser visits returned HTTP 404 with a Framer site-not-found page; no alternate current publisher endpoint was established." ], "sources": [ { "label": "Current endpoint; 404 observed", "url": "https://appmotion.design/" }, { "label": "Creator's App Motion launch post", "url": "https://dribbble.com/shots/22799939-App-Motion" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "blocked", "modes": [ "http", "browser", "source-review" ], "summary": "The historical product identity is confirmed by its creator, but the live address returned a Framer 404 on both checks. No gallery sample was available.", "reportUrl": "/design-evaluations/resource-appmotion.json", "identity": { "target": "https://appmotion.design/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 6bf1cd32ca0adcac1450654b07cc736db54bd5dc3c7972a7fb8b8feb9d5bdac2 of one initial HTML response (2627 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Historical identity", "mode": "source-review", "method": "Read the creator's primary launch post on Dribbble.", "result": "pass", "observation": "The post names App Motion and links appmotion.design." }, { "name": "Current endpoint", "mode": "http", "method": "Open the address twice in fresh contexts.", "result": "fail", "observation": "Both checks returned HTTP 404 and a Framer site-not-found page." }, { "name": "Gallery runtime", "mode": "browser", "method": "Look for usable gallery controls at the documented address.", "result": "blocked", "observation": "No gallery entries or motion controls were available to exercise." } ], "security": { "scope": "The public host error response only; the application itself did not load.", "findings": [ { "level": "info", "basis": "observed", "title": "Host response is not application evidence", "detail": "The response includes HSTS and nosniff headers, but it is a Framer error page. These observations say nothing about the former gallery's security or current application code." }, { "level": "caution", "basis": "advice", "title": "Do not substitute a lookalike domain", "detail": "Use a newly confirmed publisher address if the product returns. A similar product name is insufficient evidence for a replacement link." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Use the creator post as historical context rather than a current working motion library.", "The failure is an observed availability condition, not a conclusion about safety or abandonment." ], "limits": [ "No application runtime, clips, downloads, accounts or source code were available at the tested address." ], "sources": [ { "label": "Current endpoint; 404 observed", "url": "https://appmotion.design/" }, { "label": "Creator's App Motion launch post", "url": "https://dribbble.com/shots/22799939-App-Motion" } ] } }, { "id": "motionin", "title": "Motionin", "url": "https://www.motionin.design/", "category": "Motion & effects", "kind": "Animated section prompts", "summary": "Start a section brief from an interactive example.", "whatItIs": "Motionin presents interactive web sections with prompts and categories such as heroes, portfolios and product showcases. It is a source for describing a section’s behavior rather than evidence that a generated result will match it.", "whenUseful": "You want a specific interactive section and can define a static fallback.", "example": "Use one product-showcase prompt, replace its content, and specify how all information remains available without scrolling effects.", "expectedResult": "A bounded section prototype and fallback brief.", "cautions": [ "Generated code can differ from the reference and may add heavy animation dependencies.", "Verify licenses and access for the chosen section, then test motion, keyboard use and mobile cost." ], "requirements": [ "An AI builder or implementation workflow plus review of its generated code." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Selecting Free narrowed the public gallery from 54 to nine visible item links. Paid unlocks and generated implementations were not accessed." ], "sources": [ { "label": "Primary product documentation", "url": "https://www.motionin.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Selecting Free narrowed the public gallery from 54 to nine visible item links. Paid unlocks and generated implementations were not accessed.", "reportUrl": "/design-evaluations/resource-motionin.json", "identity": { "target": "https://www.motionin.design/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:97d46408c7ffc6f940629b8000f8057b1a1ca677aa81375f136551df6fe15696" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 22 captured button labels; 0 inputs; 0 canvases." }, { "name": "Free gallery filter", "mode": "browser", "method": "Select Free and compare visible gallery links", "result": "pass", "observation": "Visible gallery links 54 -> 9; paid unlock not attempted." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "The gallery filter is the tested workflow", "detail": "Public filtering worked. The contents and safety of a generated page remain unknown until the resulting code and dependencies are reviewed." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No paid prompts, account access, model generation, source export or production integration." ] }, "practicalCaveats": [ "Use the free preview to define the interaction, then inspect the output and add a static fallback.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No paid prompts, account access, model generation, source export or production integration.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://www.motionin.design/" } ] } }, { "id": "kinetics", "title": "Kinetics", "url": "https://kinetics.colorion.co/", "category": "Motion & effects", "kind": "Animation snippets", "summary": "Explore spring-like feedback with CSS and React examples.", "whatItIs": "Kinetics publishes interface animation examples with CSS snippets and, where labeled, React versions and prompts. Its examples mix easing approximations and interactive JavaScript, so inspect the selected technique rather than assuming every effect uses the same engine.", "whenUseful": "A control needs a clear response to input without a full animation framework.", "example": "Adapt an expanding panel’s timing while keeping a real button trigger and expanded-state announcement.", "expectedResult": "A small, explainable transition tied to a control.", "cautions": [ "Visual samples may omit production semantics; a clickable div still needs appropriate interaction handling.", "Respect reduced motion and measure layout work on the target device." ], "requirements": [ "CSS or React compatibility and review of the chosen snippet." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Searching the effect library for hover reduced rendered View code controls from 162 to 33. No React snippet was installed." ], "sources": [ { "label": "Primary product documentation", "url": "https://kinetics.colorion.co/" }, { "label": "Official repository documentation", "url": "https://github.com/ckissi/kinetics" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Searching the effect library for hover reduced rendered View code controls from 162 to 33. No React snippet was installed.", "reportUrl": "/design-evaluations/resource-kinetics.json", "identity": { "target": "https://kinetics.colorion.co/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:3717cd16e97d932a68091e755e31e1b0735fe4ff29c37c6313cfa8c2a9c243e9" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 20 inputs; 0 canvases." }, { "name": "Effect search", "mode": "browser", "method": "Search spring library for hover and compare visible View code buttons", "result": "pass", "observation": "Rendered code controls 162 -> 33." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Snippet search leaves effect-specific risks open", "detail": "The public index filtered successfully. The cost, event behavior and reduced-motion handling of any chosen effect still need a direct test." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No full snippet execution, spring-physics correctness study or cross-browser rendering audit." ] }, "practicalCaveats": [ "Test the selected effect’s actual trigger and keyboard equivalent before adopting its CSS or React code.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No full snippet execution, spring-physics correctness study or cross-browser rendering audit.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://kinetics.colorion.co/" } ] } }, { "id": "colorion-animated-buttons", "title": "Colorion Animated Buttons", "url": "https://animatedbuttons.colorion.co/", "category": "Motion & effects", "kind": "CSS button effects", "summary": "Compare button feedback styles without adopting an entire kit.", "whatItIs": "This Colorion library presents CSS button interactions with code to inspect and adapt. It is most useful when a product already has button semantics and needs a restrained visual treatment.", "whenUseful": "A primary action needs feedback consistent with the rest of the interface.", "example": "Apply one effect to an existing semantic button and create matching focus, pressed and disabled states.", "expectedResult": "One button treatment across input methods.", "cautions": [ "Hover-only behavior excludes touch and keyboard users.", "Keep label contrast stable during the effect; check the selected snippet’s reuse conditions." ], "requirements": [ "An existing button component and CSS review." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The first Fill Up CSS sample was disclosed and rendered locally. Its fill panel moved on hover, and the authored native button retained keyboard activation and a visible focus outline." ], "sources": [ { "label": "Primary product documentation", "url": "https://animatedbuttons.colorion.co/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture" ], "summary": "The first Fill Up CSS sample was disclosed and rendered locally. Its fill panel moved on hover, and the authored native button retained keyboard activation and a visible focus outline.", "reportUrl": "/design-evaluations/resource-colorion-animated-buttons.json", "identity": { "target": "colorion-animated-buttons first public CSS sample", "version": "unversioned generated sample", "integrity": "sha256:dd260fbe774b60fa2c079769e7fc349d4be089eb48e941759e9357baa664a592" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables.", "Synthetic local inputs only. Package/skill source inspected before execution; no install lifecycle scripts run.", "Local package/CSS browser fixtures block real network. Variate additionally uses Node filesystem permissions and a no-network preload." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 0 inputs; 0 canvases." }, { "name": "CSS sample generation", "mode": "browser", "method": "Open first CSS disclosure and inspect code or captured copy output; system clipboard is not written", "result": "pass", "observation": "Captured 1247 UTF-8 bytes; SHA256 dd260fbe774b60fa2c079769e7fc349d4be089eb48e941759e9357baa664a592. This verifies disclosed/generated output, not OS clipboard permission." }, { "name": "Fill-panel hover response", "mode": "local-fixture", "method": "Read pseudo-element transform before and after pointer hover", "result": "pass", "observation": "{\"before\": \"matrix(1, 0, 0, 1, 0, 41)\", \"after\": \"matrix(1, 0, 0, 1, 0, 0)\"}" }, { "name": "Native keyboard activation", "mode": "local-fixture", "method": "Tab to authored button and press Enter; inspect local click counter", "result": "pass", "observation": "{\"focused\": true, \"clicks\": 1, \"outlineStyle\": \"auto\", \"outlineWidth\": \"3px\"}" }, { "name": "Visible focus boundary", "mode": "local-fixture", "method": "Inspect computed keyboard focus outline", "result": "pass", "observation": "{\"focused\": true, \"clicks\": 1, \"outlineStyle\": \"auto\", \"outlineWidth\": \"3px\"}" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. Also inspected pinned source and the specified synthetic fixture outputs. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "The tested sample was self-contained CSS", "detail": "The inspected sample contained no remote imports or script, and the isolated render made no outbound requests. That finding covers this hashed sample only." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "One sample only. Clipboard output was captured in memory; no operating-system clipboard permission, full collection or contrast audit." ] }, "practicalCaveats": [ "Keep semantic button markup and test your own colors, disabled state and touch behavior; the sample’s hover treatment alone is not a complete button contract.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "One sample only. Clipboard output was captured in memory; no operating-system clipboard permission, full collection or contrast audit.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://animatedbuttons.colorion.co/" } ] } }, { "id": "colorion-gradient-buttons", "title": "Colorion Gradient Buttons", "url": "https://gradientbuttons.colorion.co/", "category": "Motion & effects", "kind": "CSS button styles", "summary": "Find a gradient treatment for a defined action.", "whatItIs": "Gradient Buttons provides browsable button styles and copyable CSS. Use it to explore color and emphasis while retaining the product’s existing button behavior and hierarchy.", "whenUseful": "A marketing CTA needs a more expressive surface.", "example": "Choose a restrained gradient, map its colors to brand tokens, and check the full hover range behind the label.", "expectedResult": "A styled CTA with legible states.", "cautions": [ "Contrast must hold across the gradient, not just at one sampled point.", "A visual effect does not determine whether an action deserves primary emphasis." ], "requirements": [ "CSS support and a semantic button or link with the appropriate action." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The Sea Blue sample shifted its gradient on hover and activated by keyboard in a local native-button wrapper. Its CSS removed the keyboard outline, leaving one unmet focus expectation." ], "sources": [ { "label": "Primary product documentation", "url": "https://gradientbuttons.colorion.co/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture" ], "summary": "The Sea Blue sample shifted its gradient on hover and activated by keyboard in a local native-button wrapper. Its CSS removed the keyboard outline, leaving one unmet focus expectation.", "reportUrl": "/design-evaluations/resource-colorion-gradient-buttons.json", "identity": { "target": "colorion-gradient-buttons first public CSS sample", "version": "unversioned generated sample", "integrity": "sha256:4fdf9b8a7cf0ffc8f834d1f8b0095cbaf70002ba38da68245df18f91bbc0675b" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables.", "Synthetic local inputs only. Package/skill source inspected before execution; no install lifecycle scripts run.", "Local package/CSS browser fixtures block real network. Variate additionally uses Node filesystem permissions and a no-network preload." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 1 inputs; 0 canvases." }, { "name": "CSS sample generation", "mode": "browser", "method": "Open first CSS disclosure and inspect code or captured copy output; system clipboard is not written", "result": "pass", "observation": "Captured 470 UTF-8 bytes; SHA256 4fdf9b8a7cf0ffc8f834d1f8b0095cbaf70002ba38da68245df18f91bbc0675b. This verifies disclosed/generated output, not OS clipboard permission." }, { "name": "Gradient hover response", "mode": "local-fixture", "method": "Read background position before and after pointer hover", "result": "pass", "observation": "{\"before\": \"0% 0%\", \"after\": \"100% 50%\"}" }, { "name": "Native keyboard activation", "mode": "local-fixture", "method": "Tab to authored button and press Enter; inspect local click counter", "result": "pass", "observation": "{\"focused\": true, \"clicks\": 1, \"outlineStyle\": \"none\", \"outlineWidth\": \"3px\"}" }, { "name": "Visible focus boundary", "mode": "local-fixture", "method": "Inspect computed keyboard focus outline", "result": "fail", "observation": "{\"focused\": true, \"clicks\": 1, \"outlineStyle\": \"none\", \"outlineWidth\": \"3px\"}" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. Also inspected pinned source and the specified synthetic fixture outputs. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "concern", "basis": "observed", "title": "Copied CSS suppresses the keyboard outline", "detail": "The sample includes outline:none. The focused fixture reported outline-style none even though Enter activated the button. Add a visible focus treatment before use." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "One generated sample only; no complete gallery, touch, forced-colors or contrast audit. The native click handler belongs to the authored fixture." ] }, "practicalCaveats": [ "Restore a clear :focus-visible ring and check contrast at both ends of the gradient.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "One generated sample only; no complete gallery, touch, forced-colors or contrast audit. The native click handler belongs to the authored fixture.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://gradientbuttons.colorion.co/" } ] } }, { "id": "colorion-text-effects", "title": "Colorion Text Effects", "url": "https://text-effects.colorion.co/", "category": "Motion & effects", "kind": "CSS text effects", "summary": "Give a short headline a controlled visual treatment.", "whatItIs": "Colorion’s text-effect library provides CSS examples and recreation prompts. Its documentation describes token-based colors and reduced-motion handling, which still need checking after an effect is adapted.", "whenUseful": "A short marketing headline needs emphasis while body copy remains quiet.", "example": "Try one reveal on a short title, preserve the complete accessible text, and compare the reduced-motion rendering.", "expectedResult": "A readable title with a nonessential effect.", "cautions": [ "Blur, splitting and repeated decorative letters can impair reading or screen-reader output.", "Publisher reduced-motion claims were not independently tested; check the chosen snippet in context." ], "requirements": [ "CSS implementation and a way to verify accessible text and motion settings." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The Borealis CSS sample rendered clipped gradient text locally. Its animation continued after reduced motion was requested, leaving one unmet motion-suppression expectation." ], "sources": [ { "label": "Primary product documentation", "url": "https://text-effects.colorion.co/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture" ], "summary": "The Borealis CSS sample rendered clipped gradient text locally. Its animation continued after reduced motion was requested, leaving one unmet motion-suppression expectation.", "reportUrl": "/design-evaluations/resource-colorion-text-effects.json", "identity": { "target": "colorion-text-effects first public CSS sample", "version": "unversioned generated sample", "integrity": "sha256:a05960a4f7b3cd5270f645d7922df710a8109d27a42a9b417d172f5967fa386b" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables.", "Synthetic local inputs only. Package/skill source inspected before execution; no install lifecycle scripts run.", "Local package/CSS browser fixtures block real network. Variate additionally uses Node filesystem permissions and a no-network preload." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 0 inputs; 0 canvases." }, { "name": "CSS sample generation", "mode": "browser", "method": "Open first CSS disclosure and inspect code or captured copy output; system clipboard is not written", "result": "pass", "observation": "Captured 842 UTF-8 bytes; SHA256 a05960a4f7b3cd5270f645d7922df710a8109d27a42a9b417d172f5967fa386b. This verifies disclosed/generated output, not OS clipboard permission." }, { "name": "Text-effect render", "mode": "local-fixture", "method": "Inspect gradient clipping and active CSS animation", "result": "pass", "observation": "{\"animations\": 1, \"clip\": \"text\", \"color\": \"rgba(0, 0, 0, 0)\"}" }, { "name": "Reduced-motion boundary", "mode": "local-fixture", "method": "Switch prefers-reduced-motion to reduce and count this sample animation", "result": "fail", "observation": "{\"runningAfterReduce\": 1, \"interpretation\": \"A remaining animation is an unmet motion-suppression expectation for this copied sample, not a full-library verdict.\"}" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. Also inspected pinned source and the specified synthetic fixture outputs. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "concern", "basis": "observed", "title": "The copied animation does not stop for reduced motion", "detail": "The inspected sample defines an infinite animation without a reduced-motion branch. The local fixture still had one running animation after the preference changed." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "One sample only; no forced-colors, print, contrast or complete collection test. No remote font was loaded." ] }, "practicalCaveats": [ "Add a static reduced-motion style and a readable text fallback before using the effect in a headline.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "One sample only; no forced-colors, print, contrast or complete collection test. No remote font was loaded.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://text-effects.colorion.co/" } ] } }, { "id": "motion-primitives", "title": "Motion Primitives", "url": "https://motion-primitives.com/", "category": "Motion & effects", "kind": "Motion components", "summary": "Build interface transitions from editable components.", "whatItIs": "Motion Primitives provides animated React interface components using Motion and Tailwind CSS, with a public documentation site and official repository. The site includes interactive demonstrations, and the repository still labels the project as beta.", "whenUseful": "An application needs a reusable transition pattern with code under team control.", "example": "Prototype a collapsible details panel and specify focus, interruption and reduced-motion behavior before adopting it.", "expectedResult": "An inspectable component adapted to the application.", "cautions": [ "Beta components can change; a working hosted demo is not a compatibility test for your application.", "Reduced motion was requested during the browser sample, but animation behavior and assistive-technology support were not audited comprehensively." ], "requirements": [ "A compatible React, Motion and Tailwind setup for integration.", "Review the exact copied component and dependency versions before production use." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The documentation site now loads. A public dialog opened and dismissed with Escape after its exit animation; no component was installed into a local application." ], "sources": [ { "label": "Public component demos", "url": "https://motion-primitives.com/" }, { "label": "Official repository", "url": "https://github.com/ibelick/motion-primitives" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The public demo opens a dialog and closes it with Escape. The documentation gap is resolved; local integration, dependency safety and comprehensive accessibility remain untested.", "reportUrl": "/design-evaluations/resource-motion-primitives.json", "identity": { "target": "https://motion-primitives.com/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 95f092f909856db76014bbca882ebcc1cea8d8e884ef86c954959ed52ea7544d of one initial HTML response (71246 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Public documentation", "mode": "browser", "method": "Open the site and confirm the linked official repository.", "result": "pass", "observation": "HTTP 200 and interactive component demos rendered." }, { "name": "Dialog interaction", "mode": "browser", "method": "Open the public dialog, wait for animation, press Escape and wait for exit.", "result": "pass", "observation": "Visible dialog count changed from 1 to 0." }, { "name": "Application integration", "mode": "browser", "method": "Install or copy the component into a project.", "result": "not-run", "observation": "This lane tested the publisher's hosted demo, not a pinned local dependency fixture." } ], "security": { "scope": "Public demo navigation, request destinations and official repository description; no dependency audit.", "findings": [ { "level": "info", "basis": "observed", "title": "Demo media comes from several origins", "detail": "The initial demo loaded image/media assets from Pinterest, Spotify and Cosmos-related hosts alongside analytics scripts. That is a property of the hosted example, not proof that copied components make the same requests." }, { "level": "caution", "basis": "advice", "title": "Audit the component you actually adopt", "detail": "Inspect imports, dependencies and any remote assets in the selected component. Validate focus handling and reduced-motion behavior inside your own application." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Wait for exit animations when checking dialog state; the initial immediate count was premature and the delayed check resolved it.", "A hosted-demo pass does not establish library-wide keyboard or screen-reader behavior." ], "limits": [ "No package installation, lockfile audit, local build, performance benchmark or full accessibility test.", "Only one dialog sample was asserted; other components were not validated." ], "sources": [ { "label": "Public component demos", "url": "https://motion-primitives.com/" }, { "label": "Official repository", "url": "https://github.com/ibelick/motion-primitives" } ] } }, { "id": "microkit", "title": "MicroKit UI", "url": "https://microkit.co/", "category": "Motion & effects", "kind": "Microinteraction components", "summary": "Use small interaction examples to clarify feedback.", "whatItIs": "MicroKit offers copyable React and CSS microinteractions, with an official shadcn registry link. Its collection includes navigation, input and button treatments that can be evaluated individually.", "whenUseful": "A working product needs clearer feedback at a few specific moments.", "example": "Adapt a tab indicator while retaining the tab semantics and an obvious selected state without motion.", "expectedResult": "A focused interaction improvement.", "cautions": [ "A hover or drag demo may need an alternative for keyboard and touch use.", "Registry installation modifies project code and dependencies; inspect the chosen item before use." ], "requirements": [ "CSS or a supported React/TypeScript/Tailwind setup, depending on the component." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Selecting Activity changed the visible Expanding Icon Tabs sample’s DOM state. This checked the public interaction; the registry component was not installed." ], "sources": [ { "label": "Primary product documentation", "url": "https://microkit.co/" }, { "label": "Official repository documentation", "url": "https://github.com/henriquegpb/microkit" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Selecting Activity changed the visible Expanding Icon Tabs sample’s DOM state. This checked the public interaction; the registry component was not installed.", "reportUrl": "/design-evaluations/resource-microkit.json", "identity": { "target": "https://microkit.co/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:a43e35480145d326797b4e2ae53a5e83f64d98461761635999728496c3132a57" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 6 inputs; 0 canvases." }, { "name": "Interactive tabs sample", "mode": "browser", "method": "Switch the visible Expanding Icon Tabs sample from Overview to Activity", "result": "pass", "observation": "Activity control DOM state changed=true; no user data or backend request submitted." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Demo selection does not validate application callbacks", "detail": "The sample changed its rendered control state without a backend. A copied tab can still require correct content association, labels and app-level routing." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No local registry install, full tab key-map, screen reader or application callback test." ] }, "practicalCaveats": [ "Test keyboard navigation and content association after integrating the selected component, rather than inheriting a gallery result.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No local registry install, full tab key-map, screen reader or application callback test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://microkit.co/" } ] } }, { "id": "liquid-glass", "title": "Liquid Glass by Sam Asante", "url": "https://glass.samasante.com/?view=docs", "category": "Motion & effects", "kind": "Refraction component", "summary": "Add a refractive surface while keeping content readable.", "whatItIs": "The primary documentation describes a headless React Glass component that refracts DOM content or uses WebGL for video and canvas. It distinguishes the visual lens from the crisp content layer on top.", "whenUseful": "A decorative surface needs a specific glass treatment and a plain fallback is acceptable.", "example": "Place a nonessential glass frame behind a card, then test contrast over light, dark and moving backgrounds.", "expectedResult": "A decorative effect with stable readable content.", "cautions": [ "Refraction can distort nearby information and consume rendering resources.", "Browser-compatibility and accessibility claims were not tested; media modes also need asset permissions and network review." ], "requirements": [ "React 18 or newer per the documentation; evaluate the selected DOM or WebGL mode." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Switching the documentation example to npm produced its install command. The refractive DOM/WebGL component itself was not executed in this pass." ], "sources": [ { "label": "Primary product documentation", "url": "https://glass.samasante.com/?view=docs" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "Switching the documentation example to npm produced its install command. The refractive DOM/WebGL component itself was not executed in this pass.", "reportUrl": "/design-evaluations/resource-liquid-glass.json", "identity": { "target": "https://glass.samasante.com/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:776e9f0cceb2448675744483190f75bdcf03aaa795de99e44b22f771d27b0e6b" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 6 captured button labels; 0 inputs; 0 canvases." }, { "name": "Package-manager documentation switch", "mode": "browser", "method": "Switch installation example from pnpm to npm and inspect command output", "result": "pass", "observation": "npm install command rendered=true. Refractive rendering not exercised on docs view." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Installation instructions do not establish rendering safety", "detail": "The docs switch worked, but browser support, DOM capture behavior, GPU cost and fallback readability remain untested." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No package install, DOM/WebGL rendering, capture privacy, GPU profiling or cross-browser fallback test." ] }, "practicalCaveats": [ "Try the exact mode with synthetic content and inspect what it captures before putting sensitive application UI behind it.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No package install, DOM/WebGL rendering, capture privacy, GPU profiling or cross-browser fallback test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://glass.samasante.com/?view=docs" }, { "label": "Evaluated public sample", "url": "https://glass.samasante.com/" } ] } }, { "id": "anim8", "title": "Anim8", "url": "https://www.tryanim8.com/", "category": "Motion & effects", "kind": "Animation editor", "summary": "Edit motion as vector artwork and export an animated asset.", "whatItIs": "Anim8’s current primary material describes an editor with keyframes and MP4-to-vector animation conversion, plus animated SVG export. This is broader than a basic keyframe utility and can involve uploading source media.", "whenUseful": "You need a custom short animation and want to inspect or edit its frames.", "example": "Use a synthetic icon loop, inspect the exported SVG structure and provide a static version in the page.", "expectedResult": "A reviewed animated asset and fallback.", "cautions": [ "Uploading video can disclose its contents; check storage and processing terms before using private or client media.", "Export size, fidelity, scripting and reduced-motion behavior were not tested." ], "requirements": [ "Browser-based service access and rights to the source artwork or video." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Selecting the bundled Sample image changed the public demo state. No user file was uploaded, and vectorization or export was not invoked." ], "sources": [ { "label": "Primary product documentation", "url": "https://www.tryanim8.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "Selecting the bundled Sample image changed the public demo state. No user file was uploaded, and vectorization or export was not invoked.", "reportUrl": "/design-evaluations/resource-anim8.json", "identity": { "target": "https://www.tryanim8.com/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:5845c46fb05268001556e7a17a84fcc4065b7a6058a948e9daf1e3e6b6d65516" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 15 captured button labels; 1 inputs; 0 canvases." }, { "name": "Bundled sample selection", "mode": "browser", "method": "Select Sample image without uploading or running vectorization", "result": "pass", "observation": "Sample selection changed visible page text=true; image elements=14. Vectorize and export not invoked because service processing scope was not established." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Sample selection does not test service processing", "detail": "The account-free page exposed sample controls, but this pass did not establish where vectorization runs or what processing/export access requires." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No upload, processing request, paid access, animation editing, output quality or export verification." ] }, "practicalCaveats": [ "Confirm the processing and retention path with a nonprivate fixture before submitting artwork or video.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No upload, processing request, paid access, animation editing, output quality or export verification.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://www.tryanim8.com/" } ] } }, { "id": "animejs", "title": "Anime.js", "url": "https://animejs.com/", "category": "Motion & effects", "kind": "Animation engine", "summary": "Coordinate custom animation with a programmable timeline.", "whatItIs": "Anime.js is a JavaScript animation engine with timelines, easings, SVG tools, scroll observation and draggable behavior. It is useful when the motion logic needs more explicit control than a single CSS transition.", "whenUseful": "Several elements need to animate in a coordinated, interruptible sequence.", "example": "Animate a synthetic process diagram, expose pause behavior, and skip the sequence when reduced motion is requested.", "expectedResult": "A maintainable animation sequence with documented states.", "cautions": [ "Animation code can add main-thread work and conflict with framework updates.", "An animation engine does not supply interaction semantics; keyboard access and focus remain application responsibilities." ], "requirements": [ "JavaScript integration and a measured motion/performance budget." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Anime.js 4.5.0 passed seven local checks covering object and DOM interpolation, sequencing, revert, empty targets and explicit pause. Default animation still ran under reduced motion." ], "sources": [ { "label": "Primary product documentation", "url": "https://animejs.com/" }, { "label": "Official repository documentation", "url": "https://github.com/juliangarnier/anime" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture", "source-review" ], "summary": "Anime.js 4.5.0 passed seven local checks covering object and DOM interpolation, sequencing, revert, empty targets and explicit pause. Default animation still ran under reduced motion.", "reportUrl": "/design-evaluations/resource-animejs.json", "identity": { "target": "animejs", "version": "4.5.0", "integrity": "sha512-NQimYX+lz8WaXonGS9zVVoviCIAjONeJayxacUditaivYLqyXgGjFKjuyl0aUUhFKm5MriX9ty1TGovNzoJQWA==" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables.", "Synthetic local inputs only. Package/skill source inspected before execution; no install lifecycle scripts run.", "Local package/CSS browser fixtures block real network. Variate additionally uses Node filesystem permissions and a no-network preload." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 11 captured button labels; 3 inputs; 6 canvases." }, { "name": "Object interpolation", "mode": "local-fixture", "method": "Seek a paused linear numeric animation at0/500/1000ms", "result": "pass", "observation": "[0, 50, 100]" }, { "name": "Object revert", "mode": "local-fixture", "method": "Revert the numeric animation and inspect original value", "result": "pass", "observation": "{\"x\": 0}" }, { "name": "Timeline sequencing", "mode": "local-fixture", "method": "Schedule two100ms animations and seek to150ms", "result": "pass", "observation": "{\"first\": 100, \"second\": 100}" }, { "name": "DOM style interpolation", "mode": "local-fixture", "method": "Seek a synthetic box to50% of transform/opacity animation", "result": "pass", "observation": "{\"transform\": \"matrix(1, 0, 0, 1, 50, 0)\", \"opacity\": \"0.625\"}" }, { "name": "DOM cleanup", "mode": "local-fixture", "method": "Revert DOM animation and inspect inline properties", "result": "pass", "observation": "{\"opacity\": \"0.25\", \"transform\": \"\"}" }, { "name": "Empty-target handling", "mode": "local-fixture", "method": "Construct and revert paused animation with an empty target list", "result": "pass", "observation": "{\"accepted\": true}" }, { "name": "Motion preference and pause", "mode": "local-fixture", "method": "Start synthetic default animation under reduced motion, then explicitly pause", "result": "pass", "observation": "{\"prefersReduced\": true, \"value\": 11, \"unchanged\": true}" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. Also inspected pinned source and the specified synthetic fixture outputs. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "The animation engine does not choose the motion policy", "detail": "The synthetic animation advanced while prefers-reduced-motion was reduce. Explicit pause stopped it; consumers must connect motion preferences to their own playback decisions." }, { "level": "info", "basis": "observed", "title": "Inspected package and isolated run", "detail": "The pinned package declares no runtime dependencies; registry SHA512 matched. The synthetic browser fixture made zero outbound requests. This does not establish all possible package behavior." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No full engine audit, draggable/scroll/WebGL adapter test, framework lifecycle suite or physical-device performance measurement." ] }, "practicalCaveats": [ "Use scopes/revert or equivalent lifecycle cleanup, wire reduced motion deliberately, and measure the real page on slower devices.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No full engine audit, draggable/scroll/WebGL adapter test, framework lifecycle suite or physical-device performance measurement.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://animejs.com/" }, { "label": "Exact evaluated registry archive", "url": "https://registry.npmjs.org/animejs/-/animejs-4.5.0.tgz" } ] } }, { "id": "jakub-gooey", "title": "Libraries.dev Gooey", "url": "https://libraries.dev/gooey", "category": "Motion & effects", "kind": "Effect library", "summary": "Explore a merging, liquid visual motif.", "whatItIs": "The former gooey.jakubantalik.com page announces its move to Libraries.dev. The current library presents gooey effects for React, giving the treatment a maintained documentation destination to inspect.", "whenUseful": "A small decorative interaction benefits from shapes appearing to merge.", "example": "Apply the effect to a synthetic icon treatment while keeping the actual button hit area and label unchanged.", "expectedResult": "One visual motif within a stable control.", "cautions": [ "Merging shapes can hide boundaries or make targets ambiguous.", "Check the current package, license and reduced-motion options; no effect was installed or rendered here." ], "requirements": [ "A compatible implementation and a nonessential effect boundary." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Changing Goo blur from six to sixteen changed the sample SVG Gaussian-blur value to sixteen. This verifies one live parameter, not the full React library." ], "sources": [ { "label": "Primary product documentation", "url": "https://libraries.dev/gooey" }, { "label": "Earlier product address", "url": "https://gooey.jakubantalik.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Changing Goo blur from six to sixteen changed the sample SVG Gaussian-blur value to sixteen. This verifies one live parameter, not the full React library.", "reportUrl": "/design-evaluations/resource-jakub-gooey.json", "identity": { "target": "https://libraries.dev/gooey", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:6cdd51682a05a774905513eb3b8421db8892e83da0109ab965518c25a2f24bed" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 22 captured button labels; 4 inputs; 0 canvases." }, { "name": "Gooey control response", "mode": "browser", "method": "Adjust Goo blur range and inspect value plus SVG filter output", "result": "pass", "observation": "Slider 6 -> 16; Gaussian deviations [\"6\",\"6\",\"6\",\"16\"]." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Filter strength changes the rendered treatment", "detail": "The public control changed an SVG filter value. Readability and rendering cost can vary with the chosen blur and the content beneath it." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No local package install, frame-rate measurement, screen reader or full browser support test." ] }, "practicalCaveats": [ "Keep the effect decorative and test the real action without it, including reduced motion and low-power devices.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No local package install, frame-rate measurement, screen reader or full browser support test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://libraries.dev/gooey" } ] } }, { "id": "jakub-beam", "title": "Libraries.dev Border Beam", "url": "https://libraries.dev/beam.html", "category": "Motion & effects", "kind": "Effect library", "summary": "Use a moving border as a limited attention cue.", "whatItIs": "The former beam.jakubantalik.com site points to Libraries.dev, whose current catalog includes Border Beam. The effect places a moving highlight around a surface and should be treated as decoration.", "whenUseful": "One status card needs temporary emphasis after a meaningful event.", "example": "Highlight a newly completed task briefly, while a static label communicates its completion.", "expectedResult": "An optional attention cue with a clear stopping condition.", "cautions": [ "A moving border must not replace the visible focus indicator or status text.", "Persistent movement can distract; verify reduced motion and current package documentation before implementation." ], "requirements": [ "A defined attention event and review of the current library’s setup." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The dedicated Border Beam playground exposed running animations and two code blocks after opening Install & Usage. The review now links directly to that playground." ], "sources": [ { "label": "Dedicated primary playground and documentation", "url": "https://libraries.dev/beam.html" }, { "label": "Earlier product address", "url": "https://beam.jakubantalik.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The dedicated Border Beam playground exposed running animations and two code blocks after opening Install & Usage. The review now links directly to that playground.", "reportUrl": "/design-evaluations/resource-jakub-beam.json", "identity": { "target": "https://libraries.dev/beam", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:5ced446e50c5098c9144a13e6878184032dcb6f85182689b5fa44e5446b67cdc" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 9 captured button labels; 2 inputs; 0 canvases." }, { "name": "Border-beam playground", "mode": "browser", "method": "Inspect animation samples and switch install disclosure", "result": "pass", "observation": "18 running Web Animations API-visible animations; 2 visible install/code blocks. Motion frame rate and reduced-motion completeness untested." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Visible motion remains after the preference switch", "detail": "The bounded page still had Web Animations API-visible animations after reduced motion was requested. This is a page-level observation; canvas, timers and each individual component were not audited." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No library installation, full animation inventory, GPU/performance measurement or paid variants." ] }, "practicalCaveats": [ "Use the beam for a limited event, provide a quiet state and verify the chosen component’s own reduced-motion behavior.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No library installation, full animation inventory, GPU/performance measurement or paid variants.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://libraries.dev/" }, { "label": "Evaluated public sample", "url": "https://libraries.dev/beam" } ] } }, { "id": "jakub-metal", "title": "Libraries.dev Liquid Metal", "url": "https://libraries.dev/metal", "category": "Motion & effects", "kind": "WebGL effect", "summary": "Apply a metallic effect with a usable plain component underneath.", "whatItIs": "Libraries.dev documents a liquid-metal treatment for buttons, text and badges using WebGL in the web version. Its documentation describes a fallback to the child element when the rendering capability is unavailable.", "whenUseful": "A brand presentation needs one metallic accent without changing the action itself.", "example": "Wrap a synthetic promotional button, then compare the plain fallback, contrast and motion behavior.", "expectedResult": "A decorative surface that preserves the original action.", "cautions": [ "Shader effects can increase GPU use and behave differently across devices.", "The documented fallback and compatibility were not runtime-tested; review the selected engine version and dependencies." ], "requirements": [ "React 18 or newer and WebGL2 for the documented web effect, with a fallback." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Switching between v1 and v2 changed the public demo state; twelve canvases were present. GPU output quality and fallback behavior were not scored." ], "sources": [ { "label": "Primary product documentation", "url": "https://libraries.dev/metal" }, { "label": "Earlier product address", "url": "https://metal.jakubantalik.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Switching between v1 and v2 changed the public demo state; twelve canvases were present. GPU output quality and fallback behavior were not scored.", "reportUrl": "/design-evaluations/resource-jakub-metal.json", "identity": { "target": "https://libraries.dev/metal", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:f2137d37990753f3b5b811a8387649217bd1f2a918f14f921f127c93af8966ed" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 26 captured button labels; 4 inputs; 12 canvases." }, { "name": "Metal effect version switch", "mode": "browser", "method": "Activate v1 then v2 in the public effect playground", "result": "pass", "observation": "Visible state changed across version toggles=true; canvases=12. GPU quality not scored." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Canvas presence requires a separate fallback test", "detail": "The observed playground used multiple canvases. A successful version switch does not establish WebGL availability, readable fallback content or acceptable power use." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No local install, WebGL-loss simulation, mobile GPU test, physical-device frame rate or paid studio access." ] }, "practicalCaveats": [ "Keep the action label and plain component usable when the metallic surface cannot render.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No local install, WebGL-loss simulation, mobile GPU test, physical-device frame rate or paid studio access.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://libraries.dev/metal" } ] } }, { "id": "jakub-orbs", "title": "Libraries.dev Thinking Orbs", "url": "https://libraries.dev/orbs", "category": "Motion & effects", "kind": "Status animation", "summary": "Show an active process without implying knowledge of its inner workings.", "whatItIs": "Thinking Orbs provides animated states for AI interface loading indicators, now documented at Libraries.dev. It is a visual status component; its state labels do not prove that a model is literally searching, solving or thinking.", "whenUseful": "A background operation needs a calm activity indicator.", "example": "Connect a synthetic request to an orb and a plain-language status label, then stop both on success or failure.", "expectedResult": "Activity feedback tied to the actual operation state.", "cautions": [ "Avoid presenting decorative states as evidence of model reasoning or progress.", "Provide timeout, error and cancellation behavior separately; motion must not be the only status signal." ], "requirements": [ "A supported platform; the documented web component requires React 18 or newer." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Choosing Searching and then Listening changed the public demo state in both cases. These were synthetic labels, not evidence of an agent performing those activities." ], "sources": [ { "label": "Primary product documentation", "url": "https://libraries.dev/orbs" }, { "label": "Earlier product address", "url": "https://orbs.jakubantalik.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Choosing Searching and then Listening changed the public demo state in both cases. These were synthetic labels, not evidence of an agent performing those activities.", "reportUrl": "/design-evaluations/resource-jakub-orbs.json", "identity": { "target": "https://libraries.dev/orbs", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:07c03abb902661fcfa3cd945b1ad44835ec58859f4a863a5fc933433acfd8859" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 32 captured button labels; 2 inputs; 10 canvases." }, { "name": "Orb state selection", "mode": "browser", "method": "Select Searching then Listening in the public state demo", "result": "pass", "observation": "Visible demo state changed for both selections=true. No actual agent task is represented by this synthetic demo." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "An animated state label must follow real application state", "detail": "The demo can switch among states without doing a task. In a product, the label should reflect a known operation and preserve errors, cancellation and completion outside the animation." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No model execution, live task instrumentation, package installation or complete assistive-technology test." ] }, "practicalCaveats": [ "Wire the indicator to real state transitions and include readable status text plus a still alternative.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No model execution, live task instrumentation, package installation or complete assistive-technology test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://libraries.dev/orbs" } ] } }, { "id": "circle-loaders", "title": "Circle Loaders", "url": "https://circleloaders.dominikakissi.com/", "category": "Motion & effects", "kind": "SVG loading indicators", "summary": "Use a self-contained animated SVG for a waiting state.", "whatItIs": "Circle Loaders presents circular indicators with inline SVG markup, keyframes and color settings. The source examples make the asset inspectable without requiring an entire animation package.", "whenUseful": "A short background wait needs a compact visual cue.", "example": "Place one loader beside a textual loading message and show a recovery action if the request fails.", "expectedResult": "A consistent loading state with a visible endpoint.", "cautions": [ "A spinner communicates activity, not percentage complete or a guaranteed finish time.", "Check announcements, static fallback and animation duration in the receiving interface." ], "requirements": [ "SVG/CSS support and application logic for completion, failure and cancellation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Selecting 2× halved the observed animation-duration samples from 2400 to 1200 milliseconds. The page’s counted CSS animations stopped when reduced motion was requested." ], "sources": [ { "label": "Primary product documentation", "url": "https://circleloaders.dominikakissi.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Selecting 2× halved the observed animation-duration samples from 2400 to 1200 milliseconds. The page’s counted CSS animations stopped when reduced motion was requested.", "reportUrl": "/design-evaluations/resource-circle-loaders.json", "identity": { "target": "https://circleloaders.dominikakissi.com/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:3b09e853844c06d334fc70702550f490a04c0ffc49f6851eb6b5806aaca7a2da" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 55 captured button labels; 0 inputs; 0 canvases." }, { "name": "Loader speed control", "mode": "browser", "method": "Activate 2x playback and inspect CSS animation durations", "result": "pass", "observation": "Duration samples [2400,2400,2400,2400,2400,2400,2400,2400] -> [1200,1200,1200,1200,1200,1200,1200,1200]." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Motion behavior is only part of a loading state", "detail": "The sampled speed control and media preference changed animation behavior. They do not provide application completion, timeout, failure or accessible status semantics." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No downloaded SVG integration, screen-reader announcements, complete collection or frame-rate test." ] }, "practicalCaveats": [ "Pair the visual loader with useful status text, bounded waiting and a way to recover from failure.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No downloaded SVG integration, screen-reader announcements, complete collection or frame-rate test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://circleloaders.dominikakissi.com/" } ] } }, { "id": "getlayers", "title": "GetLayers", "url": "https://www.getlayers.ai/", "category": "Motion & effects", "kind": "Templates and visual assets", "summary": "Start from a concrete scene or section and adapt it to the brief.", "whatItIs": "GetLayers offers website prompts, sections, scenes, backgrounds and browser design tools, with additional source and integration options. Its materials distinguish prompts from editable implementation assets, which matters when estimating the work left to ship.", "whenUseful": "A marketing page needs a specific visual concept and the team can evaluate the result.", "example": "Choose one product-showcase scene, replace sample content, and test whether the page remains useful with effects disabled.", "expectedResult": "A scoped visual prototype and implementation checklist.", "cautions": [ "Source files, prompts and integrations have different access conditions; verify the selected item’s terms.", "Heavy media and 3D effects need device, accessibility and network checks; publisher performance claims were not reproduced." ], "requirements": [ "The chosen asset access plus an implementation stack suited to its format." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. A public template link opened the Herbier Blanc detail. Account/unlock language remained visible; source export and paid access were not tested." ], "sources": [ { "label": "Primary product documentation", "url": "https://www.getlayers.ai/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "A public template link opened the Herbier Blanc detail. Account/unlock language remained visible; source export and paid access were not tested.", "reportUrl": "/design-evaluations/resource-getlayers.json", "identity": { "target": "https://www.getlayers.ai/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:be67050c3b8231fd5dddb71cec6070b27f8cf69b35b040b00bc695a9407dc665" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 1 inputs; 0 canvases." }, { "name": "Public template detail browsing", "mode": "browser", "method": "Open first linked template and inspect preview/code access boundary", "result": "pass", "observation": "Reached https://www.getlayers.ai/layer/herbier-blanc; iframe previews=0; account/unlock language=true. No export or unlock requested." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Preview access does not grant asset or code access", "detail": "The public detail could be browsed, but the test did not unlock a template or verify redistribution terms for its images, fonts or code." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No sign-in, purchase, export, AI generation, local rendering or downstream asset workflow." ] }, "practicalCaveats": [ "Check the exact asset license and implementation dependencies before committing to a template.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No sign-in, purchase, export, AI generation, local rendering or downstream asset workflow.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://www.getlayers.ai/" } ] } }, { "id": "scrolltide", "title": "Scrolltide", "url": "https://www.scrolltide.co/", "category": "Motion & effects", "kind": "Animated page templates", "summary": "Use a full-page motion brief when the story needs it.", "whatItIs": "Scrolltide’s current library describes scroll-driven website templates and prompts, with sections, shaders and components. A full-page template can guide composition, but it also brings assumptions about content, navigation and rendering.", "whenUseful": "A launch page depends on a sequence of visual demonstrations.", "example": "Adapt one public template to a short synthetic story and define an equivalent linear page for reduced motion.", "expectedResult": "A complete page draft with a simpler reading path.", "cautions": [ "Scroll effects can interfere with navigation or hide content if JavaScript fails.", "Verify the selected template’s framework, assets and license; no template was purchased or built here." ], "requirements": [ "Template access, an appropriate frontend stack and a static/reduced-motion plan." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Selecting Navigation changed the public component-gallery results. The sample did not copy paid prompts or execute a generated page." ], "sources": [ { "label": "Primary product documentation", "url": "https://www.scrolltide.co/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Selecting Navigation changed the public component-gallery results. The sample did not copy paid prompts or execute a generated page.", "reportUrl": "/design-evaluations/resource-scrolltide.json", "identity": { "target": "https://www.scrolltide.co/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:033680b6e844d8f4c8ff8ef905aa8b971d446bd38326c0e29ad253a36cca0290" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 70 captured button labels; 6 inputs; 1 canvases." }, { "name": "Component category filter", "mode": "browser", "method": "Select Navigation in the public component gallery", "result": "pass", "observation": "Visible gallery text changed after Navigation filter; preview buttons=64. No paid prompt copied." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "A filtered preview is not shipped-page evidence", "detail": "The gallery responded to its category control. Scroll behavior, dependencies and static fallback in an exported implementation remain unknown." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No paid access, prompt generation, template export, local install or production performance test." ] }, "practicalCaveats": [ "Review the selected output with JavaScript disabled and reduced motion before making motion carry essential content.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No paid access, prompt generation, template export, local install or production performance test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://www.scrolltide.co/" } ] } }, { "id": "kage", "title": "Kage", "url": "https://kage.design/", "category": "Motion & effects", "kind": "Reference-to-prompt library", "summary": "Turn a real interface reference into an explicit starting brief.", "whatItIs": "Kage organizes real product interfaces, components and page types and offers prompts for coding tools. The useful step is translating an observed layout into requirements that can be reviewed against your own product.", "whenUseful": "An agent needs a concrete composition target for one screen or section.", "example": "Pick a pricing reference, describe the hierarchy you want, and replace the original offer and identity before generation.", "expectedResult": "A specific layout brief rather than a vague aesthetic request.", "cautions": [ "Recreation prompts do not transfer rights to the reference design, copy or assets.", "Generated output still needs semantic, responsive and accessibility review." ], "requirements": [ "A chosen reference and a project brief with owned content." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The public search field accepted dashboard, but the bounded search probe did not establish a changed result set. Reference browsing was reachable; search effectiveness remains unconfirmed." ], "sources": [ { "label": "Primary product documentation", "url": "https://kage.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The public search field accepted dashboard, but the bounded search probe did not establish a changed result set. Reference browsing was reachable; search effectiveness remains unconfirmed.", "reportUrl": "/design-evaluations/resource-kage.json", "identity": { "target": "https://kage.design/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:823e60912a776e2e7692a90b95ee8c3eb86c017399f5051c58cca0b3ab63a024" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 15 captured button labels; 2 inputs; 1 canvases." }, { "name": "Reference search", "mode": "browser", "method": "Type dashboard into the public search field without submitting a site", "result": "fail", "observation": "Visible links 195 -> 195 after the synthetic GET search. Search-result relevance not independently scored; submission fields untouched." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Search acceptance is weaker evidence than search results", "detail": "The query was retained while the global visible-link count stayed195. This may reflect the page structure or checker scope; it is not proof that search is broken." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No confirmed search-result relevance, prompt generation, model execution or site submission." ] }, "practicalCaveats": [ "Inspect the reference manually and write an original brief with owned content; do not assume a search result grants reuse rights.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No confirmed search-result relevance, prompt generation, model execution or site submission.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://kage.design/" } ] } }, { "id": "vibe-prompts", "title": "VibePrompt", "url": "https://vibeprompts.dev/", "category": "Motion & effects", "kind": "UI prompt library", "summary": "Give a coding tool a more specific section request.", "whatItIs": "VibePrompt groups layout prompts by jobs such as authentication, pricing, onboarding and dashboards. It can reduce ambiguity in a brief while leaving the resulting markup and behavior to be evaluated.", "whenUseful": "You know the section you need but have not specified its structure.", "example": "Adapt a contact-section prompt with actual field requirements, validation messages and the established design tokens.", "expectedResult": "A concrete section draft with explicit acceptance criteria.", "cautions": [ "A prompt’s promise of ready-to-ship code is not a test result.", "Generated forms need real submission, error and privacy behavior; placeholder copy must be replaced." ], "requirements": [ "A coding workflow, approved content and a review of generated code." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. Entering dashboard changed the visible prompt-search results. No prompt was sent to a model and no generated page was evaluated." ], "sources": [ { "label": "Primary product documentation", "url": "https://vibeprompts.dev/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Entering dashboard changed the visible prompt-search results. No prompt was sent to a model and no generated page was evaluated.", "reportUrl": "/design-evaluations/resource-vibe-prompts.json", "identity": { "target": "https://vibeprompts.dev/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:a2ecd33e4c75c9bc6bd14d74d8fc53f638e34d46f05478a721279a4dd0b64d43" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 3 captured button labels; 1 inputs; 0 canvases." }, { "name": "Prompt search", "mode": "browser", "method": "Search dashboard and compare public prompt links", "result": "pass", "observation": "Visible result text changed for dashboard; no prompt sent to a model." } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "advice", "title": "Prompts are untrusted task input", "detail": "The directory search worked. Copied prompts can still request dependencies, external services or design choices that do not fit the receiving project." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No model output, dependency installation, source export, paid workflow or generated-UI security test." ] }, "practicalCaveats": [ "Review the prompt against your project constraints and inspect the generated code before running it.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No model output, dependency installation, source export, paid workflow or generated-UI security test.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://vibeprompts.dev/" } ] } }, { "id": "navbar-gallery", "title": "Navbar Gallery", "url": "https://www.navbar.gallery/", "category": "Section galleries", "kind": "Navigation reference", "summary": "Choose navigation that fits the information structure.", "whatItIs": "Navbar Gallery groups navigation examples by patterns such as static bars, dropdowns, sidebars and breadcrumbs. It helps compare the shape of navigation before choosing its visual treatment.", "whenUseful": "A site is growing and visitors need a clearer route to content.", "example": "Compare a simple header and a sidebar against an actual list of destinations, then test both with representative tasks.", "expectedResult": "A navigation proposal tied to content and tasks.", "cautions": [ "A screenshot does not show focus order, submenu dismissal or small-screen behavior.", "Avoid copying a complex menu solely because it looks polished; implement and test appropriate keyboard interaction." ], "requirements": [ "A content map and a realistic set of navigation tasks." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.navbar.gallery/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The dropdown/fly-out category opened and loaded reference images. The gallery’s category navigation worked; the photographed menus were not operated.", "reportUrl": "/design-evaluations/resource-navbar-gallery.json", "identity": { "target": "https://www.navbar.gallery/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:61436fc404de8a94838331c87026a77f3c95429613c814e54160382a463ba4d9 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.navbar.gallery/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Navbar Gallery – Navigation Design Inspiration”. 156 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Explore dropdown or flyout navbars link to https://www.navbar.gallery/type/dropdowns.", "result": "pass", "observation": "The destination returned 200; title: “100+ Best Examples of Dropdown Menu Designs | Navbar Gallery”. 15 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared frame-ancestors. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Navbar Gallery attempted requests to 7 additional hosts, including cdn.prod.website-files.com, d3e54v103j8qbb.cloudfront.net, plausible.io, cdn.navbar.gallery. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the category to compare information hierarchy, then build and test keyboard opening, dismissal and mobile behavior independently." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the category to compare information hierarchy, then build and test keyboard opening, dismissal and mobile behavior independently.", "A screenshot does not show focus order, submenu dismissal or small-screen behavior." ], "limits": [ "No linked production navbar, template purchase or submitted site was tested; screenshots do not reveal all interaction states.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.navbar.gallery/" }, { "label": "Observed sample or category", "url": "https://www.navbar.gallery/type/dropdowns" } ] } }, { "id": "supahero", "title": "Supahero", "url": "https://supahero.io/", "category": "Section galleries", "kind": "Hero reference", "summary": "Study how the first screen explains a page.", "whatItIs": "Supahero curates website hero sections and states that it is now part of Screensdesign. The examples help compare headline, supporting detail, product image and action placement.", "whenUseful": "The top of a marketing page is attractive but unclear.", "example": "Compare three hero structures using the same short product explanation and one meaningful action.", "expectedResult": "A clearer first-screen composition.", "cautions": [ "Hero references do not prove comprehension or conversion outcomes.", "Replace all borrowed copy and artwork, then test reading order and cropping on small screens." ], "requirements": [ "A precise message, an intended action and owned visual assets." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://supahero.io/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Better Stack hero detail opened and its reference image decoded. Public hero-sample browsing worked.", "reportUrl": "/design-evaluations/resource-supahero.json", "identity": { "target": "https://supahero.io/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:0609abd87053578224487da35d69f7572c6f8d352077e05266f9fd7f718cfcbc — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://supahero.io/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Supahero - Website hero section library”. 574 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Better Stack link to https://supahero.io/hero/better-stack.", "result": "pass", "observation": "The destination returned 200; title: “Better Stack Hero Section - Supahero”. 1 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Supahero attempted requests to 3 additional hosts, including static.cloudflareinsights.com, cloudflareinsights.com, pub-26e6aa63ed7942ecb7e9dbc72f09f164.r2.dev. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Compare message hierarchy and visual balance rather than treating the reference as proof of conversion performance." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "6 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Compare message hierarchy and visual balance rather than treating the reference as proof of conversion performance.", "Hero references do not prove comprehension or conversion outcomes." ], "limits": [ "The source website, animation behavior, asset licenses and downstream Screensdesign account features were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://supahero.io/" }, { "label": "Observed sample or category", "url": "https://supahero.io/hero/better-stack" } ] } }, { "id": "cta-gallery", "title": "CTA Gallery", "url": "https://www.cta.gallery/", "category": "Section galleries", "kind": "Action-section reference", "summary": "Compare how a page asks someone to take the next step.", "whatItIs": "CTA Gallery organizes examples including buttons, forms, modals and pricing actions. It is useful for observing hierarchy and surrounding context, while the action’s value and terms must come from your own offer.", "whenUseful": "A page has several competing actions or an unclear next step.", "example": "Compare a short contact form with a direct scheduling link, including what happens after submission.", "expectedResult": "An action section with a clear expectation and recovery path.", "cautions": [ "Gallery claims about maximizing conversions are not evidence for your audience.", "Avoid manipulative defaults and verify form labels, consent language and error feedback." ], "requirements": [ "A legitimate next step and a defined post-action workflow." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.cta.gallery/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Modal / Pop-up category opened with CTA reference images. This checked browsing the examples, without activating or submitting the example calls to action.", "reportUrl": "/design-evaluations/resource-cta-gallery.json", "identity": { "target": "https://www.cta.gallery/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:af177d7b2a416a009d62ee86635b1774a52c180b3940262b20d7e803de4f7c55 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.cta.gallery/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “CTA.gallery | The Best Call-to-Action Inspiration for Designers”. 134 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Modal / Pop-up link to https://www.cta.gallery/categories/modal-pop-up.", "result": "pass", "observation": "The destination returned 200; title: “Best CTA Designs for Modal / Pop-up | Call-to-Action Examples”. 97 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "CTA Gallery attempted requests to 5 additional hosts, including www.googletagmanager.com, events.framer.com, framerusercontent.com, framer.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "A persuasive modal still needs clear dismissal, consent and recovery behavior. Gallery copy about conversions was not verified." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "6 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "A persuasive modal still needs clear dismissal, consent and recovery behavior. Gallery copy about conversions was not verified.", "Gallery claims about maximizing conversions are not evidence for your audience." ], "limits": [ "No source-site form, modal keyboard behavior, subscriber flow or conversion experiment was run.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.cta.gallery/" }, { "label": "Observed sample or category", "url": "https://www.cta.gallery/categories/modal-pop-up" } ] } }, { "id": "footer-design", "title": "Footer Design", "url": "https://www.footer.design/", "category": "Section galleries", "kind": "Footer reference", "summary": "Make the end of the page useful.", "whatItIs": "Footer Design collects footers by visual style and composition. It can help a team organize secondary navigation, contact information and other end-of-page content without leaving a generic afterthought.", "whenUseful": "Visitors reach the bottom and still need a route to support or related information.", "example": "Group a small set of real destinations and contact details, then compare a compact layout with a multi-column version.", "expectedResult": "A footer that helps visitors continue or recover.", "cautions": [ "A striking footer can bury essential links under oversized decoration.", "Do not copy another company’s legal or trust claims; check link labels and reading order." ], "requirements": [ "An accurate list of secondary destinations and approved contact details." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.footer.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Grid style category opened with named footer references, including Harvest Hall and Heron AI. Category browsing and image delivery worked.", "reportUrl": "/design-evaluations/resource-footer-design.json", "identity": { "target": "https://www.footer.design/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:2eabf3c13be4d2fe78bee1e558ac2bbb4696fdc04cae6e24ea27ce26aa107f35 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.footer.design/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Footer — The only footer gallery on earth.”. 27 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Grid link to https://www.footer.design/styles/grid.", "result": "pass", "observation": "The destination returned 200; title: “Footer | Grid Footers — The only footer gallery on earth.”. 25 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared frame-ancestors. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Footer Design attempted requests to 8 additional hosts, including cdn.prod.website-files.com, ajax.googleapis.com, www.google.com, fonts.googleapis.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the grid examples to organize information; keep essential help and legal routes reachable in your own page structure." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "5 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the grid examples to organize information; keep essential help and legal routes reachable in your own page structure.", "A striking footer can bury essential links under oversized decoration." ], "limits": [ "The referenced sites’ links, responsive footers, legal claims and accessibility were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.footer.design/" }, { "label": "Observed sample or category", "url": "https://www.footer.design/styles/grid" } ] } }, { "id": "404s-design", "title": "404s", "url": "https://www.404s.design/", "category": "Section galleries", "kind": "Error-page reference", "summary": "Give a missing page a useful recovery path.", "whatItIs": "404s curates error-page designs with style and interaction filters. It offers visual ideas for an edge case whose main job remains helping a visitor find the right destination.", "whenUseful": "A site needs a purposeful missing-page experience.", "example": "Use one restrained composition with a clear explanation, a home link and relevant search or section links.", "expectedResult": "A recoverable error page within the site’s identity.", "cautions": [ "An entertaining page still needs the correct HTTP status and accessible navigation.", "Avoid effects that delay recovery or imply the visitor caused the failure." ], "requirements": [ "A real 404 route and tested recovery destinations." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.404s.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Ente gallery detail opened with a reference image and related entries. The gallery detail returned 200, which is expected for a reference page and says nothing about Ente’s actual error response.", "reportUrl": "/design-evaluations/resource-404s-design.json", "identity": { "target": "https://www.404s.design/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:4863e918d52e65049a52c81ecdcb79cf42e40680e49f9f00c8553f1baad23939 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.404s.design/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “404s — A Curated Gallery of Creative Error Page Designs”. 50 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Ente link to https://www.404s.design/sites/ente.", "result": "pass", "observation": "The destination returned 200; title: “Ente”. 15 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared frame-ancestors. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "404s attempted requests to 11 additional hosts, including cdn.prod.website-files.com, cdn.jsdelivr.net, ajax.googleapis.com, cdnjs.cloudflare.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Test the real route’s HTTP status and recovery paths after designing a 404 page; an attractive screenshot does not establish either." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Test the real route’s HTTP status and recovery paths after designing a 404 page; an attractive screenshot does not establish either.", "An entertaining page still needs the correct HTTP status and accessible navigation." ], "limits": [ "No source-site missing URL was requested. Some script errors occurred in the anonymous session, so this is a bounded detail-view result, not an all-controls pass.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.404s.design/" }, { "label": "Observed sample or category", "url": "https://www.404s.design/sites/ente" } ] } }, { "id": "unsection", "title": "Unsection", "url": "https://www.unsection.com/", "category": "Section galleries", "kind": "Section reference", "summary": "Research the part of a page that needs work.", "whatItIs": "Unsection organizes website examples by sections such as pricing, features, testimonials and FAQs. This makes it easier to examine a specific composition without borrowing an entire site’s look.", "whenUseful": "One section needs better hierarchy while the rest of the page already works.", "example": "Compare three feature sections using your actual headings, evidence and content length.", "expectedResult": "A section layout matched to the information it contains.", "cautions": [ "An isolated screenshot hides the surrounding narrative and responsive behavior.", "Examples are references, not a license to reuse assets or endorse their claims." ], "requirements": [ "A defined section purpose and realistic content." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.unsection.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The Pricing category displayed section references and an explicit prompt to join to keep browsing. Public sampling works, with an account boundary visible in the result.", "reportUrl": "/design-evaluations/resource-unsection.json", "identity": { "target": "https://www.unsection.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:3e28230c642c24d2784c19e7a4237d509ec90b669ce4a90b46a0d9b9e6d1d2ad — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.unsection.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Section-First Website Design Inspiration | Unsection”. 65 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Pricing link to https://www.unsection.com/category/pricing-section-design.", "result": "pass", "observation": "The destination returned 200; title: “Pricing Section Design Examples | Unsection”. 23 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Unsection attempted requests to 5 additional hosts, including unsection.b-cdn.net, www.supafeedback.com, www.googletagmanager.com, mrkr.app. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the available sample to compare pricing hierarchy before deciding whether deeper research justifies an account." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "18 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the available sample to compare pricing hierarchy before deciding whether deeper research justifies an account.", "An isolated screenshot hides the surrounding narrative and responsive behavior." ], "limits": [ "The join gate was not crossed; saved sections, full catalog access, downloads and referenced pricing behavior remain untested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.unsection.com/" }, { "label": "Observed sample or category", "url": "https://www.unsection.com/category/pricing-section-design" } ] } }, { "id": "bento-grids", "title": "Bento Grids", "url": "https://bentogrids.com/", "category": "Section galleries", "kind": "Layout reference", "summary": "Study compact feature mosaics and inspect their source references.", "whatItIs": "Bento Grids collects compact, card-based layout references with links back to their sources. Its separate template page points to Figma-oriented starting points; the gallery itself is inspiration rather than a tested production component library.", "whenUseful": "A page needs to present several related features without making every item look equally important.", "example": "Pick one grid reference, replace its labels with your actual long and short feature descriptions, and test reading order on a narrow screen.", "expectedResult": "A layout hypothesis with explicit content and responsiveness checks.", "cautions": [ "A reference screenshot does not establish responsive behavior or accessibility.", "Keep reading order sensible when cards resize or rearrange; a strong visual grid can still produce confusing keyboard navigation." ], "requirements": [ "A browser for the gallery and an appropriate design tool for any chosen template.", "Confirm the original creator's reuse terms before adapting artwork or a template." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The gallery, one example overlay and the template page were inspected in a fresh browser. No template or original artwork was downloaded." ], "sources": [ { "label": "Public layout gallery", "url": "https://bentogrids.com/" }, { "label": "Template page", "url": "https://bentogrids.com/templates" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "A gallery example opened, its overlay dismissed with Escape, and the template link reached the Figma-oriented template page.", "reportUrl": "/design-evaluations/resource-bento-grids.json", "identity": { "target": "https://bentogrids.com/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 daa2108670dd977b640691d2f48c07ab449e6d320f4abb07b14d8c9e8e2854d0 of one initial HTML response (126029 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Gallery preview", "mode": "browser", "method": "Open the Chroma example, then dismiss its overlay with Escape.", "result": "pass", "observation": "One preview close control appeared; the overlay dismissed and navigation became available." }, { "name": "Template navigation", "mode": "browser", "method": "Follow Get Bento Templates after closing the preview.", "result": "pass", "observation": "The browser reached /templates with the Bento Grids Templates title and Figma-oriented template content." }, { "name": "Asset integration", "mode": "browser", "method": "Download and adapt a template in a design or code project.", "result": "not-run", "observation": "No asset was downloaded, installed or tested responsively." } ], "security": { "scope": "Public navigation, one preview overlay and passive response/request observations.", "findings": [ { "level": "info", "basis": "observed", "title": "Defensive headers on the sampled page", "detail": "The response included HSTS, nosniff and a restrictive device-permissions policy. These are transport/browser controls on this response, not an application security certification." }, { "level": "caution", "basis": "advice", "title": "Follow the rights back to the source", "detail": "Check the original creator's permissions before reusing a gallery image or template; attribution is not a reuse license." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Close the preview before using the underlying navigation; its overlay intentionally intercepts pointer input.", "Test meaningful DOM order and narrow-screen layout in the implementation you build." ], "limits": [ "One example and one navigation path were sampled; no download, paid access or template execution.", "No responsive-layout, screen-reader or source-code audit." ], "sources": [ { "label": "Public layout gallery", "url": "https://bentogrids.com/" }, { "label": "Template page", "url": "https://bentogrids.com/templates" } ] } }, { "id": "oversight-sections", "title": "Oversight Supply Sections", "url": "https://supply.madebyoversight.com/sections", "category": "Section galleries", "kind": "Interactive sections", "summary": "Preview interface sections before adapting one to a specific page.", "whatItIs": "Oversight Supply Sections is a browsable library of interface sections with live previews and copy controls for agent-assisted design work. Entries have different access labels, so a visible preview does not establish that every section can be copied or used on the same terms.", "whenUseful": "An existing page needs a focused hero, feature or proof section without replacing the whole design.", "example": "Filter the library, preview a relevant section, then compare its hierarchy with your actual content before reviewing any copied code or agent instructions.", "expectedResult": "A concrete section candidate with access, rights and implementation requirements still checked item by item.", "cautions": [ "Review copied code and agent-facing instructions before bringing them into a project.", "Public preview access does not establish Pro access, license scope or compatibility with a particular framework." ], "requirements": [ "A browser to inspect the public previews.", "A suitable design or development workflow and the rights required for the chosen section." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The Studio Originals filter reduced visible previews from 41 to 10. Activating Transmission created a preview iframe pointing to the publisher's Transmission page; child-frame content and functionality were not asserted. Copy, paid access and implementation workflows were not exercised." ], "sources": [ { "label": "Section library", "url": "https://supply.madebyoversight.com/sections" }, { "label": "Sampled Transmission preview", "url": "https://supply.madebyoversight.com/section-previews/transmission/index.html" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The section filter changed the public list, and activating Transmission created a preview iframe with the expected destination. Child-frame behavior, copying, agent execution and paid access remain untested.", "reportUrl": "/design-evaluations/resource-oversight-sections.json", "identity": { "target": "https://supply.madebyoversight.com/sections", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 385e85c09c7345b8aa9a857c8bf9471ef53d5cd5e006076afc5f6f5fa02aa4d1 of one initial HTML response (144933 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Collection filter", "mode": "browser", "method": "Select Studio Originals and count the visible preview controls.", "result": "pass", "observation": "The sampled list changed from 41 previews to 10." }, { "name": "Preview iframe destination", "mode": "browser", "method": "Open Transmission from the filtered list.", "result": "pass", "observation": "A preview iframe appeared with src https://supply.madebyoversight.com/section-previews/transmission/index.html. Its child-frame content and functionality were not asserted." }, { "name": "Copy and implementation", "mode": "browser", "method": "Copy a section or run its agent instructions in a project.", "result": "not-run", "observation": "Only the public preview was opened; no instructions or source were executed." } ], "security": { "scope": "Public catalog filtering, an iframe preview and passive network observations.", "findings": [ { "level": "info", "basis": "observed", "title": "Preview loads a separate document", "detail": "The Transmission example loaded in a same-publisher iframe; the catalog also requested PostHog-related assets. This does not establish what copied section code does in a different application." }, { "level": "caution", "basis": "advice", "title": "Treat copied instructions as reviewable input", "detail": "Inspect any prompt, command, package or remote URL before giving copied material to an agent with file or network access." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Check each item's Free or Pro access label and reuse terms.", "A preview demonstrates presentation; it does not verify the resulting implementation's accessibility or security." ], "limits": [ "No copy, account, purchase, package installation or generated-site workflow.", "No audit of all sections, iframe isolation or downstream dependencies.", "Iframe creation and its destination were observed; child-frame response status, rendered content and interactive behavior were not verified." ], "sources": [ { "label": "Section library", "url": "https://supply.madebyoversight.com/sections" }, { "label": "Sampled Transmission preview", "url": "https://supply.madebyoversight.com/section-previews/transmission/index.html" } ] } }, { "id": "inspora", "title": "Inspora", "url": "https://www.inspora.design/", "category": "Site inspiration & templates", "kind": "Creative reference", "summary": "Compare ideas across web, brand and motion.", "whatItIs": "Inspora is a visual reference directory spanning web, branding, product, motion, illustration, 3D and print. The public category controls change the displayed work, making it useful for narrowing a mood board before examining individual sources in more depth.", "whenUseful": "You need a small set of visual directions before writing a brief.", "example": "Choose a web and a print reference, then explain the shared hierarchy or typography you want to explore.", "expectedResult": "A focused moodboard with explicit design observations.", "cautions": [ "A category filter does not measure the quality or effectiveness of the designs it shows.", "Motion-heavy examples need separate reduced-motion and performance review before imitation." ], "requirements": [ "A browser and a brief that states the audience, task and intended visual direction.", "Item-level source and permission checks before adapting a reference." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The Web category loaded a different set of post links, including a portfolio website. The sampled batch retained 32 visible post links; individual post detail and reuse terms were not audited." ], "sources": [ { "label": "Public inspiration directory", "url": "https://www.inspora.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The Web filter changed the public gallery's entries. Collection navigation is confirmed; item-level rights and implementation quality are not.", "reportUrl": "/design-evaluations/resource-inspora.json", "identity": { "target": "https://www.inspora.design/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 f11edc41c926a9136f2c4461b383c713f894702af11a21f1c2846d07b29394ac of one initial HTML response (72137 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Category filtering", "mode": "browser", "method": "Open the directory, select Web and compare the visible post links.", "result": "pass", "observation": "The first visible entry changed to /posts/portfolio-website and the set included web-specific references; 32 post links remained in the sampled batch." }, { "name": "Individual reference assessment", "mode": "browser", "method": "Inspect complete post details and original creator permissions.", "result": "not-run", "observation": "This bounded test covered category navigation and entry links, not every referenced source." } ], "security": { "scope": "Public category interaction, visible media and passive request destinations.", "findings": [ { "level": "info", "basis": "observed", "title": "Media and analytics destinations", "detail": "The page requested media.inspora.design and PostHog-related assets. The filtered DOM contained video elements; no private input or upload was submitted." }, { "level": "caution", "basis": "advice", "title": "Separate reference choice from adoption", "detail": "Inspect original rights and motion behavior before translating a reference into a production interface." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "The unchanged batch size is not evidence that the filter did nothing; the actual item links changed.", "Write down the useful pattern in each reference rather than treating visual novelty as a product requirement." ], "limits": [ "One category was exercised; no individual creator-site, save or submission workflow.", "No media performance, full accessibility or asset-license audit." ], "sources": [ { "label": "Public inspiration directory", "url": "https://www.inspora.design/" } ] } }, { "id": "recent", "title": "Recent", "url": "https://recent.design/", "category": "Site inspiration & templates", "kind": "Creative reference and tool index", "summary": "Browse visual work and related design resources.", "whatItIs": "Recent now includes design inspiration, websites, launch videos, app screenshots and icons, alongside tools and skills. It is broader than a tool directory, so choose the relevant view for the job.", "whenUseful": "You want to compare current visual approaches or discover a focused tool.", "example": "Collect a few examples of editorial hierarchy and record what each demonstrates instead of copying the whole visual style.", "expectedResult": "A small, annotated reference set.", "cautions": [ "A curated feed is not a representative sample of what works for your audience.", "Tool listings require their own capability and permission review; a gallery inclusion is not a security endorsement." ], "requirements": [ "A defined design question and time-bounded browsing." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://recent.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Websites route opened with a separate website reference collection and decoded images. Navigation from the broader design feed worked.", "reportUrl": "/design-evaluations/resource-recent.json", "identity": { "target": "https://recent.design/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:4d946940cd33b0bdb0350fd757b11caa4b432a976c45e284352deb88cfacc3fd — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://recent.design/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Recent — Design Inspiration”. 51 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Websites link to https://recent.design/websites.", "result": "pass", "observation": "The destination returned 200; title: “Web Design Inspiration — Recent”. 20 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Recent attempted requests to 5 additional hosts, including cdn.recent.design, static.cloudflareinsights.com, cdn.visitors.now, o4511855074410496.ingest.de.sentry.io. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Keep website references separate from Recent’s tools, skills and other creative categories; inclusion is not a security endorsement." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "23 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Keep website references separate from Recent’s tools, skills and other creative categories; inclusion is not a security endorsement.", "A curated feed is not a representative sample of what works for your audience." ], "limits": [ "No bookmarks, account features or linked tool installations were used, and no performance or usability claim about featured work was tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://recent.design/" }, { "label": "Observed sample or category", "url": "https://recent.design/websites" } ] } }, { "id": "curated", "title": "Curated", "url": "https://curated.design/", "category": "Site inspiration & templates", "kind": "Website and section reference", "summary": "Find a page structure by industry and style.", "whatItIs": "Curated indexes real websites and sections with filters and agent-oriented features. It can help turn a broad visual search into a specific page brief, while the source website remains the best place to inspect actual behavior.", "whenUseful": "You need a relevant marketing structure without starting from an empty canvas.", "example": "Compare product pages in a similar category and map their sections to the questions your visitors need answered.", "expectedResult": "A content-led page outline with a few visual references.", "cautions": [ "A listed site does not establish conversion, accessibility or performance results.", "Saved searches, advanced access and agent integrations were not exercised." ], "requirements": [ "A target audience, a content outline and access to the desired catalog view." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://curated.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Sections route opened with section-type navigation and reference images. Public browsing reached the section-focused collection.", "reportUrl": "/design-evaluations/resource-curated.json", "identity": { "target": "https://curated.design/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:788b5491de2a4871b78b2373e316bb7976f968d15f0e43fc7b618c2ee63f73a1 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://curated.design/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Web design inspiration from real, live websites — Curated”. 42 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Sections link to https://curated.design/sections/.", "result": "pass", "observation": "The destination returned 200; title: “Landing page sections — heroes, pricing, footers | Curated”. 14 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Curated attempted requests to 3 additional hosts, including curated-images.b-cdn.net, marketstorage.b-cdn.net, curated-video.b-cdn.net. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Compare related sections in the context of your complete page, rather than combining individually attractive fragments without a consistent hierarchy." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Compare related sections in the context of your complete page, rather than combining individually attractive fragments without a consistent hierarchy.", "A listed site does not establish conversion, accessibility or performance results." ], "limits": [ "Prompt-based reference finding, saved searches, paid templates and MCP integrations were not exercised.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://curated.design/" }, { "label": "Observed sample or category", "url": "https://curated.design/sections/" } ] } }, { "id": "landing-love", "title": "Landing.love", "url": "https://www.landing.love/", "category": "Site inspiration & templates", "kind": "Website reference", "summary": "Study the pacing of complete marketing pages.", "whatItIs": "Landing.love curates landing pages across styles and industries, including motion-heavy examples. A full-page reference can reveal the relationship between introduction, evidence and action better than an isolated hero.", "whenUseful": "You are defining a launch page’s narrative and visual pace.", "example": "Sketch the section sequence of two relevant examples, then replace it with your own message and evidence.", "expectedResult": "A page outline with a deliberate information sequence.", "cautions": [ "A polished reference can depend on large media or unusual scrolling that does not fit your audience.", "Inspect the source site and retain ownership of your copy and assets." ], "requirements": [ "A clear page objective and realistic content." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.landing.love/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Felix Rieseberg detail opened with website screenshots and related references. Public detail navigation and image delivery worked.", "reportUrl": "/design-evaluations/resource-landing-love.json", "identity": { "target": "https://www.landing.love/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:712cbbe5671784c2a9f09a2f6c856582c7514786aad105ec473943ac8ecdfbba — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.landing.love/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “landing.love — Best Landing Page Design Inspiration”. 10 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed public sample link to https://www.landing.love/sites/felixrieseberg/.", "result": "pass", "observation": "The destination returned 200; title: “Felix Rieseberg Website Design — landing.love”. 6 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Landing.love attempted requests to 15 additional hosts, including static.cloudflareinsights.com, cdn.landing.love, rsms.me, umami.upflam.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the reference to study composition. Motion-heavy inspiration still needs reduced-motion, loading and small-screen checks in your implementation." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "33 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the reference to study composition. Motion-heavy inspiration still needs reduced-motion, loading and small-screen checks in your implementation.", "A polished reference can depend on large media or unusual scrolling that does not fit your audience." ], "limits": [ "The linked website and its animations were not operated; saved boards, accounts and premium features were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.landing.love/" }, { "label": "Observed sample or category", "url": "https://www.landing.love/sites/felixrieseberg/" } ] } }, { "id": "landing-gallery", "title": "Landing.Gallery", "url": "https://www.landing.gallery/", "category": "Site inspiration & templates", "kind": "Website reference", "summary": "Compare complete pages by purpose and implementation context.", "whatItIs": "Landing.Gallery organizes landing references and page types such as pricing and careers, with framework filters. Those filters can help narrow research, but they do not establish that the underlying implementation is suitable for reuse.", "whenUseful": "A marketing site needs a consistent structure across several page types.", "example": "Compare a home page and pricing page from the same reference, then write a hierarchy appropriate to your own offering.", "expectedResult": "A related set of page briefs.", "cautions": [ "A platform label is not a code-quality or accessibility assessment.", "Use source links to inspect behavior; avoid lifting another company’s assets, prices or testimonials." ], "requirements": [ "A set of page goals and approved content." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.landing.gallery/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Pricing inspiration route opened with pricing-page references. The category was available without an account in this visit.", "reportUrl": "/design-evaluations/resource-landing-gallery.json", "identity": { "target": "https://www.landing.gallery/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:43eb9f947e84f37428a5bcc83a7a8547953e57f706fc4e40b2107dde9bf4e93b — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.landing.gallery/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Best Landing Page Inspiration Library | Landing.Gallery”. 84 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed pricing pages link to https://www.landing.gallery/inspiration/pricing.", "result": "pass", "observation": "The destination returned 200; title: “Discover 260+ Pricing Pages Design Inspiration & Examples | Landing.Gallery”. 32 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Landing.Gallery attempted requests to 6 additional hosts, including imagedelivery.net, logo.parsew.com, cdn.visitors.now, api.openpanel.dev. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the collection to compare plan hierarchy and disclosure. Framework labels and screenshots do not establish production code quality." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "9 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the collection to compare plan hierarchy and disclosure. Framework labels and screenshots do not establish production code quality.", "A platform label is not a code-quality or accessibility assessment." ], "limits": [ "No reference site, framework filter matrix, MCP connection, newsletter or submission workflow was tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.landing.gallery/" }, { "label": "Observed sample or category", "url": "https://www.landing.gallery/inspiration/pricing" } ] } }, { "id": "landdding", "title": "Landdding", "url": "https://landdding.com/", "category": "Site inspiration & templates", "kind": "Website reference", "summary": "Explore website composition across a broad set of industries.", "whatItIs": "Landdding presents curated website and landing-page examples with industry categories and template links. It is useful for comparing composition without assuming every example is a purchasable or reusable template.", "whenUseful": "The design brief needs a few distinct directions.", "example": "Find three relevant examples and describe only their hierarchy, rhythm and content density.", "expectedResult": "A concise direction board with explicit reasons.", "cautions": [ "Featured designs and templates are different resources with different reuse conditions.", "Visual selection does not prove task success, performance or accessibility." ], "requirements": [ "A defined audience and a short list of visual questions." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://landdding.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The homepage displayed website references, but its Design category rendered “Something Unexpected” and no images. The test guard blocked GraphQL POST requests, so category behavior remains inconclusive under this GET-only method.", "reportUrl": "/design-evaluations/resource-landdding.json", "identity": { "target": "https://landdding.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:f0dc0b52ef0e3d6fa2b1282d46ae2f01962832fd632237c8f7b4c0fbbf0ade5b — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://landdding.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Inspirational new website designs - Landdding”. 45 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Design link to https://landdding.com/c/design.", "result": "blocked", "observation": "Category document returned 200 but rendered Something Unexpected with zero images; GraphQL POST was blocked by the test guard. Category functionality is inconclusive." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Landdding attempted requests to 6 additional hosts, including www.googletagmanager.com, unpkg.com, analytics.ahrefs.com, api-prod.landdding.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the observed homepage references as the bounded result. Confirm category loading in an ordinary session before relying on that workflow." }, { "level": "info", "basis": "observed", "title": "Method guard affected the result", "detail": "GraphQL POST requests to api-prod.landdding.com were stopped. The Design-category error therefore cannot be treated as a confirmed service failure or security defect." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "11 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the observed homepage references as the bounded result. Confirm category loading in an ordinary session before relying on that workflow.", "Featured designs and templates are different resources with different reuse conditions." ], "limits": [ "GraphQL POST bodies were neither inspected nor allowed; the observed category error cannot be attributed to the product independently of the guard. Accounts, submissions and PRO access were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://landdding.com/" }, { "label": "Observed sample or category", "url": "https://landdding.com/c/design" } ] } }, { "id": "saaspo", "title": "Saaspo", "url": "https://saaspo.com/", "category": "Site inspiration & templates", "kind": "SaaS website reference", "summary": "Research common SaaS marketing structures.", "whatItIs": "Saaspo's indexed primary pages describe a library of SaaS landing pages and section references with category filters. The live endpoint presented a Cloudflare verification response in fresh browser checks, so this review can describe the documented offering but cannot confirm current interactive catalog behavior.", "whenUseful": "A software marketing page needs a clearer product, proof and action sequence.", "example": "Compare resource or pricing-section patterns, then organize your actual content around the visitor’s decision.", "expectedResult": "A SaaS page outline grounded in the product’s real information.", "cautions": [ "Indexed primary descriptions can lag the live service; current collection contents and access conditions remain unconfirmed.", "A security-verification response is not proof that the service is offline, and it was not bypassed." ], "requirements": [ "Normal access to the current public catalog and a specific software-product brief." ], "reviewStatus": "partial", "reviewedOn": "2026-10-19", "reviewNotes": [ "Two fresh browser requests returned HTTP 403 with a Cloudflare verification page. Indexed primary descriptions were available, but live filters, entries and account conditions could not be exercised." ], "sources": [ { "label": "Publisher catalog; browser verification blocked", "url": "https://saaspo.com/" }, { "label": "Publisher sections; indexed primary description", "url": "https://saaspo.com/sections" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "blocked", "modes": [ "http", "browser", "source-review" ], "summary": "Public primary descriptions were found, but two fresh browser visits were blocked by a verification page. No catalog runtime pass is claimed.", "reportUrl": "/design-evaluations/resource-saaspo.json", "identity": { "target": "https://saaspo.com/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 24afddbca9d503df8ef33a9030f23e7b45782d22ca938a6691dbd0b8391356b5 of one initial HTML response (6094 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Public endpoint", "mode": "http", "method": "Open saaspo.com in two fresh browser contexts.", "result": "blocked", "observation": "Both checks returned HTTP 403 and a Cloudflare verification page." }, { "name": "Primary-source discovery", "mode": "source-review", "method": "Review search-indexed pages on the publisher's domain.", "result": "pass", "observation": "The indexed primary text describes landing-page and section-reference browsing; it does not establish live availability." }, { "name": "Catalog interaction", "mode": "browser", "method": "Use live filters or open a reference entry.", "result": "blocked", "observation": "The catalog UI was unavailable behind the verification response; no bypass was attempted." } ], "security": { "scope": "Passive observation of the public verification response and search-indexed primary descriptions.", "findings": [ { "level": "info", "basis": "observed", "title": "Verification boundary respected", "detail": "The response was an access-verification page. Challenge POST requests were blocked by the test guard, and the check did not attempt to solve or bypass it." }, { "level": "caution", "basis": "observed", "title": "Headers belong to the challenge", "detail": "Observed CSP, frame and content-type protections describe the verification response; they cannot be generalized to the catalog application." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Treat this as a documented resource with an unresolved live-access check.", "Verify current reference contents and reuse terms through normal access before relying on them." ], "limits": [ "No live catalog, filtering, asset download, account or paid workflow could be tested.", "The GET/HEAD-only guard can affect verification behavior; the block is specific to this test environment." ], "sources": [ { "label": "Publisher catalog; browser verification blocked", "url": "https://saaspo.com/" }, { "label": "Publisher sections; indexed primary description", "url": "https://saaspo.com/sections" } ] } }, { "id": "saasframe", "title": "SaaSFrame", "url": "https://www.saasframe.io/", "category": "Site inspiration & templates", "kind": "SaaS interface reference", "summary": "Compare marketing and product interface patterns.", "whatItIs": "SaaSFrame’s current library presents UX and UI examples from SaaS websites and interfaces. It helps connect the marketing story with the application patterns a user encounters afterward.", "whenUseful": "A software product needs consistent expectations from signup through initial use.", "example": "Compare a pricing page and onboarding screen for the same task, then map the transition in your own product.", "expectedResult": "A more coherent cross-screen flow.", "cautions": [ "A screenshot does not establish permissions, validation or successful completion.", "Current membership and download workflows were not exercised; source-image rights remain separate." ], "requirements": [ "A specific product flow and access to the relevant examples." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.saasframe.io/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The Pricing Page category opened with sample images plus membership pricing and upgrade UI. Chromium access worked while the separate HTTP checker received 403.", "reportUrl": "/design-evaluations/resource-saasframe.json", "identity": { "target": "https://www.saasframe.io/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:9acae58071073be211c481e2669f68e675a3cbc874abe19c1bd318f4c2324d5e — initial HTTP 403 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "blocked", "observation": "The standalone client received 403 at https://www.saasframe.io/. The fresh browser check is reported separately; this is not evidence that the site is offline." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “SaaSFrame — UX & UI Design Examples Library for SaaS Websites and Interfaces”. 187 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed 💵 Pricing Page211 link to https://www.saasframe.io/categories/pricing-page.", "result": "pass", "observation": "The destination returned 200; title: “211 SaaS Pricing Page UI Design Examples in 2026”. 10 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared frame-ancestors. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "SaaSFrame attempted requests to 12 additional hosts, including cdn.prod.website-files.com, cdn.jsdelivr.net, memberstack.github.io, static.cloudflareinsights.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Separate free samples from the membership offer before budgeting research time; the test did not unlock the full screenshot library." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "21 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Separate free samples from the membership offer before budgeting research time; the test did not unlock the full screenshot library.", "A screenshot does not establish permissions, validation or successful completion." ], "limits": [ "Memberstack POST requests were blocked by the read-only guard. Authentication, downloads, full-library permissions and paid access were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.saasframe.io/" }, { "label": "Observed sample or category", "url": "https://www.saasframe.io/categories/pricing-page" } ] } }, { "id": "saas-landing-page", "title": "SaaS Landing Page", "url": "https://saaslandingpage.com/", "category": "Site inspiration & templates", "kind": "SaaS website reference", "summary": "Find examples of the supporting pages around a software launch.", "whatItIs": "SaaS Landing Page organizes examples for landing pages, pricing, features, FAQs and other marketing surfaces. It also links templates, which should be evaluated separately from inspiration screenshots.", "whenUseful": "You need a practical first outline for a software marketing site.", "example": "Draft a features page using real product capabilities, then compare whether the hierarchy answers the visitor’s questions.", "expectedResult": "A page draft with a clearer explanation of the product.", "cautions": [ "Sample testimonials, pricing and performance claims are not reusable facts.", "A visual reference does not establish the quality or license of a linked template." ], "requirements": [ "A product explanation and approved evidence for any claims." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://saaslandingpage.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Pricing page collection opened with named examples, including Calendly and Relume, and decoded images. Public category browsing worked.", "reportUrl": "/design-evaluations/resource-saas-landing-page.json", "identity": { "target": "https://saaslandingpage.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:d2d3cbb10cdcf3b72dd7f48e2fc9fd0f6ced6e4b8617250f41affec477f154ad — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://saaslandingpage.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “The Best Landing Page Examples For Design Inspiration - SaaS Landing Page”. 19 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Pricing link to https://saaslandingpage.com/pricing/.", "result": "pass", "observation": "The destination returned 200; title: “64 Best Pricing Page Examples [Design Inspiration] - SaaS Landing Page”. 13 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "SaaS Landing Page attempted requests to 3 additional hosts, including static.cloudflareinsights.com, plausible.io, ipinfo.io. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Borrow the comparison questions, not another company’s prices, testimonials or product claims." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Borrow the comparison questions, not another company’s prices, testimonials or product claims.", "Sample testimonials, pricing and performance claims are not reusable facts." ], "limits": [ "The original SaaS sites, purchasable templates, rights terms and any conversion outcomes were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://saaslandingpage.com/" }, { "label": "Observed sample or category", "url": "https://saaslandingpage.com/pricing/" } ] } }, { "id": "minimal-gallery", "title": "Minimal Gallery", "url": "https://minimal.gallery/", "category": "Site inspiration & templates", "kind": "Website reference", "summary": "Study restraint without removing needed information.", "whatItIs": "Minimal Gallery curates websites alongside templates and tools, with category filters. It is a useful place to study hierarchy and whitespace when a page needs fewer competing visual signals.", "whenUseful": "A content-rich page feels visually crowded.", "example": "Compare two restrained editorial layouts and test your longest headings and supporting details within them.", "expectedResult": "A quieter layout that still carries necessary information.", "cautions": [ "Minimal styling can hide affordances or produce weak contrast if taken too far.", "References and purchasable templates have separate rights and implementation requirements." ], "requirements": [ "Realistic content and a clear list of actions the page must support." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://minimal.gallery/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Portfolio category opened with portfolio reference images. The gallery’s category route worked without an account.", "reportUrl": "/design-evaluations/resource-minimal-gallery.json", "identity": { "target": "https://minimal.gallery/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:124959055263f23813c535fccd7b3cd6788cd9a68f0fba3542947dbb9e698aab — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://minimal.gallery/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Minimal Gallery – Hand-picked web design inspiration, premium templates, tools and more”. 24 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Portfolio link to https://minimal.gallery/tag/portfolio/.", "result": "pass", "observation": "The destination returned 200; title: “Beautiful Portfolio websites – Minimal Gallery”. 18 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared frame-ancestors, upgrade-insecure-requests. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Minimal Gallery attempted requests to 2 additional hosts, including 21ef0880.delivery.rocketcdn.me, plausible.io. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Minimal presentation can hide affordances; retain clear labels, focus states and sufficient contrast when adapting the visual direction." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Minimal presentation can hide affordances; retain clear labels, focus states and sufficient contrast when adapting the visual direction.", "Minimal styling can hide affordances or produce weak contrast if taken too far." ], "limits": [ "No bookmarks, paid template, source-site behavior or full accessibility evaluation was exercised.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://minimal.gallery/" }, { "label": "Observed sample or category", "url": "https://minimal.gallery/tag/portfolio/" } ] } }, { "id": "seesaw", "title": "Seesaw", "url": "https://www.seesaw.website/", "category": "Site inspiration & templates", "kind": "Website reference", "summary": "Find edited examples of contemporary website design.", "whatItIs": "Seesaw presents hand-picked websites across categories including portfolios, design tools and developer tools. It works as a focused reference feed, not a specification for how your product must look.", "whenUseful": "A team needs a few coherent website references.", "example": "Choose one example for type hierarchy and another for content pacing, then document the choices that fit your own brief.", "expectedResult": "A reference set with a clear role for each example.", "cautions": [ "Editorial selection does not verify usability or business outcomes.", "Avoid blending references without a shared token and content system." ], "requirements": [ "A clear visual question and a short reference shortlist." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.seesaw.website/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Design Tools category opened and loaded a collection of references. Account-free category navigation worked.", "reportUrl": "/design-evaluations/resource-seesaw.json", "identity": { "target": "https://www.seesaw.website/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:8f28166ed5b870a50905c99626c5eefce4cceb2ee2f2ad90f103748e7680279c — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.seesaw.website/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “SEESAW ✦ Design Inspiration”. 911 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Design Tools link to https://www.seesaw.website/category/design-tools.", "result": "pass", "observation": "The destination returned 200; title: “Design Tools ✦ Design Inspiration”. 33 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Seesaw attempted requests to 2 additional hosts, including cdn.usefathom.com, res.cloudinary.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the selected sites as an editorial sample, not as a representative ranking of usable design-tool interfaces." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the selected sites as an editorial sample, not as a representative ranking of usable design-tool interfaces.", "Editorial selection does not verify usability or business outcomes." ], "limits": [ "Search completeness, subscriptions and the featured tools themselves were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.seesaw.website/" }, { "label": "Observed sample or category", "url": "https://www.seesaw.website/category/design-tools" } ] } }, { "id": "brutalist-websites", "title": "Brutalist Websites", "url": "https://brutalistwebsites.com/", "category": "Site inspiration & templates", "kind": "Experimental website archive", "summary": "Explore expressive, unconventional web composition.", "whatItIs": "Brutalist Websites documents sites that deliberately challenge polished, comfortable web conventions. It can broaden visual options for cultural or experimental work, while essential tasks still need to remain understandable.", "whenUseful": "The project’s identity calls for a raw or unconventional expression.", "example": "Explore a typographic direction for a cultural event while keeping tickets, dates and navigation easy to find.", "expectedResult": "An expressive visual proposal with protected task clarity.", "cautions": [ "Aesthetic difficulty is not a reason to remove keyboard access, legibility or familiar recovery paths.", "Archived references may have changed, and their visual assets remain their owners’ work." ], "requirements": [ "An appropriate brand context and explicit usability constraints." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://brutalistwebsites.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The American Millennial interview opened with its image and editorial content. The observed link used HTTP but the final browser document was HTTPS.", "reportUrl": "/design-evaluations/resource-brutalist-websites.json", "identity": { "target": "https://brutalistwebsites.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:13834a1aea8164dfcd9b6d5046873d4e54e4c79b06d9f7659ea676078b92a129 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://brutalistwebsites.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Brutalist Websites”. 1599 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Interview link to http://brutalistwebsites.com/americanmillenni.al.", "result": "pass", "observation": "The destination returned 200; title: “Brutalist Websites – American Millennial”. 1 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Observed host boundary", "detail": "The initial Brutalist Websites browser visit attempted requests only to brutalistwebsites.com. This does not cover later features, server-side processing or a complete session." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Keep the HTTPS address and check individual archive destinations before relying on them. Experimental visual style does not remove readability and recovery requirements." }, { "level": "caution", "basis": "observed", "title": "HTTP archive link", "detail": "The selected Interview anchor used http://brutalistwebsites.com/americanmillenni.al, while its final document loaded over HTTPS. Prefer the HTTPS destination; this one upgrade does not establish the transport behavior of every archive link." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Keep the HTTPS address and check individual archive destinations before relying on them. Experimental visual style does not remove readability and recovery requirements.", "Aesthetic difficulty is not a reason to remove keyboard access, legibility or familiar recovery paths." ], "limits": [ "The external featured website was not opened; archived links, accessibility, historical availability and any submission workflow were not audited.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://brutalistwebsites.com/" }, { "label": "Observed sample or category", "url": "https://brutalistwebsites.com/americanmillenni.al/" } ] } }, { "id": "loadmore", "title": "loadmo.re", "url": "https://loadmo.re/", "category": "Site inspiration & templates", "kind": "Mobile website archive", "summary": "Study compositions designed around a phone-sized canvas.", "whatItIs": "loadmo.re is a mobile website design archive with categories such as editorial, typography and tactile interaction. It offers alternatives to treating mobile as a compressed desktop layout.", "whenUseful": "The primary experience is a mobile website.", "example": "Compare two mobile editorial examples with your own long content, then test the proposed hierarchy on a narrow screen.", "expectedResult": "A phone-focused layout direction.", "cautions": [ "A mobile screenshot does not show reachability, keyboard behavior or real network cost.", "Experimental references may use sound, camera or animation; adopt those only with a clear purpose and appropriate permissions." ], "requirements": [ "A mobile task and representative content lengths." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://loadmo.re/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Sabrina Zeltner detail opened and its mobile-design reference image decoded. Public archive detail navigation worked.", "reportUrl": "/design-evaluations/resource-loadmore.json", "identity": { "target": "https://loadmo.re/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:8b39c0641a03c40d232cd8753c527a78df90c0bee9853852644a2eae7f8e0699 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://loadmo.re/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “loadmo.re — Mobile Web Design Archive by Kim Boutin”. 6 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed sabrinazeltner.com link to https://loadmo.re/posts/sabrina-zeltner.", "result": "pass", "observation": "The destination returned 200; title: “Sabrina Zeltner – Mobile Design Inspiration | Loadmo.re”. 1 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "loadmo.re attempted requests to 2 additional hosts, including cdnjs.cloudflare.com, www.googletagmanager.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the mobile reference to plan hierarchy, then test real touch targets and constrained-network behavior on a device." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the mobile reference to plan hierarchy, then test real touch targets and constrained-network behavior on a device.", "A mobile screenshot does not show reachability, keyboard behavior or real network cost." ], "limits": [ "The featured mobile site, camera/microphone behavior and device performance were not tested. A page script error was observed without blocking the sampled detail.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://loadmo.re/" }, { "label": "Observed sample or category", "url": "https://loadmo.re/posts/sabrina-zeltner" } ] } }, { "id": "craftwork-websites", "title": "Craftwork Website Inspiration", "url": "https://craftwork.design/inspiration/websites", "category": "Site inspiration & templates", "kind": "Website reference", "summary": "Browse website examples within a broader design-resource platform.", "whatItIs": "Craftwork’s former curated/websites route redirects to its current website-inspiration collection. The broader platform also sells assets and templates, so distinguish the reference you are studying from material licensed for use.", "whenUseful": "You need another source of full-site composition references.", "example": "Select a relevant site and record how it groups content, then rebuild the structure using your own brand assets.", "expectedResult": "A composition brief with source attribution.", "cautions": [ "The inspiration listing does not grant rights to the showcased site.", "Template and asset licenses need checking independently from gallery access." ], "requirements": [ "A browser and a defined page brief." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://craftwork.design/inspiration/websites" }, { "label": "Earlier address, observed redirect", "url": "https://craftwork.design/curated/websites" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Resflow detail opened with reference imagery, a Sections area and related examples. The current inspiration directory led to a working public detail.", "reportUrl": "/design-evaluations/resource-craftwork-websites.json", "identity": { "target": "https://craftwork.design/inspiration/websites", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:1d6e5112cf05cb3822a97e6e056bf2c2e831210dd222438b5be062993997bb6e — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://craftwork.design/inspiration/websites. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Website Design Inspiration — 2,900+ Curated Websites • Craftwork”. 64 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Resflow link to https://craftwork.design/curated/website/resflow.", "result": "pass", "observation": "The destination returned 200; title: “Resflow — Agency Website Design Inspiration • Craftwork”. 7 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Craftwork Website Inspiration attempted requests to 3 additional hosts, including curated-images.b-cdn.net, cfw6.b-cdn.net, curated-video.b-cdn.net. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Distinguish inspiration entries from the separately sold asset and template catalog before assuming reuse rights." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Distinguish inspiration entries from the separately sold asset and template catalog before assuming reuse rights.", "The inspiration listing does not grant rights to the showcased site." ], "limits": [ "No product purchase, source-site interaction, MCP connection or downloadable asset was tested; the visit does not cover all directory controls.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://craftwork.design/inspiration/websites" }, { "label": "Observed sample or category", "url": "https://craftwork.design/curated/website/resflow" } ] } }, { "id": "admire-the-web", "title": "Admire The Web", "url": "https://admiretheweb.com/", "category": "Site inspiration & templates", "kind": "Website reference", "summary": "Compare website and interaction examples by category.", "whatItIs": "Admire The Web presents a searchable index with categories and an interaction view. It is useful for locating references across different types of sites before narrowing the design brief.", "whenUseful": "A project needs a broader set of composition possibilities.", "example": "Compare a service site and a product site for how they explain a complex offer, then retain only the useful structure.", "expectedResult": "A more specific page brief.", "cautions": [ "A directory can include historical or experimental work; inspect the current source site.", "Screenshots do not prove accessible behavior or permit asset reuse." ], "requirements": [ "A page objective and a shortlist of relevant categories." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://admiretheweb.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Agency category opened with named entries such as ANDMADE and Grndwrk Studio. The public category route and images worked.", "reportUrl": "/design-evaluations/resource-admire-the-web.json", "identity": { "target": "https://admiretheweb.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:8faa56fa0e3425306973fe8c15156e515cee035c34171973d4623e727164f34b — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://admiretheweb.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Admire The Web - The very best in web design inspiration”. 40 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Agency link to https://admiretheweb.com/category/agency/.", "result": "pass", "observation": "The destination returned 200; title: “Agency Website Design Inspiration | Admire The Web”. 13 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Admire The Web attempted requests to 6 additional hosts, including fonts.googleapis.com, cdn.usefathom.com, cdn.paddle.com, fonts.gstatic.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Check the live source and date of an interesting entry before treating it as a current production reference." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "1 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Check the live source and date of an interesting entry before treating it as a current production reference.", "A directory can include historical or experimental work; inspect the current source site." ], "limits": [ "No saved-item account, website submission, subscription or interaction on a featured site was tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://admiretheweb.com/" }, { "label": "Observed sample or category", "url": "https://admiretheweb.com/category/agency/" } ] } }, { "id": "umanmade", "title": "Umanmade", "url": "https://www.umanmade.com/", "category": "Site inspiration & templates", "kind": "Creative reference", "summary": "Look beyond interface screens for a visual direction.", "whatItIs": "Umanmade describes a curated directory of human-made digital work across UI, motion, branding, illustration and related fields. It can help teams articulate an identity without treating every reference as an implementation example.", "whenUseful": "A brand-led project needs a broader creative vocabulary.", "example": "Compare a motion and a typography reference, then write the visual qualities that suit your own product.", "expectedResult": "A cross-disciplinary moodboard with clear intent.", "cautions": [ "A creative demonstration may not be a shipped or tested product interface.", "Credit the original creator and confirm rights before using any artwork or media." ], "requirements": [ "A brand brief and owned assets for implementation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.umanmade.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The public creative-work feed loaded, and one gallery video played muted with its playback time advancing. This is a real media-preview result, not a test of the depicted interface.", "reportUrl": "/design-evaluations/resource-umanmade.json", "identity": { "target": "https://www.umanmade.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:314386739d68c61387950fa71372cb21b53d3da7c78bc109408ff11ba8037386 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.umanmade.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Umanmade”. 88 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Bring one gallery video into view, play it muted for 1.5 seconds, verify time advances, then pause.", "result": "pass", "observation": "The 670.328125×482 sample reached readyState 4; playback time advanced." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Umanmade attempted requests to 6 additional hosts, including events.framer.com, framerusercontent.com, framer.com, app.framerstatic.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Follow creator attribution and ask whether a reference is a motion study or a shipped product before adapting its behavior." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "2 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Follow creator attribution and ask whether a reference is a motion study or a shipped product before adapting its behavior.", "A creative demonstration may not be a shipped or tested product interface." ], "limits": [ "No likes, submissions or subscription requests were sent. Creator sites, reproduction rights and the functionality depicted in the video were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.umanmade.com/" } ] } }, { "id": "wellmade", "title": "Wellmade", "url": "https://wellmade.fyi/", "category": "Site inspiration & templates", "kind": "Creative-work gallery", "summary": "Compare polished creative work across UI, branding and product presentation.", "whatItIs": "Wellmade is a visual gallery of creative work organized into categories such as app icons, UI, branding, websites and launch videos. Public category pages support browsing, while save controls and X sign-in introduce separate account workflows that were not used here.", "whenUseful": "You need examples that show how visual identity carries across a product and its launch materials.", "example": "Browse the UI and app-icon categories, choose two useful references, and explain the hierarchy or recognition problem each helps solve.", "expectedResult": "A focused visual brief with specific observations and original-source checks.", "cautions": [ "Gallery inclusion does not establish commercial reuse rights.", "Saving and account data handling were not tested; the public browse result does not cover those features." ], "requirements": [ "A browser for public browsing.", "Original assets and item-level permission checks when turning inspiration into finished work." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The public UI category opened successfully and rendered image and video examples. Save, submission and X sign-in controls were left unused." ], "sources": [ { "label": "Public creative-work gallery", "url": "https://wellmade.fyi/" }, { "label": "Sampled UI category", "url": "https://wellmade.fyi/t/ui" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The UI category opened with visual examples in a fresh browser. Public browsing works in this sample; account and submission features remain untested.", "reportUrl": "/design-evaluations/resource-wellmade.json", "identity": { "target": "https://wellmade.fyi/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 6cdd51d14dee65c93c1c855766997bb2eab6e69d8ab38151c576040fed3d4a12 of one initial HTML response (10423 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Category navigation", "mode": "browser", "method": "Select UI from the public gallery.", "result": "pass", "observation": "The browser reached /t/ui with the UI · Wellmade title; the sampled DOM contained 82 images and 14 videos." }, { "name": "Save and authentication", "mode": "browser", "method": "Use save, submission or X sign-in controls.", "result": "not-run", "observation": "These account-related controls were visible but not activated." } ], "security": { "scope": "One public category path, response headers and passive request destinations.", "findings": [ { "level": "info", "basis": "observed", "title": "Protective headers on sampled responses", "detail": "The response included HSTS, frame-ancestors none, X-Frame-Options DENY and nosniff. These are useful response-level controls, not evidence about account authorization or stored data." }, { "level": "caution", "basis": "advice", "title": "Check the source before reuse", "detail": "Follow the specific work back to its creator and establish permission before reusing visuals or branding." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Images and videos in a gallery do not show keyboard behavior or small-screen layout of the original product.", "A public browse pass does not cover saving or publishing work through an account." ], "limits": [ "One category was sampled; no sign-in, save, submission or asset download.", "No full media, accessibility, permission or backend audit." ], "sources": [ { "label": "Public creative-work gallery", "url": "https://wellmade.fyi/" }, { "label": "Sampled UI category", "url": "https://wellmade.fyi/t/ui" } ] } }, { "id": "modulify-templates", "title": "Modulify Templates", "url": "https://modulify.ai/templates", "category": "Site inspiration & templates", "kind": "Website templates", "summary": "Begin with a complete page structure inside the current builder.", "whatItIs": "Modulify’s current template page describes previewing and cloning websites into its dashboard. The current platform should be evaluated on its own workflow rather than assuming historical Webflow-oriented behavior still applies.", "whenUseful": "You need a full prototype structure for a campaign or small site.", "example": "Preview a relevant template, replace its sample content, and check the resulting page’s routes and form behavior.", "expectedResult": "A branded prototype with known implementation gaps.", "cautions": [ "A cloneable template is not proof that export, hosting and integrations meet your requirements.", "Review asset rights and service data handling before uploading client content; no template was cloned here." ], "requirements": [ "Builder access and confirmation of the selected template’s export and hosting options." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://modulify.ai/templates" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "An observed live-preview link opened the Sales CRM template with a Companies view and decoded images. The template was viewed without cloning it into a workspace.", "reportUrl": "/design-evaluations/resource-modulify-templates.json", "identity": { "target": "https://modulify.ai/templates", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:827eb832d03bc2050e5e43208faf860935968e34130f81103940680a0dcd4696 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://modulify.ai/templates. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Free Templates to Clone – Built with Modulify”. 231 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Open a live preview of the Sales CRM template link to https://sales-crm-template.modulify.website/.", "result": "pass", "observation": "The destination returned 200; title: “Sales CRM”. 21 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." }, { "name": "Category button attempt", "mode": "browser", "method": "Locate the previously observed exact “saas” category button in a fresh visit.", "result": "blocked", "observation": "The locator did not become visible within five seconds. This is an automation-selector limit, not proof that the category filter is broken; the separately observed live-preview link worked." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared frame-ancestors. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Modulify Templates attempted requests to 12 additional hosts, including static.cloudflareinsights.com, www.googletagmanager.com, datafa.st, sc.lfeeder.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the preview to assess structure before committing to the platform; a rendered CRM sample does not establish data isolation or working business operations." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "12 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the preview to assess structure before committing to the platform; a rendered CRM sample does not establish data isolation or working business operations.", "A cloneable template is not proof that export, hosting and integrations meet your requirements." ], "limits": [ "No clone, login, record edit, contact import, email sequence or publish action was attempted. A first category-button locator timed out; the independent preview check succeeded.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://modulify.ai/templates" }, { "label": "Observed sample or category", "url": "https://sales-crm-template.modulify.website/" } ] } }, { "id": "wedoflow", "title": "Wedoflow", "url": "https://www.wedoflow.com/", "category": "Site inspiration & templates", "kind": "Webflow templates", "summary": "Use a Webflow-oriented starting point for a complete site.", "whatItIs": "Wedoflow presents website templates, cloneables and supporting material aimed at Webflow projects. It is useful when the intended editing and publishing workflow actually fits that platform.", "whenUseful": "A team wants a maintainable marketing site built in Webflow.", "example": "Review a template’s CMS structure and mobile pages before replacing its demo content with the real site map.", "expectedResult": "A realistic starting point for a Webflow build.", "cautions": [ "Moving a template into another framework is a rebuild, not a direct component import.", "Check the specific license, included assets and ongoing platform requirements before purchase." ], "requirements": [ "A suitable Webflow workflow and the selected template’s access rights." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.wedoflow.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Catania template detail opened with template content and related examples. Public template inspection worked without a purchase.", "reportUrl": "/design-evaluations/resource-wedoflow.json", "identity": { "target": "https://www.wedoflow.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:0e68e458ab609de91f2736462d11ee7f7a0b507eddef435d90c5fcc4072446ad — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.wedoflow.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Premium Webflow Template Designs | Wedoflow”. 239 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Catania $79 USD link to https://www.wedoflow.com/t/catania.", "result": "pass", "observation": "The destination returned 200; title: “Catania Webflow Template | Wedoflow”. 7 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Wedoflow attempted requests to 8 additional hosts, including wedoflow.cdn.modulify.website, verifieddr.com, analytics.modulify.ai, connect.facebook.net. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Confirm the specific template’s license, asset entitlements and Webflow requirements before adopting it or rebuilding it in another stack." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Confirm the specific template’s license, asset entitlements and Webflow requirements before adopting it or rebuilding it in another stack.", "Moving a template into another framework is a rebuild, not a direct component import." ], "limits": [ "No template was purchased, cloned or published; the template’s live forms, CMS and checkout behavior were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.wedoflow.com/" }, { "label": "Observed sample or category", "url": "https://www.wedoflow.com/t/catania" } ] } }, { "id": "oversight-templates", "title": "Oversight Supply Templates", "url": "https://supply.madebyoversight.com/", "category": "Site inspiration & templates", "kind": "Website templates", "summary": "Preview full website templates and compare platform-specific starting points.", "whatItIs": "Oversight Supply presents website templates and design starting points, with platform filters and live previews. Framer and Webflow entries sit alongside copy and access controls; the preview is a useful way to inspect a direction before checking the particular template's format and terms.", "whenUseful": "A complete page needs a coherent starting structure that fits the project's publishing platform.", "example": "Filter to the required platform, open a live preview and test whether your real navigation and copy fit before evaluating the template's terms.", "expectedResult": "A concrete template candidate with known platform requirements and an adoption checklist.", "cautions": [ "A template preview can load a separate website and its scripts.", "Review any copied prompt, code or package instructions before allowing an agent to act on them." ], "requirements": [ "A browser for previewing and the appropriate platform for the selected template.", "Confirm the item's access and reuse terms before purchasing, copying or adapting it." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The Framer filter displayed 12 preview labels. Activating Cherry created an iframe pointing to its Framer-hosted site; child-frame content and functionality were not asserted. No template was copied, purchased, downloaded or deployed." ], "sources": [ { "label": "Template library", "url": "https://supply.madebyoversight.com/" }, { "label": "Sampled Cherry preview", "url": "https://ovo-cherry.framer.website/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The Framer filter worked, and activating Cherry created a preview iframe with the expected destination. Child-frame behavior, platform integration, paid access and copied agent workflows remain untested.", "reportUrl": "/design-evaluations/resource-oversight-templates.json", "identity": { "target": "https://supply.madebyoversight.com/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 597c301548f12068b7d253a2ddf5f716de18dd36b77895786883096d220c29aa of one initial HTML response (346628 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Platform filter", "mode": "browser", "method": "Select the observed Framer link in the catalog.", "result": "pass", "observation": "The filtered public list showed 12 preview labels." }, { "name": "Preview iframe destination", "mode": "browser", "method": "Open Cherry from the filtered list.", "result": "pass", "observation": "A preview iframe appeared with src https://ovo-cherry.framer.website/. Its child-frame content and functionality were not asserted." }, { "name": "Template adoption", "mode": "browser", "method": "Copy, purchase, download or deploy a template.", "result": "not-run", "observation": "No adoption or paid workflow was performed." } ], "security": { "scope": "One platform filter and an external iframe preview, with passive request observations.", "findings": [ { "level": "info", "basis": "observed", "title": "Preview crosses to a hosted template site", "detail": "The Cherry preview loads a Framer-hosted origin. Treat preview browsing as a separate site's code execution in the browser, not proof of what a copied template will request later." }, { "level": "caution", "basis": "advice", "title": "Review agent-facing material", "detail": "Check any copied prompt or command for file access, network calls and dependencies before running it in a project." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Verify the selected template's platform and license rather than assuming the whole catalog shares one set of conditions.", "A preview can help judge layout; it does not demonstrate account, form or deployment correctness." ], "limits": [ "No account, favorite, purchase, copy, package execution or deployment.", "Only one platform filter and one template preview were sampled.", "Iframe creation and its destination were observed; child-frame response status, rendered content and interactive behavior were not verified." ], "sources": [ { "label": "Template library", "url": "https://supply.madebyoversight.com/" }, { "label": "Sampled Cherry preview", "url": "https://ovo-cherry.framer.website/" } ] } }, { "id": "mobbin", "title": "Mobbin", "url": "https://mobbin.com/", "category": "Site inspiration & templates", "kind": "Product design reference", "summary": "Research screens and patterns from shipped products.", "whatItIs": "Mobbin presents a reference library of mobile and web product screens, with search and agent-oriented access. It helps compare concrete interface choices while preserving the need to understand the original task and context.", "whenUseful": "You need examples of a logged-in product pattern such as settings or onboarding.", "example": "Compare how several apps expose account controls, then test a simpler structure with your own tasks.", "expectedResult": "A reference-backed interface proposal.", "cautions": [ "A shipped screen is not proof that the pattern is optimal, ethical or accessible.", "Membership, downloads and MCP access were not tested; screenshot reuse rights are separate from browsing access." ], "requirements": [ "A well-defined product task and access to the relevant library view." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://mobbin.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "Explore resolved to the mobile app collection and displayed an explicit login-or-join boundary for further browsing. The public route works, but full research access was not available within this account-free pass.", "reportUrl": "/design-evaluations/resource-mobbin.json", "identity": { "target": "https://mobbin.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:c84fd23db1eaa38e72433ccd9c76922ca8250c55fd73694eae377605791debee — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://mobbin.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Mobbin — UI & UX design inspiration for mobile & web apps”. 295 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Explore link to https://mobbin.com/explore.", "result": "pass", "observation": "The destination returned 200; title: “Explore the best mobile app designs on Mobbin”. 1 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Mobbin attempted requests to 1 additional host, including www.googletagmanager.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Budget for the account boundary before planning a large screen or flow audit. Public collection labels do not establish access to every screen." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Budget for the account boundary before planning a large screen or flow audit. Public collection labels do not establish access to every screen.", "A shipped screen is not proof that the pattern is optimal, ethical or accessible." ], "limits": [ "No account was created and the gate was not bypassed. Full-resolution screens, downloads, membership permissions, MCP and end-to-end app flows remain untested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://mobbin.com/" }, { "label": "Observed sample or category", "url": "https://mobbin.com/explore/mobile" } ] } }, { "id": "page-flows", "title": "Page Flows", "url": "https://pageflows.com/", "category": "Site inspiration & templates", "kind": "User-flow reference", "summary": "Study the steps between screens.", "whatItIs": "Page Flows organizes recorded product journeys into a browsable reference library for websites and apps. A recording lets you inspect the order and presentation of a past interaction, but it cannot establish the current product's behavior, accessibility or success rate.", "whenUseful": "A multi-step flow cannot be understood from a single screenshot.", "example": "Map a recorded onboarding sequence, note its date, and add questions about exits, permissions and error states that the recording does not show.", "expectedResult": "A dated flow outline and a list of states to validate in your own product.", "cautions": [ "A successful recorded path may omit errors, permissions, uncommon states and accessibility behavior.", "The sampled recording briefly encountered a decode error before a successful fresh retry; full-length and member-only playback were not tested." ], "requirements": [ "A browser and a specific journey to study; some library features have account or paid-access boundaries.", "Check the recording date and product context before using it as a design reference." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Public Web navigation and a Claude onboarding recording labeled July 2025 were accessible. The first short playback attempt ended with a decode error after about 1.96 seconds; a fresh retry played about 4.49 seconds without an error. No account or collection write was performed." ], "sources": [ { "label": "Public flow library", "url": "https://pageflows.com/" }, { "label": "Web catalog", "url": "https://pageflows.com/web/" }, { "label": "Sampled Claude onboarding recording", "url": "https://pageflows.com/post/desktop-web/onboarding/claude/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser", "source-review" ], "summary": "Public catalog navigation and short sample playback were confirmed. One brief decode failure preceded a successful fresh retry, so playback reliability remains a limitation.", "reportUrl": "/design-evaluations/resource-page-flows.json", "identity": { "target": "https://pageflows.com/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 47f2b4bed9f12a3899c070365a158f31a79a0f330590eeeda1f8c0eb63465d29 of one initial HTML response (239947 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Web catalog navigation", "mode": "browser", "method": "Follow the public Web link from the homepage.", "result": "pass", "observation": "The browser reached /web/ with product, screen, UI-element and flow browsing controls." }, { "name": "Initial short playback", "mode": "browser", "method": "Open the public Claude onboarding recording and play it muted for about 2.5 seconds.", "result": "fail", "observation": "Playback advanced about 1.96 seconds, then paused with media error code 3 (decode)." }, { "name": "Fresh playback retry", "mode": "browser", "method": "Open the same recording in a fresh context and play for about 4.5 seconds.", "result": "pass", "observation": "Playback reached 4.49 seconds with readyState 4, paused false and no media error; media range requests returned HTTP 206." }, { "name": "Full recording and member features", "mode": "browser", "method": "Watch the complete recording or use login, trial, save or collection controls.", "result": "not-run", "observation": "Only short public playback was sampled; the full 165-second recording and account features were not tested." } ], "security": { "scope": "Public catalog navigation, a short public video sample, response headers and passive request observations.", "findings": [ { "level": "info", "basis": "observed", "title": "Playback and third-party requests", "detail": "The video was served from pageflows.com. The public page also requested CDN, Lottie and analytics-related origins; non-GET telemetry and verification requests were blocked." }, { "level": "caution", "basis": "advice", "title": "Avoid mistaking a recording for a live audit", "detail": "Use the recording date and context when drawing conclusions. A historical demonstration does not validate the original product's current privacy, permissions or accessibility." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "The successful retry narrows the first failure to an intermittent sample result; it does not prove full-length or cross-browser reliability.", "The July 2025 label describes the reference recording, not a test of today's Claude product." ], "limits": [ "No full recording, member collection, trial, sign-in or saved-content workflow.", "Playback was sampled in one browser version under a write-blocking guard; reliability and accessibility remain unbenchmarked." ], "sources": [ { "label": "Public flow library", "url": "https://pageflows.com/" }, { "label": "Web catalog", "url": "https://pageflows.com/web/" }, { "label": "Sampled Claude onboarding recording", "url": "https://pageflows.com/post/desktop-web/onboarding/claude/" } ] } }, { "id": "appllama", "title": "Appllama", "url": "https://appllama.io/", "category": "Site inspiration & templates", "kind": "Mobile app-flow reference", "summary": "Compare onboarding and paywall patterns in context.", "whatItIs": "Appllama presents screens and flows from iOS apps, including onboarding and paywalls. Its revenue-oriented discovery can help locate relevant examples, but financial success does not establish which design decision caused it.", "whenUseful": "A subscription app needs to explain value and access conditions.", "example": "Compare two onboarding flows and rewrite the permission and subscription steps around your own product’s actual terms.", "expectedResult": "A transparent mobile onboarding hypothesis.", "cautions": [ "Revenue and ranking signals are not controlled experiments or proof of ethical design.", "Review cancellation clarity, consent and accessibility rather than copying pressure or scarcity tactics." ], "requirements": [ "A defined app journey and accurate subscription information." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://appllama.io/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The SideShift app detail opened with welcome, onboarding, paywall and in-app sections plus sample images. Public flow-reference browsing worked.", "reportUrl": "/design-evaluations/resource-appllama.json", "identity": { "target": "https://appllama.io/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:2334affbc99925fc19acc77af87e71fe04140653e83b00b8f5f705932962736d — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://appllama.io/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Appllama - Discover winning app designs, then build your own”. 80 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed #100 Business SideShift - Earn Money Find jobs and get paid! $200K Revenue · September 202 link to https://appllama.io/apps/6481115809/sideshift-earn-money.", "result": "pass", "observation": "The destination returned 200; title: “SideShift - Earn Money screens, onboarding and paywall | Appllama”. 7 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared default-src, script-src, style-src, img-src, media-src, font-src, connect-src, worker-src, child-src, frame-src, frame-ancestors, base-uri, form-action, object-src; it also contained unsafe-inline. X-Frame-Options was DENY. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Appllama attempted requests to 5 additional hosts, including static.cloudflareinsights.com, cloud.appllama.io, api.appllama.io, www.googletagmanager.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "A paywall reference is not permission to copy a pressure tactic or proof of revenue lift; review cancellation and consent separately." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "9 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "A paywall reference is not permission to copy a pressure tactic or proof of revenue lift; review cancellation and consent separately.", "Revenue and ranking signals are not controlled experiments or proof of ethical design." ], "limits": [ "The actual iOS app, revenue metrics, complete flow availability, account features and MCP integration were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://appllama.io/" }, { "label": "Observed sample or category", "url": "https://appllama.io/apps/6481115809/sideshift-earn-money" } ] } }, { "id": "appshot", "title": "Appshot Gallery", "url": "https://www.appshot.gallery/", "category": "Site inspiration & templates", "kind": "App-store screenshot reference", "summary": "Study how an app presents itself before installation.", "whatItIs": "Appshot’s current primary page identifies App Store screenshot inspiration, with filters for genre, tone and style. These are presentation references for discovery surfaces, which differs from observing a complete logged-in app workflow.", "whenUseful": "An app listing needs a clearer visual explanation of its value.", "example": "Draft a sequence of store screenshots using your own UI and verified feature claims, then test whether the first images tell a coherent story.", "expectedResult": "An app-listing storyboard with honest messaging.", "cautions": [ "Store screenshots can be promotional compositions rather than actual in-app states.", "Check current platform specifications separately and retain rights to all visible assets." ], "requirements": [ "Owned product screenshots, approved claims and current store requirements." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "The current primary page describes App Store screenshot inspiration, which is a marketing surface rather than a recorded in-app workflow." ], "sources": [ { "label": "Primary resource page", "url": "https://www.appshot.gallery/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The YoungPhoto screenshot detail worked, but the observed Functional category link returned a genuine 404 page. App-detail browsing is usable; that category path was broken in this snapshot.", "reportUrl": "/design-evaluations/resource-appshot.json", "identity": { "target": "https://www.appshot.gallery/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:631f2f945595eedfb31b43aed36aefe7e2ddc4f873c22233434b8646305e70e6 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.appshot.gallery/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “APPSHOT.GALLERY: App Store Screenshot Inspiration for ASO & Mobile UI”. 118 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed YoungPhoto - Aesthetic Camera Photo & Video 5.0 $1.99 link to https://www.appshot.gallery/app/youngphoto-aesthetic-camera.", "result": "pass", "observation": "The destination returned 200; title: “YoungPhoto - Aesthetic Camera | - ASO Screenshot Inspiration”. 79 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." }, { "name": "Functional category link", "mode": "browser", "method": "Follow the Functional category href observed on the homepage.", "result": "fail", "observation": "https://www.appshot.gallery/keyword/functional returned HTTP 404 and the site’s 404 page. The separate YoungPhoto detail check passed." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared frame-ancestors. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Appshot Gallery attempted requests to 9 additional hosts, including cdn.prod.website-files.com, d3e54v103j8qbb.cloudfront.net, ajax.googleapis.com, plausible.io. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the working detail route while checking category links before relying on them. These are App Store promotional screenshots, not an in-app workflow test." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "1 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the working detail route while checking category links before relying on them. These are App Store promotional screenshots, not an in-app workflow test.", "Store screenshots can be promotional compositions rather than actual in-app states." ], "limits": [ "No app was installed or purchased; other category paths, App Store requirements and screenshot reuse permissions were not validated.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.appshot.gallery/" }, { "label": "Observed sample or category", "url": "https://www.appshot.gallery/app/youngphoto-aesthetic-camera" } ] } }, { "id": "uxsnaps", "title": "UXSnaps", "url": "https://www.uxsnaps.com/", "category": "Site inspiration & templates", "kind": "Product design commentary", "summary": "Use product teardowns to form questions about your own interface.", "whatItIs": "UXSnaps publishes short and deeper UI/UX breakdowns of real products. Its explanations can help identify a pattern’s intended purpose, but an editorial interpretation is not a controlled test of effectiveness.", "whenUseful": "A team needs to explain why a pattern might help rather than merely collecting screenshots.", "example": "Read one onboarding breakdown, state the proposed benefit, and write a task-based test for your own version.", "expectedResult": "A testable design hypothesis.", "cautions": [ "Claims that a pattern works can depend on context and selection bias.", "Follow the original product and research sources where available; do not treat commentary as causal evidence." ], "requirements": [ "A specific pattern and a plan to validate it with the target audience." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.uxsnaps.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The Deep Dive control changed the rendered collection and active styling. Chromium loaded the UI despite a 429 response to the separate HTTP client.", "reportUrl": "/design-evaluations/resource-uxsnaps.json", "identity": { "target": "https://www.uxsnaps.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:1c8822d47616a2a6e104fd634331da14fc4a33f3b809a670e5c58d4a4b7ae165 — initial HTTP 429 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "blocked", "observation": "The standalone client received 429 at https://www.uxsnaps.com/. The fresh browser check is reported separately; this is not evidence that the site is offline." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “UXSnaps – Actionable UI/UX Breakdowns from Top Apps”. 435 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Activate the observed “Deep Dive” display control and compare the rendered state.", "result": "pass", "observation": "The page content changed and the control’s active styling changed; rendered image elements changed from 435 to 25." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared default-src, script-src, style-src, img-src, font-src, connect-src, frame-ancestors, base-uri, form-action; it also contained unsafe-inline. X-Frame-Options was DENY. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "UXSnaps attempted requests to 2 additional hosts, including www.googletagmanager.com, cdn.sanity.io. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Treat the breakdowns as editorial analysis. The filtered page contained membership language, and the test did not establish access to every long-form article." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "2 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Treat the breakdowns as editorial analysis. The filtered page contained membership language, and the test did not establish access to every long-form article.", "Claims that a pattern works can depend on context and selection bias." ], "limits": [ "No membership, weekly email subscription or account workflow was used, and the claimed design lessons were not reproduced in a controlled experiment.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.uxsnaps.com/" } ] } }, { "id": "logosystem", "title": "Logosystem", "url": "https://logosystem.co/", "category": "Brand & assets", "kind": "Logo reference", "summary": "Study how marks behave across forms and motion.", "whatItIs": "Logosystem curates logos, wordmarks, symbols and animated identity examples with creator references. It helps a team compare how an identity changes across contexts rather than selecting a logo to reuse.", "whenUseful": "You are writing an identity brief and need a vocabulary for variation.", "example": "Compare a wordmark, compact symbol and animated version, then define the roles your own identity must support.", "expectedResult": "A set of identity requirements for original design work.", "cautions": [ "The examples are other creators’ marks, not a pool of assets licensed for your brand.", "A successful large-format mark may fail at favicon size or in a single color." ], "requirements": [ "A brand brief and an original design process." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://logosystem.co/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Palmetto logo detail opened with Ragged Edge attribution and related logos. Public logo-detail browsing worked.", "reportUrl": "/design-evaluations/resource-logosystem.json", "identity": { "target": "https://logosystem.co/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:7727781b4c8f3d3b6e6b7b856e91fd76ff4397db1633ed555ff549c0e9af62fb — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://logosystem.co/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Logo Inspiration — 1,300+ Logos & Animated Logos | Logosystem”. 44 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Ragged Edge link to https://logosystem.co/logo/palmetto-2.", "result": "pass", "observation": "The destination returned 200; title: “Palmetto logo by Ragged Edge — Logosystem”. 15 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Logosystem attempted requests to 2 additional hosts, including cdn.logosystem.co, v-api.rolanddrice.workers.dev. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Preserve the creator attribution and study the construction rather than treating a gallery logo as an asset you may reuse." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Preserve the creator attribution and study the construction rather than treating a gallery logo as an asset you may reuse.", "The examples are other creators’ marks, not a pool of assets licensed for your brand." ], "limits": [ "No save or account action was taken; downloads, trademark clearance and animation behavior were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://logosystem.co/" }, { "label": "Observed sample or category", "url": "https://logosystem.co/logo/palmetto-2" } ] } }, { "id": "logobook", "title": "Logobook", "url": "https://logobook.com/", "category": "Brand & assets", "kind": "Logo archive", "summary": "Explore the construction of symbols and wordmarks.", "whatItIs": "Logobook organizes logo references by letters, shapes, objects and business categories. Its structured archive can help reveal recurring visual devices and distinguish them from a particular brand’s identity.", "whenUseful": "You need to understand a visual idea before drawing your own mark.", "example": "Study how several circular symbols use negative space, then sketch original directions with a different concept and silhouette.", "expectedResult": "An informed original exploration.", "cautions": [ "An archive entry does not grant reuse rights or establish trademark clearance.", "Do not infer suitability from longevity alone; test your own mark in realistic sizes and contexts." ], "requirements": [ "A defined identity problem and original artwork." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://logobook.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The A letter category opened with named logo entries and image assets. Public classification browsing worked.", "reportUrl": "/design-evaluations/resource-logobook.json", "identity": { "target": "https://logobook.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:a996ea383486e0df805dbb3c15b69c3cd8c0c9985094accbd8b8035d379a95f0 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://logobook.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Logobook - Discover the worlds finest logos, symbols and trademarks”. 329 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed A link to https://logobook.com/letter/a/.", "result": "pass", "observation": "The destination returned 200; title: “A Archives - Logobook”. 167 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Logobook attempted requests to 2 additional hosts, including ajax.googleapis.com, www.google-analytics.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Letter-based comparison can reveal common constructions, but it does not clear a new mark for use." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Letter-based comparison can reveal common constructions, but it does not clear a new mark for use.", "An archive entry does not grant reuse rights or establish trademark clearance." ], "limits": [ "No logo asset was downloaded, trademark search performed or newsletter subscribed to; historical ownership and licensing remain separate checks.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://logobook.com/" }, { "label": "Observed sample or category", "url": "https://logobook.com/letter/a/" } ] } }, { "id": "logoinspo", "title": "Logoinspo", "url": "https://www.logoinspo.com/", "category": "Brand & assets", "kind": "Logo reference", "summary": "Filter identity references by style, industry and color.", "whatItIs": "Logoinspo curates real and fictional logo work, with attribution to designers and links to original sources. Filters can narrow a visual search, while the brief still needs to explain what the identity should communicate.", "whenUseful": "An identity exploration has a clear direction but needs comparative examples.", "example": "Compare wordmark treatments for a specific tone, then write what your own typography must communicate.", "expectedResult": "A focused identity reference board.", "cautions": [ "Fictional and shipped identities are different kinds of evidence.", "Credit sources and avoid reproducing a mark; filters do not provide rights clearance." ], "requirements": [ "A brand strategy and a deliberate visual question." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.logoinspo.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Handi detail opened with related logos and decoded images. Account-free logo-detail navigation worked.", "reportUrl": "/design-evaluations/resource-logoinspo.json", "identity": { "target": "https://www.logoinspo.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:6f00359f38b5e04360baca0a96d3658d7554a2dfbdfa97ae9c9345b6ee08978f — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.logoinspo.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Logo Inspiration — 1,200+ Curated Logos | Logoinspo”. 40 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Open Handi details link to https://www.logoinspo.com/logo/handi.", "result": "pass", "observation": "The destination returned 200; title: “Handi Logo Design — Branding Inspiration | LogoInspo”. 17 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Logoinspo attempted requests to 2 additional hosts, including cdn.logoinspo.com, www.googletagmanager.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Verify whether the chosen mark is a real identity or a concept, and follow its original source before adapting a motif." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Verify whether the chosen mark is a real identity or a concept, and follow its original source before adapting a motif.", "Fictional and shipped identities are different kinds of evidence." ], "limits": [ "No download, ownership verification, trademark clearance or complete filter test was performed.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.logoinspo.com/" }, { "label": "Observed sample or category", "url": "https://www.logoinspo.com/logo/handi" } ] } }, { "id": "brandlogo", "title": "Brandlogo", "url": "https://brandlogo.co/", "category": "Brand & assets", "kind": "Brand reference", "summary": "Compare logo and identity approaches through a browsable reference gallery.", "whatItIs": "Brandlogo is a browsable logo and identity reference gallery with categories and visual classification controls. It helps compare how brands use shape, typography and color, while the original designer and brand remain the right places to establish reuse permissions.", "whenUseful": "A brand brief needs clearer choices about typography, shape and visual character.", "example": "Browse the Tech category, identify three different approaches to recognition, and describe the design choices without copying the marks.", "expectedResult": "A more precise identity brief grounded in original design decisions.", "cautions": [ "A logo gallery is a reference source, not a license to reuse marks.", "Category membership and visual similarity do not establish trademark clearance or suitability for a brand." ], "requirements": [ "A browser and a clear brand brief.", "Original artwork and rights checks for any final identity or asset use." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "The Tech category opened and rendered labeled brand examples. No logo file, submission flow or asset-license agreement was tested." ], "sources": [ { "label": "Logo reference gallery", "url": "https://brandlogo.co/" }, { "label": "Sampled Tech category", "url": "https://brandlogo.co/categories/tech/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The public Tech category opened with labeled examples. Current browsing is confirmed; asset rights and downloads are not.", "reportUrl": "/design-evaluations/resource-brandlogo.json", "identity": { "target": "https://brandlogo.co/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 ba2134c4ce15f373c71fe9c4620a35295a177d67ec9441dc8b73699e5ee2eda5 of one initial HTML response (928180 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Category navigation", "mode": "browser", "method": "Select Tech from the public catalog.", "result": "pass", "observation": "The browser reached /categories/tech/ with the Logos in tech - brandlogo title and labeled examples; the sampled DOM contained 351 images." }, { "name": "Download or submission", "mode": "browser", "method": "Download a logo or submit a listing.", "result": "not-run", "observation": "Neither asset transfer nor a submission was performed." } ], "security": { "scope": "One public category path and passive response/request observations.", "findings": [ { "level": "info", "basis": "observed", "title": "Multiple asset and directory origins", "detail": "The initial page requested font/CDN services and directory-badge hosts as well as the publisher origin. No user content was entered." }, { "level": "caution", "basis": "advice", "title": "Keep brand rights separate from browsing", "detail": "Obtain permission for reuse and review trademark implications in the actual use context; viewing a reference does not supply those rights." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Compare underlying design choices rather than carrying another company's mark into a finished identity.", "A gallery rendering test does not assess the original brands' websites or assets." ], "limits": [ "Only the Tech category was sampled; no download, submission or full outbound-link audit.", "No legal clearance, source-code or comprehensive accessibility assessment." ], "sources": [ { "label": "Logo reference gallery", "url": "https://brandlogo.co/" }, { "label": "Sampled Tech category", "url": "https://brandlogo.co/categories/tech/" } ] } }, { "id": "rebrand-gallery", "title": "Rebrand Gallery", "url": "https://www.rebrand.gallery/", "category": "Brand & assets", "kind": "Identity reference", "summary": "See an identity change as a system and a presentation.", "whatItIs": "Rebrand Gallery collects rebrand examples with reveal videos, marks and identity imagery, organized by attributes such as industry and studio. It can help explain how a visual system is introduced across touchpoints.", "whenUseful": "A team is planning an identity refresh or its launch presentation.", "example": "Study how one rebrand connects typography, imagery and motion, then map your own assets across the same touchpoints.", "expectedResult": "A rollout storyboard for an original identity.", "cautions": [ "A reveal film is a selected presentation, not evidence that customers understood or preferred the change.", "Videos, sound and identity assets need their own reuse permissions and accessible alternatives." ], "requirements": [ "An approved identity direction and rights to the assets used in the rollout." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.rebrand.gallery/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Kiss Branding detail opened with identity imagery and related rebrands. Public entry navigation worked despite visible sign-in options elsewhere in the page.", "reportUrl": "/design-evaluations/resource-rebrand-gallery.json", "identity": { "target": "https://www.rebrand.gallery/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:b2858e4c6cb61fe40e6b526100fd6832db6d7a7ce5dd0ccd0ada812a35dffec5 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.rebrand.gallery/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Rebrand Gallery — Best Rebrands & Brand Identity Inspiration”. 42 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Open Kiss Branding in new tab link to https://www.rebrand.gallery/rebrand/kiss-branding.", "result": "pass", "observation": "The destination returned 200; title: “Kiss Rebrand 2026: New Logo & Identity by Kiss Branding”. 9 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared default-src, script-src, style-src, img-src, font-src, connect-src, frame-src, worker-src, media-src, object-src, base-uri, form-action, frame-ancestors, upgrade-insecure-requests; it also contained unsafe-eval. X-Frame-Options was DENY. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Rebrand Gallery attempted requests to 4 additional hosts, including plausible.io, cdn.sanity.io, challenges.cloudflare.com, cdn.rebrand.gallery. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Compare the identity system and attribution; a reveal presentation does not establish customer preference or business impact." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Compare the identity system and attribution; a reveal presentation does not establish customer preference or business impact.", "A reveal film is a selected presentation, not evidence that customers understood or preferred the change." ], "limits": [ "No account, membership, video-download or licensed-asset workflow was used; full reveal playback and rights were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.rebrand.gallery/" }, { "label": "Observed sample or category", "url": "https://www.rebrand.gallery/rebrand/kiss-branding" } ] } }, { "id": "visual-journal", "title": "Visual Journal", "url": "https://visualjournal.it/", "category": "Brand & assets", "kind": "Brand and graphic-design reference", "summary": "Explore identity ideas beyond interface conventions.", "whatItIs": "Visual Journal is Alessandro Scarpellini’s editorial selection of branding and graphic-design work. Its perspective can help connect digital design with typography, print and broader visual communication.", "whenUseful": "A digital product needs a stronger connection to its brand world.", "example": "Use a packaging or editorial reference to describe a typographic hierarchy, then test that hierarchy in a readable screen layout.", "expectedResult": "A brand-informed visual direction.", "cautions": [ "Print composition does not automatically translate to responsive behavior or interactive controls.", "Retain creator attribution and obtain permission before reusing artwork, photography or type assets." ], "requirements": [ "A brand brief and an explicit translation from reference to screen." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://visualjournal.it/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Atlas Garden article opened with Ofform Studio attribution and project imagery. Public editorial browsing worked.", "reportUrl": "/design-evaluations/resource-visual-journal.json", "identity": { "target": "https://visualjournal.it/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:d6919a3e81ea58649ac9384d1edab374c57834aa2c37e24598a6b0533922fea5 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://visualjournal.it/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Visual Journal – Branding, Editorial and Graphic Design”. 12 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Atlas Garden on Visual Journal link to https://visualjournal.it/atlasgarden.", "result": "pass", "observation": "The destination returned 200; title: “Atlas Garden – Visual Journal”. 4 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Observed host boundary", "detail": "The initial Visual Journal browser visit attempted requests only to visualjournal.it. This does not cover later features, server-side processing or a complete session." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use print and branding work to inform composition while separately solving responsive layout and interactive states." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use print and branding work to inform composition while separately solving responsive layout and interactive states.", "Print composition does not automatically translate to responsive behavior or interactive controls." ], "limits": [ "No creator asset was downloaded or licensed, and the project’s real-world results or interactive implementation were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://visualjournal.it/" }, { "label": "Observed sample or category", "url": "https://visualjournal.it/atlasgarden" } ] } }, { "id": "brand-guidelines", "title": "Brand Guidelines", "url": "https://www.brandguidelines.net/", "category": "Brand & assets", "kind": "Brand documentation reference", "summary": "Study how organizations document identity decisions.", "whatItIs": "BrandGuidelines.net links curated brand manuals from different organizations and creators. It is useful for learning the structure of a guide while each original manual remains the authority for its own rules.", "whenUseful": "You need to document an identity so other people can apply it consistently.", "example": "Compare how two manuals explain logo spacing and color roles, then write equivalent rules using your own approved assets.", "expectedResult": "A clear outline for a brand guide.", "cautions": [ "A public brand manual does not authorize use of that organization’s identity.", "Linked files may be historical or hosted elsewhere; verify the original source before relying on a rule." ], "requirements": [ "Approved brand decisions and access to original manuals for reference." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.brandguidelines.net/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "An observed Spotify listing opened Spotify’s official Design & Branding Guidelines. The directory-to-primary-source route worked without a sign-in.", "reportUrl": "/design-evaluations/resource-brand-guidelines.json", "identity": { "target": "https://www.brandguidelines.net/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:2c19f3a16b6fcadf64b764b6c70cfe32b87970f06712bc606625a84746ec19f8 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.brandguidelines.net/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “The Brand Styleguide Document Showcase”. 39 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed ✨ New Spotify In-house link to https://developer.spotify.com/documentation/design.", "result": "pass", "observation": "The destination returned 200; title: “Design & Branding Guidelines | Spotify for Developers”. 40 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Brand Guidelines attempted requests to 6 additional hosts, including www.googletagmanager.com, events.framer.com, framerusercontent.com, fonts.gstatic.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Read the original owner’s usage conditions. A directory entry is not permission to reuse a brand identity." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "7 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Read the original owner’s usage conditions. A directory entry is not permission to reuse a brand identity.", "A public brand manual does not authorize use of that organization’s identity." ], "limits": [ "Other external manuals, hosted PDFs, premium templates and historical links were not checked; no manual was downloaded.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.brandguidelines.net/" }, { "label": "Observed sample or category", "url": "https://developer.spotify.com/documentation/design" } ] } }, { "id": "deck-gallery", "title": "Deck.gallery", "url": "https://www.deck.gallery/", "category": "Brand & assets", "kind": "Presentation reference", "summary": "Compare the pacing and hierarchy of complete decks.", "whatItIs": "Deck.gallery curates decks and slides across pitches, guidelines, reports and other presentation types. It helps a team examine how information unfolds across slides instead of decorating each slide independently.", "whenUseful": "A presentation needs a stronger narrative and clearer data hierarchy.", "example": "Map the sequence of a report deck, then rebuild the story using your own evidence and charts.", "expectedResult": "A presentation outline with a deliberate visual rhythm.", "cautions": [ "A polished deck is not evidence that its claims or business outcomes are valid.", "Membership and complete-deck access were not tested; do not reuse confidential-looking material or copyrighted slides without rights." ], "requirements": [ "A defined audience, verified content and an appropriate presentation format." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.deck.gallery/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The OK COOL TikTok Trend Report detail opened with preview imagery and related decks. Public preview access worked; sign-in and pricing options remained visible.", "reportUrl": "/design-evaluations/resource-deck-gallery.json", "identity": { "target": "https://www.deck.gallery/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:3d45888e591e6bb7dbc21c8d4389feaab6c0e71bb61a8cb171f586e1df5690f3 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.deck.gallery/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Deck.gallery - Beautifully designed decks, curated”. 257 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Report OK COOL TikTok Trend Report 2024 link to https://www.deck.gallery/ok-cool-chaos-2024/.", "result": "pass", "observation": "The destination returned 200; title: “OK COOL TikTok Trend Report 2024 - Deck.gallery”. 18 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared default-src, script-src, style-src, font-src, img-src, connect-src, frame-src, frame-ancestors, base-uri, form-action, object-src, upgrade-insecure-requests, worker-src; it also contained unsafe-inline. X-Frame-Options was DENY. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Deck.gallery attempted requests to 5 additional hosts, including static.cloudflareinsights.com, images.deck.gallery, guests.pikapod.net, clerk.deck.gallery. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the preview to study pacing and hierarchy, and verify access and rights before planning to reuse or redistribute deck material." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "9 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the preview to study pacing and hierarchy, and verify access and rights before planning to reuse or redistribute deck material.", "A polished deck is not evidence that its claims or business outcomes are valid." ], "limits": [ "No full deck was downloaded, membership purchased or private material supplied. Full-slide availability and reported business outcomes were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.deck.gallery/" }, { "label": "Observed sample or category", "url": "https://www.deck.gallery/ok-cool-chaos-2024/" } ] } }, { "id": "posts-design", "title": "posts.design", "url": "https://posts.design/", "category": "Brand & assets", "kind": "Social design reference", "summary": "Study how a brand communicates in a small feed canvas.", "whatItIs": "posts.design collects social posts, headers and Open Graph images with source references. It can help compare headline scale, visual hierarchy and campaign consistency across short-form touchpoints.", "whenUseful": "A launch needs a repeatable social visual system.", "example": "Compare announcement cards, then draft your own sequence using approved copy and product imagery.", "expectedResult": "A consistent social-post direction.", "cautions": [ "A post appearing in a gallery does not prove engagement, reach or conversion performance.", "Original artwork and brand marks remain protected; use the pattern, not another company’s claims or imagery." ], "requirements": [ "Approved messaging, owned assets and current channel format requirements." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://posts.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Launches category opened with product-announcement post references. Public category navigation and image delivery worked.", "reportUrl": "/design-evaluations/resource-posts-design.json", "identity": { "target": "https://posts.design/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:dde52292f5319267e4c38ba16d680673774bfa6eb2f9bdcee15ea53b3ef2f3a6 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://posts.design/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Social post design inspiration — posts.design”. 177 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Launches link to https://posts.design/categories/announcement.", "result": "pass", "observation": "The destination returned 200; title: “Product launch announcement post design examples — posts.design”. 34 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "posts.design attempted requests to 1 additional host, including static.cloudflareinsights.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Adapt the information hierarchy using your own approved message and assets; published social designs do not establish engagement lift." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "9 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Adapt the information hierarchy using your own approved message and assets; published social designs do not establish engagement lift.", "A post appearing in a gallery does not prove engagement, reach or conversion performance." ], "limits": [ "No post was published or saved, no account used and no social-platform rendering or performance test was run; live-presence WebSockets were blocked.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://posts.design/" }, { "label": "Observed sample or category", "url": "https://posts.design/categories/announcement" } ] } }, { "id": "ogfolio", "title": "OGFolio", "url": "https://www.ogfolio.com/", "category": "Brand & assets", "kind": "Social-preview reference", "summary": "Design a link preview that explains the destination.", "whatItIs": "OGFolio curates Open Graph images used in social sharing. It helps compare short headlines, identity placement and visual density on a canvas that is often viewed much smaller than the original image.", "whenUseful": "A blog, documentation or product page needs a useful share image.", "example": "Create an original preview with a short title and brand marker, then check it at small sizes and common crops.", "expectedResult": "A legible social-preview concept.", "cautions": [ "An attractive image does not confirm that page metadata or social crawlers are configured correctly.", "Use owned assets and test actual share previews; the gallery does not establish reuse permissions." ], "requirements": [ "A real destination title, owned assets and Open Graph metadata implementation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://www.ogfolio.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The gallery loaded and a Clicks.Page Open Graph reference image decoded at a usable preview size. The URL-analysis form was left untouched.", "reportUrl": "/design-evaluations/resource-ogfolio.json", "identity": { "target": "https://www.ogfolio.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:65421992738388c43a8d25c901c76604ea13e28e1e002fd7493c9335992957f7 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://www.ogfolio.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “OGFolio | Curated Library of Open Graph Images”. 140 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Bring a non-promotional gallery image into view and verify image decoding.", "result": "pass", "observation": "The “Clicks.Page” image decoded at 410×215 CSS pixels." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Observed host boundary", "detail": "The initial OGFolio browser visit attempted requests only to www.ogfolio.com. This does not cover later features, server-side processing or a complete session." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Use the reference image to plan a share-card composition, then validate your own metadata and crawler result separately." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "0 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Use the reference image to plan a share-card composition, then validate your own metadata and crawler result separately.", "An attractive image does not confirm that page metadata or social crawlers are configured correctly." ], "limits": [ "No domain was submitted to the analyzer, no board saved and no source-site social preview was fetched; image rights and metadata correctness remain untested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://www.ogfolio.com/" } ] } }, { "id": "uncut", "title": "UNCUT.wtf", "url": "https://uncut.wtf/", "category": "Brand & assets", "kind": "Typeface catalog", "summary": "Find a typeface with a distinct voice and practical fit.", "whatItIs": "UNCUT.wtf catalogs contemporary typefaces and links them to their creators. It is useful for expanding typography options, while the actual font files, language support and license need checking at the chosen typeface.", "whenUseful": "The default typeface does not suit the brand or content.", "example": "Test a candidate with long headings, tables, numerals and the languages the product must support.", "expectedResult": "A type choice supported by content samples.", "cautions": [ "The catalog’s commercial-use summary does not replace checking the actual font license and redistribution conditions.", "Evaluate loading, fallback metrics and small-text legibility before changing production typography." ], "requirements": [ "Appropriate font rights and representative content samples." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://uncut.wtf/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Uncut Sans detail opened with specimen content and a license-explanation section. Public typeface-detail navigation worked without downloading a font.", "reportUrl": "/design-evaluations/resource-uncut.json", "identity": { "target": "https://uncut.wtf/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:03140d75595ef091feeb5af8bff76cc90f07be0cf61a6f2e9b360e72c64beceb — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://uncut.wtf/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Welcome to UNCUT.wtf”. 164 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Info link to https://uncut.wtf/sans-serif/uncut-sans/.", "result": "pass", "observation": "The destination returned 200; title: “Download Uncut Sans – UNCUT.wtf, free typeface catalogue”. 3 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. An enforcing CSP response header declared default-src, connect-src, script-src, style-src, font-src, img-src, frame-ancestors, form-action; it also contained unsafe-inline. X-Frame-Options was SAMEORIGIN. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "UNCUT.wtf attempted requests to 2 additional hosts, including static.cloudflareinsights.com, cloudflareinsights.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Read the actual license included with the selected font, including redistribution and web embedding terms, before adding it to a build." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "3 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Read the actual license included with the selected font, including redistribution and web embedding terms, before adding it to a build.", "The catalog’s commercial-use summary does not replace checking the actual font license and redistribution conditions." ], "limits": [ "No font binary was downloaded, installed or scanned, and language coverage, file integrity and rendering across systems were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://uncut.wtf/" }, { "label": "Observed sample or category", "url": "https://uncut.wtf/sans-serif/uncut-sans/" } ] } }, { "id": "hugeicons", "title": "Hugeicons", "url": "https://hugeicons.com/", "category": "Brand & assets", "kind": "Icon library", "summary": "Use related glyphs for recurring product actions.", "whatItIs": "Hugeicons provides icon families in several visual styles and developer-oriented formats. The useful decision is selecting a coherent subset whose meanings remain understandable in the product.", "whenUseful": "An application needs consistent navigation and action icons.", "example": "Choose one style for search, settings and export, then pair unfamiliar symbols with text labels.", "expectedResult": "A small, consistent icon set with clear meanings.", "cautions": [ "Style consistency does not make a metaphor universally understandable.", "Check the selected set’s license and package; no icons were downloaded or installed here." ], "requirements": [ "The relevant icon rights and a format compatible with the application." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://hugeicons.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Stroke Rounded collection opened with icon previews. Account-free browsing reached the selected icon family.", "reportUrl": "/design-evaluations/resource-hugeicons.json", "identity": { "target": "https://hugeicons.com/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:5ef446b15346aa37823bc4aec226ec8976ee1b9bbc2ffd58f17bce2f56645d80 — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://hugeicons.com/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “Hugeicons - 60,000+ Free & Pro Icons for Designers & Developers”. 39 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Stroke Rounded link to https://hugeicons.com/icons/stroke-rounded.", "result": "pass", "observation": "The destination returned 200; title: “Free Stroke Rounded Icons for UI and Web | Hugeicons”. 128 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. No HSTS response header was observed. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "Hugeicons attempted requests to 6 additional hosts, including app.termly.io, www.googletagmanager.com, customer-support.hugeicons.com, static.cloudflareinsights.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Verify the selected family’s free or paid license and export format; a preview does not establish package entitlements or the clarity of a metaphor." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "5 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Verify the selected family’s free or paid license and export format; a preview does not establish package entitlements or the clarity of a metaphor.", "Style consistency does not make a metaphor universally understandable." ], "limits": [ "No icon package, Figma plugin, download or purchase was used; dependency behavior, SVG sanitization and assistive labels were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://hugeicons.com/" }, { "label": "Observed sample or category", "url": "https://hugeicons.com/icons/stroke-rounded" } ] } }, { "id": "icon-creator", "title": "Forma / Icon Creator", "url": "https://iconcreator.dev/", "category": "Brand & assets", "kind": "Icon design tool", "summary": "Style individual icons and inspect exported SVG output.", "whatItIs": "Forma / Icon Creator is a browser editor for choosing and styling icons, with export controls for individual SVG or PNG files and larger library exports. In the tested path, a selected Coffee icon accepted a new primary color and produced an SVG; that result covers one small export, not every icon pack or export mode.", "whenUseful": "You need a small icon adjusted to a product's color and visual treatment.", "example": "Choose a simple icon, set a synthetic brand color and export an SVG. Inspect the file, check its pack license and test it at the smallest intended size.", "expectedResult": "A styled icon file with explicit checks for rights, legibility and safe embedding.", "cautions": [ "A successful single SVG export does not establish that every export stays local to the browser.", "The publisher's privacy documentation describes server processing for library ZIP jobs; that data handling was not exercised.", "Small-size legibility and accessible use still need review in the destination interface." ], "requirements": [ "A browser and the appropriate license for the selected icon pack.", "Check exported files before embedding them, and supply meaningful labels when an icon conveys an action or status." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "A Coffee icon was selected, its primary color changed to #1E40AF and one 1,188-byte SVG exported. The sample contained the chosen color and no matched script, event-handler, foreignObject or external-reference patterns; this was a bounded check, not a complete sanitizer or pack-wide audit." ], "sources": [ { "label": "Public icon editor", "url": "https://iconcreator.dev/" }, { "label": "Publisher privacy documentation", "url": "https://iconcreator.dev/privacy" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "One synthetic icon edit and SVG export succeeded. The exported sample passed limited static pattern checks; library ZIP, PNG and broader privacy behavior remain untested.", "reportUrl": "/design-evaluations/resource-icon-creator.json", "identity": { "target": "https://iconcreator.dev/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 2edb117b41ce5ebdd2accf7a70e286bdc34559a1800e7bc0b4a6af3f46dfdf49 of one initial HTML response (3910 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Icon search and selection", "mode": "browser", "method": "Search coffee, select the visible Coffee icon and change its primary color to #1E40AF.", "result": "pass", "observation": "The search displayed nine matching controls; selecting Coffee enabled Undo, and the editor accepted the color." }, { "name": "Synthetic SVG export", "mode": "browser", "method": "Export the single icon as SVG and inspect the downloaded bytes in memory.", "result": "pass", "observation": "A 1,188-byte SVG included #1E40AF and valid opening/closing SVG markers. SHA-256: ef5e996b0603f9b287f94e993e87d5eee0fec4c5bf6a44e79a1a6c4203291577." }, { "name": "Bounded SVG pattern check", "mode": "source-review", "method": "Scan the exported bytes for script tags, event-handler attributes, foreignObject and external-reference patterns.", "result": "pass", "observation": "Zero matches were found for each checked pattern. This is not an exhaustive SVG sanitizer or proof that every export is safe." }, { "name": "Other export modes", "mode": "browser", "method": "Export PNG or a whole-library ZIP.", "result": "not-run", "observation": "Only one SVG was exported; no library job or uploaded asset was used." } ], "security": { "scope": "A synthetic icon edit/export, bounded static SVG inspection, passive page observations and the publisher's privacy documentation.", "findings": [ { "level": "info", "basis": "observed", "title": "One inspected output had no matched active-content patterns", "detail": "The 1,188-byte sample had no detected script, event-handler, foreignObject or external-reference patterns. The check is limited to this file and these patterns." }, { "level": "caution", "basis": "documented", "title": "Library ZIP exports use server processing", "detail": "The privacy page describes a server job that stores design settings and an export record for library ZIP generation. This workflow and the stated retention/link behavior were not verified." }, { "level": "caution", "basis": "advice", "title": "Do not infer local-only processing", "detail": "The single export succeeded while non-GET requests were blocked, but GET requests remained allowed and the download URL scheme was not recorded. This does not prove that design data never leaves the browser." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Inspect the license of the selected icon pack; one pack's terms do not cover every collection.", "Check rendering and accessibility in the final application, especially at small sizes and when icons act as controls." ], "limits": [ "One synthetic Coffee icon and one SVG only; no upload, PNG export, library ZIP, account or purchase.", "Static patterns are not a full sanitizer; no stored-data, retention, backend or network-payload audit." ], "sources": [ { "label": "Public icon editor", "url": "https://iconcreator.dev/" }, { "label": "Publisher privacy documentation", "url": "https://iconcreator.dev/privacy" } ] } }, { "id": "icon-museum", "title": "Icon Museum", "url": "https://icon.museum/", "category": "Brand & assets", "kind": "App-icon reference", "summary": "Study how app icons communicate identity at a compact size.", "whatItIs": "Icon Museum is a gallery of app icons with public search and links to individual app entries. It is useful for studying how a product communicates identity in a compact image; app branding is a different problem from choosing functional interface glyphs.", "whenUseful": "You are exploring a recognizable app or PWA icon.", "example": "Inspect original creator references, then test your own icon at home-screen and small notification sizes.", "expectedResult": "An original icon direction informed by scale and context.", "cautions": [ "Gallery images are not automatically licensed production assets.", "An attractive app icon does not establish recognizability at every size or accessible treatment in the surrounding interface." ], "requirements": [ "A browser and original artwork for a finished app icon.", "Check the source creator's rights before reusing any reference image." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Public search for Comet surfaced a matching Comet – AI Browser & Assistant entry. No email subscription, original asset download or individual app-detail workflow was exercised." ], "sources": [ { "label": "Public app-icon gallery", "url": "https://icon.museum/" }, { "label": "Observed Comet search destination", "url": "https://icon.museum/apps/comet-ai-browser-assistant" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "Public search surfaced a matching Comet app entry. Subscription, downloads and individual entry details remain outside the sample.", "reportUrl": "/design-evaluations/resource-icon-museum.json", "identity": { "target": "https://icon.museum/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 d62881fd0e61c0ea0a7d69b35fd6f3f3e585c3bc3d222d7aaf15b7a8ddef8f7d of one initial HTML response (3981 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Public app search", "mode": "browser", "method": "Open Search and enter the synthetic query Comet.", "result": "pass", "observation": "A matching Comet – AI Browser & Assistant suggestion linked to /apps/comet-ai-browser-assistant." }, { "name": "Subscription and asset use", "mode": "browser", "method": "Subscribe by email or download/reuse a gallery image.", "result": "not-run", "observation": "No email, account or image-transfer workflow was submitted." } ], "security": { "scope": "Public search with a nonprivate query and passive page/network observations.", "findings": [ { "level": "info", "basis": "observed", "title": "Gallery and asset hosts", "detail": "The sampled page requested icon.museum, assets.icon.museum and Cloudflare-related resources. No email or private input was entered." }, { "level": "caution", "basis": "advice", "title": "Use references without inheriting their identity", "detail": "Treat the gallery as a way to study composition and recognition; build original artwork and establish rights for any reused material." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "The background gallery remains in the DOM during search; its link count is not a count of search results.", "App-icon inspiration does not replace testing at small sizes or against neighboring icons." ], "limits": [ "One search suggestion was sampled; no app-detail, subscription, download or reuse-license audit.", "No comprehensive keyboard, screen-reader, source-code or backend assessment." ], "sources": [ { "label": "Public app-icon gallery", "url": "https://icon.museum/" }, { "label": "Observed Comet search destination", "url": "https://icon.museum/apps/comet-ai-browser-assistant" } ] } }, { "id": "3dicons", "title": "3dicons", "url": "https://3dicons.co/", "category": "Brand & assets", "kind": "3D illustration assets", "summary": "Use a related set of illustrations for a product story.", "whatItIs": "3dicons presents 3D icon renders and describes both open-source/free and premium offerings. These are often better suited to illustration or marketing than to tiny action glyphs.", "whenUseful": "A product explanation or empty state needs a consistent illustration treatment.", "example": "Choose one visual direction for a synthetic onboarding story and check the render at the actual display size.", "expectedResult": "A coherent illustration direction.", "cautions": [ "Do not assume every current asset uses the license associated with an older collection.", "Large renders can add transfer cost; decorative images need appropriate alternative-text treatment." ], "requirements": [ "Rights to the selected collection and an image pipeline suited to the required sizes." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://3dicons.co/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The Calendar detail opened and its 3D-icon reference imagery decoded. Public sample navigation worked.", "reportUrl": "/design-evaluations/resource-3dicons.json", "identity": { "target": "https://3dicons.co/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:e7b5740be68469751de3f9b3dfce1fa42c93eb1955342f838e69f169a98f892c — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://3dicons.co/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “3dicons - Open Source & Free Premium 3D Icon Library”. 53 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed public sample link to https://3dicons.co/icons/781f28-calendar.", "result": "pass", "observation": "The destination returned 200; title: “Calendar 3d icon - 3dicons”. 23 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "3dicons attempted requests to 3 additional hosts, including cloud.umami.is, bvconuycpdvgzbvbkijl.supabase.co, gateway.umami.is. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Check the selected asset’s current license and file weight rather than assuming every item shares the older free collection’s terms." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "7 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Check the selected asset’s current license and file weight rather than assuming every item shares the older free collection’s terms.", "Do not assume every current asset uses the license associated with an older collection." ], "limits": [ "No asset was downloaded, purchased or installed; archive contents, render variants, image optimization and reuse rights were not tested.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://3dicons.co/" }, { "label": "Observed sample or category", "url": "https://3dicons.co/icons/781f28-calendar" } ] } }, { "id": "kitbitz", "title": "Kitbitz", "url": "https://kitbitz.art/", "category": "Brand & assets", "kind": "Illustration catalog", "summary": "Search hand-drawn illustrations and check the publisher's asset terms.", "whatItIs": "Kitbitz is a searchable illustration library whose public documentation describes SVG and PNG downloads, along with Figma and read-only MCP access. Its license page distinguishes the original illustration assets from the proprietary platform and integration code, which matters when deciding what can be reused.", "whenUseful": "You are comparing a drawn illustration voice for onboarding or an empty state.", "example": "Verify a selected asset’s terms, then test its detail and tone with your own text at mobile size.", "expectedResult": "An illustration shortlist with source and license records, ready for file-level and layout checks.", "cautions": [ "The publisher labels its original illustration assets CC0 1.0; that does not cover all platform code, metadata, third-party marks or other rights.", "Search results can include broader semantic matches, so inspect the actual artwork rather than relying on a title match." ], "requirements": [ "A browser for searching; inspect the selected asset and its license before production use.", "Separate setup and permission review for the Figma or MCP workflows, which were not tested here." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Searching dragon returned six visible asset actions, including several dragon-themed items and broader related illustrations. The documentation and license page were reviewed; downloads, Figma and MCP were not exercised." ], "sources": [ { "label": "Illustration library", "url": "https://kitbitz.art/" }, { "label": "Getting-started documentation", "url": "https://kitbitz.art/docs/getting-started" }, { "label": "Publisher license", "url": "https://kitbitz.art/docs/license" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "Public illustration search worked and primary format/license documentation was readable. Asset files and integration workflows were not tested.", "reportUrl": "/design-evaluations/resource-kitbitz.json", "identity": { "target": "https://kitbitz.art/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 8e05c6ec83191d0a9f9f0dbba79c3bff105ae35b2bc1c9b9cc9c921711b7296a of one initial HTML response (7039 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Illustration search", "mode": "browser", "method": "Enter dragon in the public search combobox.", "result": "pass", "observation": "Six visible asset actions appeared, including Dragon Sign and Dragon Egg alongside broader related illustrations." }, { "name": "Primary documentation", "mode": "source-review", "method": "Read the publisher's getting-started and license pages.", "result": "pass", "observation": "The pages describe SVG/PNG downloads and distinguish original illustration assets from platform and integration code." }, { "name": "Asset and integration workflows", "mode": "browser", "method": "Download an asset or connect Figma/MCP.", "result": "not-run", "observation": "No asset download, plugin connection or MCP call was performed." } ], "security": { "scope": "Public search, primary documentation and passive request observations; no integration connection.", "findings": [ { "level": "info", "basis": "documented", "title": "Asset and code licensing are separate", "detail": "The publisher's license page identifies original illustration assets as CC0 1.0 while reserving platform, plugin, MCP source, metadata and documentation. This reports the publisher's terms, not a legal clearance for every use." }, { "level": "caution", "basis": "advice", "title": "Review integrations separately", "detail": "A public catalog search does not verify the Figma plugin or MCP's installation, permissions, data access or runtime behavior." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Keep an asset's source and current license with the project; third-party trademark or publicity rights may still matter.", "Check file structure, visual fit and accessible treatment after choosing a particular illustration." ], "limits": [ "One query and primary documentation only; no asset bytes, installation, Figma or MCP runtime.", "No broad content-rights, dependency, accessibility or backend audit." ], "sources": [ { "label": "Illustration library", "url": "https://kitbitz.art/" }, { "label": "Getting-started documentation", "url": "https://kitbitz.art/docs/getting-started" }, { "label": "Publisher license", "url": "https://kitbitz.art/docs/license" } ] } }, { "id": "ui-gradients", "title": "uiGradients — address review", "url": null, "category": "Color & backgrounds", "kind": "Gradient reference", "summary": "Find gradient color combinations and inspect their CSS.", "whatItIs": "uigradients.com is a working gradient library with a linked official repository and controls for changing direction and viewing CSS. The ui.gradients.com address did not resolve, and no primary evidence established that it belongs to the same product, so the catalog identity remains unresolved.", "whenUseful": "Use the verified library as a gradient research option after confirming it is the intended source.", "example": "Choose a subtle gradient for a nonessential background and test foreground text across its entire range.", "expectedResult": "A background token with checked contrast.", "cautions": [ "A functioning candidate site is not proof of a relationship to a different domain.", "Gradient selection does not validate text contrast, brand fit or current browser compatibility of every copied declaration." ], "requirements": [ "Confirm the intended resource identity before relying on a product link.", "A CSS implementation and contrast checks for the actual text and controls placed over the gradient." ], "reviewStatus": "unverified", "reviewedOn": "2026-10-19", "reviewNotes": [ "The ui.gradients.com address failed DNS resolution. At the separate uigradients.com candidate, rotating direction changed computed CSS and the CSS view displayed gradient declarations; the official repository was also confirmed. No confirmed visit link is assigned to the unresolved catalog identity." ], "sources": [ { "label": "Candidate gradient library; identity association unconfirmed", "url": "https://uigradients.com/" }, { "label": "Candidate official repository", "url": "https://github.com/ghosh/uiGradients" }, { "label": "Unresolved earlier address", "url": "https://ui.gradients.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "unresolved", "modes": [ "http", "browser", "source-review" ], "summary": "The uigradients.com candidate's direction and CSS controls work, but its connection to ui.gradients.com remains unconfirmed.", "reportUrl": "/design-evaluations/resource-ui-gradients.json", "identity": { "target": "Candidate only; attribution unresolved: https://uigradients.com/", "version": "Unversioned public page observed 2026-10-19", "integrity": "SHA-256 a4fcf664c5db424ba286b50135aa6ab3fe8d6f1efea5ca6b7509ce46fd2790d1 of one initial HTML response (2342 bytes). This does not fingerprint the entire application or its dependencies." }, "environment": [ "Windows; Chrome 155.0.8059.82 headless via Playwright, fresh isolated contexts with a 1365 × 900 viewport.", "Reduced motion requested. GET/HEAD requests allowed; other methods and WebSocket connections blocked.", "No owner browser profile, account, credentials, purchase, upload, private fixture or service write." ], "tests": [ { "name": "Original address", "mode": "http", "method": "Open https://ui.gradients.com/ in a fresh browser.", "result": "blocked", "observation": "The request failed with ERR_NAME_NOT_RESOLVED." }, { "name": "Candidate direction control", "mode": "browser", "method": "At uigradients.com, use Rotate gradient and compare computed backgrounds.", "result": "pass", "observation": "Sampled backgrounds changed from horizontal to vertical directions." }, { "name": "Candidate CSS view", "mode": "browser", "method": "Open the candidate's CSS view.", "result": "pass", "observation": "The interface displayed corresponding linear-gradient declarations." }, { "name": "Identity resolution", "mode": "source-review", "method": "Look for primary evidence linking the two domain names.", "result": "blocked", "observation": "The candidate links its official GitHub repository, but no redirect or publisher statement linked ui.gradients.com to it." } ], "security": { "scope": "Candidate public controls, passive request observations and the linked official repository; no verified identity substitution.", "findings": [ { "level": "info", "basis": "observed", "title": "Candidate uses third-party scripts", "detail": "The candidate page requested analytics services including Hotjar and Google Analytics. The simple CSS display does not mean the hosting page has no external data flows." }, { "level": "caution", "basis": "advice", "title": "Keep identity and functionality separate", "detail": "The candidate's working controls support a bounded functionality observation, not a claim that the unresolved address is an alias or a safe automatic replacement." } ], "limits": [ "Passive public-page observations and the stated bounded sample only; no exploitation, authenticated authorization, backend, retention or comprehensive dependency audit.", "Request blocking changes application behavior; no secure/safe certification is implied." ] }, "practicalCaveats": [ "Use the candidate sources as explicitly labeled references until the intended identity is confirmed.", "Test contrast over the whole gradient and simplify dated vendor-prefixed output where appropriate to the target browsers." ], "limits": [ "No primary association between the two addresses was found; identity remains unresolved.", "No repository installation, all-gradient audit, comprehensive accessibility test or analytics-payload assessment." ], "sources": [ { "label": "Candidate gradient library; identity association unconfirmed", "url": "https://uigradients.com/" }, { "label": "Candidate official repository", "url": "https://github.com/ghosh/uiGradients" }, { "label": "Unresolved earlier address", "url": "https://ui.gradients.com/" } ] } }, { "id": "ibelick-backgrounds", "title": "Ibelick Background Snippets", "url": "https://bg.ibelick.com/", "category": "Color & backgrounds", "kind": "CSS backgrounds", "summary": "Add a restrained background without a new visual framework.", "whatItIs": "Ibelick’s collection provides Tailwind and plain-CSS background snippets with a linked repository. The site notes that previews can differ from the final page, which makes in-context review essential.", "whenUseful": "A hero or authentication surface needs depth while the content stays clear.", "example": "Apply one subtle pattern behind a plain content surface and test text, focus outlines and narrow layouts.", "expectedResult": "A background treatment that supports the content.", "cautions": [ "Patterns and gradients can reduce contrast or compete with error and focus states.", "Review CSS scope and reuse terms; no snippet was installed or benchmarked here." ], "requirements": [ "CSS or Tailwind integration and a real page for contrast checks." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation and the bounded account-free checks below were reviewed. The page rendered background-choice elements, but the first-choice/reset probe did not establish a preview change. Ten inspected choice-like divs lacked role and tabindex attributes; a complete keyboard audit was not performed." ], "sources": [ { "label": "Primary resource page", "url": "https://bg.ibelick.com/" }, { "label": "Official repository", "url": "https://github.com/ibelick/background-snippets" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser" ], "summary": "The page rendered background-choice elements, but the first-choice/reset probe did not establish a preview change. Ten inspected choice-like divs lacked role and tabindex attributes; a complete keyboard audit was not performed.", "reportUrl": "/design-evaluations/resource-ibelick-backgrounds.json", "identity": { "target": "https://bg.ibelick.com/", "version": "Unversioned public page checked 2026-10-19", "integrity": "sha256:a0a2f9f4f0293cd7817fee4d3ee7be4385087799d740fb9c0a143fc59828ded0" }, "environment": [ "Chromium 155.0.8059.82 on Windows; fresh temporary profile and fresh account-free contexts.", "Public HTTPS GET/HEAD requests only; telemetry/auth routes and WebSockets blocked. No account storage or credential environment variables." ], "tests": [ { "name": "Public document and DOM", "mode": "browser", "method": "Fresh Chromium GET, then inspect rendered controls after hydration delay", "result": "pass", "observation": "HTTP 200; 2 captured button labels; 0 inputs; 0 canvases." }, { "name": "Background preview selection and reset", "mode": "browser", "method": "Click first background choice, then use Reset background; inspect selector semantics and preview state", "result": "fail", "observation": "{\"selectionChanged\":false,\"resetChanged\":false,\"semantics\":{\"tag\":\"DIV\",\"role\":null,\"tabindex\":null}}" } ], "security": { "scope": "Passive inspection of the public response headers, requested hosts and the named browser sample. No active exploitation, authenticated permissions test or complete security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Choice semantics deserve a direct keyboard check", "detail": "The inspected cursor-pointer divs had no role or tabindex. The click/reset probe did not confirm their behavior, so this is a specific inspection lead rather than an accessibility verdict." } ], "limits": [ "No authenticated workspace, private content, production backend permissions or data-retention verification.", "No confirmed picker state transition, copied background integration, contrast measurement or complete DOM accessibility audit." ] }, "practicalCaveats": [ "Inspect the actual copied CSS on your content and verify that any interactive picker remains keyboard accessible.", "Pin and recheck the selected version or sample before adoption; the observations apply only to the scope and date shown." ], "limits": [ "No confirmed picker state transition, copied background integration, contrast measurement or complete DOM accessibility audit.", "Fresh-browser restrictions can affect external assets and hydration. Initial failed selectors and limited probes remain in the evidence; they are not blanket product failures." ], "sources": [ { "label": "Primary public resource", "url": "https://bg.ibelick.com/" } ] } }, { "id": "abtest-design", "title": "abtest.design", "url": "https://abtest.design/", "category": "Evidence", "kind": "Experiment-result catalog", "summary": "Use reported experiments to form a better hypothesis.", "whatItIs": "abtest.design curates reported A/B test outcomes across flows such as onboarding, checkout and paywalls. It is a useful discovery layer for experiments, while each claim needs its original methodology and context before it can inform a decision.", "whenUseful": "A team is considering a change because another product appears successful.", "example": "Follow a relevant case to its original source, record the audience and metric, then design a test for your own users.", "expectedResult": "A specific hypothesis and measurement plan.", "cautions": [ "Published winners are a selected sample; effects do not transfer automatically between products.", "Sample size, uncertainty, duration and guardrail metrics may be absent, so a percentage alone is insufficient evidence." ], "requirements": [ "Original experiment details and a valid measurement plan for the target product." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-18", "reviewNotes": [ "Public primary documentation reviewed. See the account-free evaluation for executed checks and remaining workflow limits." ], "sources": [ { "label": "Primary resource page", "url": "https://abtest.design/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The VEED pricing-options case opened with its example imagery and related tests. Public case-study navigation worked; its reported uplift was not independently reproduced.", "reportUrl": "/design-evaluations/resource-abtest-design.json", "identity": { "target": "https://abtest.design/", "version": "Unversioned public page observed on 2026-10-19", "integrity": "sha256:02a8d096b4112c644ec0fe83e77ba045be6f323cad83635dcdb49e03053d621b — initial HTTP 200 response body only; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82, 1365×900 desktop viewport.", "Separate fresh, ephemeral browser contexts for entry and interaction; no owner profile, credentials or stored session.", "Only GET/HEAD network requests allowed; forms, downloads, WebSockets and service workers blocked. Some analytics endpoints also blocked.", "Short bounded waits; no mobile, assistive-technology, cross-browser or performance certification." ], "tests": [ { "name": "Public HTTP response", "mode": "http", "method": "Anonymous GET with redirects followed, response-body SHA-256 and selected security-header summaries; no cookies retained.", "result": "pass", "observation": "The standalone client received 200 at https://abtest.design/. This establishes response delivery only." }, { "name": "Fresh browser entry", "mode": "browser", "method": "Open the catalog URL in a new anonymous Chromium context with read-only network guards and no inherited profile.", "result": "pass", "observation": "The document returned 200 and identified itself as “abtest.design”. 105 image elements were present; no account was used." }, { "name": "Observed public sample or navigation", "mode": "browser", "method": "Follow the observed Showing pricing options upfront New VEED • +15% trial conversion link to https://abtest.design/tests/showing-pricing-options-upfront.", "result": "pass", "observation": "The destination returned 200; title: “Showing pricing options upfront”. 54 page image elements had decoded during the bounded wait. This count is not a catalog size or performance benchmark." } ], "security": { "scope": "Passive inspection of the initial public document’s response headers and anonymous browser request hostnames, with read-only guards. No source exploitation, account access, dependency audit or private data.", "findings": [ { "level": "info", "basis": "observed", "title": "Public response protections", "detail": "The initial browser page used HTTPS. Its response included HSTS. No enforcing Content-Security-Policy response header was observed. This records the sampled response only; meta policies, backend authorization and exploit resistance were not assessed." }, { "level": "info", "basis": "observed", "title": "Request surface in the anonymous visit", "detail": "abtest.design attempted requests to 6 additional hosts, including www.googletagmanager.com, events.framer.com, framerusercontent.com, fonts.gstatic.com. Host counts include requests stopped by the test guard; they do not establish what data a service retained." }, { "level": "caution", "basis": "advice", "title": "Before using this reference", "detail": "Before borrowing the change, look for the original sample, duration, uncertainty and guardrails. A selected winner is not a transferable result." } ], "limits": [ "No authentication, authorization, tenant separation, data retention or backend handling was tested.", "Header presence or absence is a sampled configuration observation, not a security certification or an exploit finding.", "6 blocked-request records were retained across entry and interaction checks. Guards may alter normal page behavior; the logs do not represent unrestricted traffic." ] }, "practicalCaveats": [ "Before borrowing the change, look for the original sample, duration, uncertainty and guardrails. A selected winner is not a transferable result.", "Published winners are a selected sample; effects do not transfer automatically between products." ], "limits": [ "No experiment was run and no source analytics, account data, statistical calculation or original allocation method was inspected.", "Results describe the observed public pages and a bounded action, not the entire product or the referenced designs." ], "sources": [ { "label": "Public resource entry", "url": "https://abtest.design/" }, { "label": "Observed sample or category", "url": "https://abtest.design/tests/showing-pricing-options-upfront" } ] } }, { "id": "base-ui", "title": "Base UI", "url": "https://base-ui.com/", "category": "Components", "kind": "Unstyled React primitives", "summary": "Build a distinct interface without rebuilding dialog, menu and focus behavior from scratch.", "whatItIs": "Base UI provides composable React controls without a finished visual theme. You assemble parts such as a dialog trigger, popup, title and close button, then supply your own styles. It is a foundation for a product design system, not a page template or a backend.", "whenUseful": "Choose it when a React product needs a strong brand treatment and your team can maintain shared component wrappers. It is especially useful for replacing several slightly different implementations of the same overlay or input.", "example": "Proposed workflow: turn a knowledge-base article's settings into a reusable dialog. Give it a clear title, a labelled summary field and separate Cancel and Save actions. Reuse that wrapper in the collection editor, then test keyboard entry, errors, dismissal and focus return with real content. The evaluation below used a smaller synthetic dialog and did not save an article.", "expectedResult": "One styled settings pattern with explicit focus and state behavior, plus a checklist for the application-specific save and error flows.", "cautions": [ "Unstyled does not mean finished: contrast, target size and visible focus still depend on your CSS.", "Portals create a separate rendering location. Check stacking, scroll locking and nested overlays in your app.", "Opening a protected action in a dialog does not authorize it. Enforce permissions and validation in the application backend." ], "requirements": [ "A React application and a package manager; the inspected @base-ui/react 1.9.0 manifest supports React 17, 18 or 19.", "Your own styling, accessible labels, visible focus treatment and application tests. The package is MIT licensed; preserve applicable notices." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): Adds an actively maintained unstyled foundation with a different composition API from the catalog's styled component kits. GitHub reported 11,181 stars for the upstream repository (mui/base-ui); the sampled default-branch commit is dated 2026-10-19. This is a dated popularity/activity snapshot, not a measured growth rate or safety ranking.", "Public official documentation and declared package requirements reviewed. The example above is a proposed workflow; executed checks are listed separately below.", "Earlier selector, focus-timing and setup probes remain in the retained evidence. Final conclusions use the corrected bounded tests and keep unmet coverage explicit." ], "sources": [ { "label": "Official documentation", "url": "https://base-ui.com/react/overview/quick-start" }, { "label": "Official evaluated sample", "url": "https://base-ui.com/react/components/dialog" }, { "label": "Upstream repository", "url": "https://github.com/mui/base-ui" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/mui/base-ui", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/mui/base-ui/commit/8c2b3182bdcde79704a2d5dc1147a680d031250e", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@base-ui/react/1.9.0", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Accessibility responsibilities", "url": "https://base-ui.com/react/overview/accessibility" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture" ], "summary": "The official notification dialog passed keyboard opening, settled focus containment and Escape restoration. A separate @base-ui/react 1.9.0 fixture passed six checks for labels, focus, state callbacks and literal React text insertion. Neither test saved data.", "reportUrl": "/design-evaluations/resource-base-ui.json", "identity": { "target": "https://base-ui.com/react/components/dialog plus a local @base-ui/react fixture", "version": "Local @base-ui/react 1.9.0; React and React DOM 19.3.1 for the Dialog fixtures. Public demo is separately unversioned.", "integrity": "Package archive SHA-256 bcb2f90923d9be3200cde3b27cb1a8d1c832a4f5bc7d3709a4f4c99d3de771ab (npm SHA-512 integrity matched). Public document SHA-256 017006d6215b97fc5e5571b99b34a67aee57971a5eb21a7a372c7e8ed15c0338; response-body scope only." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked.", "Exact direct dependencies; 38-package lock installed with --ignore-scripts, empty user/global npm configs, isolated cache and allowlisted environment. No lifecycle install scripts ran.", "Local browser responses served only the authored fixture, pinned bundle or stylesheet. External HTTP(S) requests were denied, with zero recorded attempts in the final fixture. WebSocket attempts were blocked but not counted.", "Existing Rolldown 1.2.14 bundled inspected prebuilt exports without running upstream build scripts." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://base-ui.com/react/components/dialog. Reachability only." }, { "name": "Keyboard open and dialog semantics", "mode": "browser", "method": "Focus the first documented dialog trigger; press Enter; inspect visible dialog and accessible-name reference.", "result": "pass", "observation": "A visible dialog opened; aria-labelledby target present=True. Presence of a reference is not a screen-reader test." }, { "name": "Bounded dialog focus containment", "mode": "browser", "method": "Press Tab six times while the sample remains open and inspect focus containment after each press, allowing browser chrome or focus guards.", "result": "pass", "observation": "All six settled Tab samples stayed inside the dialog. This does not establish every focus path or nested-overlay behavior." }, { "name": "Escape and focus restoration", "mode": "browser", "method": "Press Escape, wait for exit animation and inspect closed state plus focus on original trigger.", "result": "pass", "observation": "Closed=true; trigger focus restored=true. No save action or form submission." }, { "name": "Pinned dialog opening and labels", "mode": "local-fixture", "method": "Press Enter on the authored trigger and inspect the dialog name and description relationships.", "result": "pass", "observation": "{\"title\":\"Synthetic settings\",\"description\":\"A synthetic local form; nothing is saved.\"}" }, { "name": "Initial focus", "mode": "local-fixture", "method": "Inspect focused element after the modal opens.", "result": "pass", "observation": "{\"inside\":true,\"tag\":\"INPUT\"}" }, { "name": "Tab containment", "mode": "local-fixture", "method": "Press Tab six times with a brief focus-settlement wait; inspect containment.", "result": "pass", "observation": "[true,true,true,true,true,true]" }, { "name": "React text insertion boundary", "mode": "local-fixture", "method": "Render a synthetic HTML-looking string as a React child and inspect text, image count and recorded HTTP(S) request attempts.", "result": "pass", "observation": "Literal text retained=true; image nodes=0; recorded HTTP(S) request attempts=0. React text composition only; no HTML sanitizer tested. WebSocket attempts were blocked but not counted." }, { "name": "Escape closure and restoration", "mode": "local-fixture", "method": "Press Escape and inspect removed dialog plus focus on original trigger.", "result": "pass", "observation": "{\"closed\":true,\"focused\":true}" }, { "name": "Close action and state callback", "mode": "local-fixture", "method": "Reopen by pointer, activate the component Close control and inspect open-change callbacks.", "result": "pass", "observation": "Open state callbacks [true,false,true,false]; dialog removed=true; no persistence handler attached." } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "caution", "basis": "documented", "title": "Focus behavior still needs visible styling", "detail": "Base UI documents automatic focus management but leaves visible focus styling to the application. The fixture's blue outline was authored for the test, not supplied by the library." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included content-security-policy, strict-transport-security, x-content-type-options, x-frame-options, referrer-policy. Requests attempted 1 additional host(s), including www.googletagmanager.com. The guard blocked 1 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "info", "basis": "observed", "title": "Pinned fixture network boundary", "detail": "All six @base-ui/react fixture checks completed with zero recorded HTTP(S) request attempts and zero page errors. WebSocket attempts were blocked but not counted. This applies to the small authored fixture; it is not a claim about every export, dependency or integration." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "Unstyled does not mean finished: contrast, target size and visible focus still depend on your CSS.", "Portals create a separate rendering location. Check stacking, scroll locking and nested overlays in your app.", "Opening a protected action in a dialog does not authorize it. Enforce permissions and validation in the application backend." ], "limits": [ "The full @base-ui/react package was installed, but only Dialog was exercised. Other controls, nested overlays, server rendering, mobile gestures and assistive technologies were not tested.", "The synthetic fixture used authored focus styles; it does not establish the accessibility of a team's finished visual theme." ], "sources": [ { "label": "Official documentation", "url": "https://base-ui.com/react/overview/quick-start" }, { "label": "Official evaluated sample", "url": "https://base-ui.com/react/components/dialog" }, { "label": "Upstream repository", "url": "https://github.com/mui/base-ui" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/mui/base-ui", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/mui/base-ui/commit/8c2b3182bdcde79704a2d5dc1147a680d031250e", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@base-ui/react/1.9.0", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Accessibility responsibilities", "url": "https://base-ui.com/react/overview/accessibility" } ] } }, { "id": "radix-ui", "title": "Radix Primitives", "url": "https://www.radix-ui.com/primitives", "category": "Components", "kind": "Unstyled React primitives", "summary": "Use focused UI building blocks when you need control over markup and appearance.", "whatItIs": "Radix Primitives is a React library for common interaction patterns such as dialogs, menus, tabs and tooltips. Its component parts handle state and many keyboard details while leaving styling to the application. This review covers Primitives rather than the separate Radix Themes offering.", "whenUseful": "It fits teams building a shared React component layer or improving a custom interface one control at a time. It also helps explain the behavior beneath many styled wrappers already in the catalog.", "example": "Proposed workflow: replace three different edit-record modals with one Radix Dialog wrapper. Include a title and description, make the first field labelled, and restore focus to the row's Edit button on cancellation. Add a second review step for unsaved changes instead of assuming Escape should discard work. Our fixture tested dialog mechanics, not database updates or that unsaved-change policy.", "expectedResult": "A consistent editing shell that can be styled for the product while keeping data validation and persistence explicit.", "cautions": [ "The asChild composition option can lose behavior when a custom child drops props or refs, or uses an unsuitable element.", "Keep separately installed Radix packages aligned; shared dependency duplication can complicate upgrades and bundle size.", "A modal can constrain interaction while open; it cannot establish who may read or change a record." ], "requirements": [ "A compatible React application. The pinned @radix-ui/react-dialog 1.3.1 manifest accepts React 16.8 through 19; the fixture used React 19.3.1.", "Styles, useful accessible names and careful forwarding of props and refs when composing custom children. Primitives is MIT licensed." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): Adds the widely used primitive layer behind many React kits, so readers can compare that foundation with finished styling systems. GitHub reported 19,406 stars for the upstream repository (radix-ui/primitives); the sampled default-branch commit is dated 2026-10-14. This is a dated popularity/activity snapshot, not a measured growth rate or safety ranking.", "Public official documentation and declared package requirements reviewed. The example above is a proposed workflow; executed checks are listed separately below.", "Earlier selector, focus-timing and setup probes remain in the retained evidence. Final conclusions use the corrected bounded tests and keep unmet coverage explicit." ], "sources": [ { "label": "Official documentation", "url": "https://www.radix-ui.com/primitives/docs/overview/introduction" }, { "label": "Official evaluated sample", "url": "https://www.radix-ui.com/primitives/docs/components/dialog" }, { "label": "Upstream repository", "url": "https://github.com/radix-ui/primitives" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/radix-ui/primitives", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/radix-ui/primitives/commit/eb3a2b7091293e27df8f9ba906632d8daa3d81a3", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@radix-ui/react-dialog/1.3.1", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Radix accessibility guidance", "url": "https://www.radix-ui.com/primitives/docs/overview/accessibility" }, { "label": "Composition and custom-child requirements", "url": "https://www.radix-ui.com/primitives/docs/guides/composition" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture" ], "summary": "The official edit-profile dialog passed opening, six Tab steps and Escape focus restoration. The pinned Dialog 1.3.1 fixture passed six additional checks, including state callbacks and React text insertion. Save changes was never activated.", "reportUrl": "/design-evaluations/resource-radix-ui.json", "identity": { "target": "https://www.radix-ui.com/primitives/docs/components/dialog plus a local @radix-ui/react-dialog fixture", "version": "Local @radix-ui/react-dialog 1.3.1; React and React DOM 19.3.1 for the Dialog fixtures. Public demo is separately unversioned.", "integrity": "Package archive SHA-256 485336a3a4118d0f7e49504a3b2752c8975ea0e5e3ad1c944ff055d2d2fc15f2 (npm SHA-512 integrity matched). Public document SHA-256 6b061c025b95533dfa1b6ec88666c7471e4a3a6d2e3f38be70e70a004be7572e; response-body scope only." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked.", "Exact direct dependencies; 38-package lock installed with --ignore-scripts, empty user/global npm configs, isolated cache and allowlisted environment. No lifecycle install scripts ran.", "Local browser responses served only the authored fixture, pinned bundle or stylesheet. External HTTP(S) requests were denied, with zero recorded attempts in the final fixture. WebSocket attempts were blocked but not counted.", "Existing Rolldown 1.2.14 bundled inspected prebuilt exports without running upstream build scripts." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://www.radix-ui.com/primitives/docs/components/dialog. Reachability only." }, { "name": "Keyboard open and dialog semantics", "mode": "browser", "method": "Focus the first documented dialog trigger; press Enter; inspect visible dialog and accessible-name reference.", "result": "pass", "observation": "A visible dialog opened; aria-labelledby target present=True. Presence of a reference is not a screen-reader test." }, { "name": "Bounded dialog focus containment", "mode": "browser", "method": "Press Tab six times while the sample remains open and inspect focus containment after each press.", "result": "pass", "observation": "All six settled Tab samples stayed inside the dialog. This does not establish every focus path or nested-overlay behavior." }, { "name": "Escape and focus restoration", "mode": "browser", "method": "Press Escape, wait for exit animation and inspect closed state plus focus on original trigger.", "result": "pass", "observation": "Closed=true; trigger focus restored=true. No save action or form submission." }, { "name": "Pinned dialog opening and labels", "mode": "local-fixture", "method": "Press Enter on the authored trigger and inspect the dialog name and description relationships.", "result": "pass", "observation": "{\"title\":\"Synthetic settings\",\"description\":\"A synthetic local form; nothing is saved.\"}" }, { "name": "Initial focus", "mode": "local-fixture", "method": "Inspect focused element after the modal opens.", "result": "pass", "observation": "{\"inside\":true,\"tag\":\"INPUT\"}" }, { "name": "Tab containment", "mode": "local-fixture", "method": "Press Tab six times with a brief focus-settlement wait; inspect containment.", "result": "pass", "observation": "[true,true,true,true,true,true]" }, { "name": "React text insertion boundary", "mode": "local-fixture", "method": "Render a synthetic HTML-looking string as a React child and inspect text, image count and recorded HTTP(S) request attempts.", "result": "pass", "observation": "Literal text retained=true; image nodes=0; recorded HTTP(S) request attempts=0. React text composition only; no HTML sanitizer tested. WebSocket attempts were blocked but not counted." }, { "name": "Escape closure and restoration", "mode": "local-fixture", "method": "Press Escape and inspect removed dialog plus focus on original trigger.", "result": "pass", "observation": "{\"closed\":true,\"focused\":true}" }, { "name": "Close action and state callback", "mode": "local-fixture", "method": "Reopen by pointer, activate the component Close control and inspect open-change callbacks.", "result": "pass", "observation": "Open state callbacks [true,false,true,false]; no persistence handler attached." } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "info", "basis": "observed", "title": "Dialog state stayed local in the fixture", "detail": "The synthetic open/close callback sequence was true, false, true, false and zero HTTP(S) request attempts were recorded. WebSocket attempts were blocked but not counted. That describes the authored fixture; production handlers can add network and persistence behavior." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included strict-transport-security. Requests attempted 2 additional host(s), including static.cloudflareinsights.com, www.googletagmanager.com. The guard blocked 2 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "info", "basis": "observed", "title": "Pinned fixture network boundary", "detail": "All six @radix-ui/react-dialog fixture checks completed with zero recorded HTTP(S) request attempts and zero page errors. WebSocket attempts were blocked but not counted. This applies to the small authored fixture; it is not a claim about every export, dependency or integration." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "The asChild composition option can lose behavior when a custom child drops props or refs, or uses an unsuitable element.", "Keep separately installed Radix packages aligned; shared dependency duplication can complicate upgrades and bundle size.", "A modal can constrain interaction while open; it cannot establish who may read or change a record." ], "limits": [ "Only Dialog was installed. No whole-library, nested overlay, router, hydration or mobile assistive-technology test was performed.", "The HTML-looking string stayed literal through React child rendering; dangerouslySetInnerHTML and HTML sanitizers were not tested." ], "sources": [ { "label": "Official documentation", "url": "https://www.radix-ui.com/primitives/docs/overview/introduction" }, { "label": "Official evaluated sample", "url": "https://www.radix-ui.com/primitives/docs/components/dialog" }, { "label": "Upstream repository", "url": "https://github.com/radix-ui/primitives" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/radix-ui/primitives", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/radix-ui/primitives/commit/eb3a2b7091293e27df8f9ba906632d8daa3d81a3", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@radix-ui/react-dialog/1.3.1", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Radix accessibility guidance", "url": "https://www.radix-ui.com/primitives/docs/overview/accessibility" }, { "label": "Composition and custom-child requirements", "url": "https://www.radix-ui.com/primitives/docs/guides/composition" } ] } }, { "id": "react-aria", "title": "React Aria", "url": "https://react-aria.adobe.com/", "category": "Components", "kind": "Unstyled React components and hooks", "summary": "Start complex controls with interaction and internationalization behavior already considered.", "whatItIs": "Adobe's React Aria supplies unstyled components and lower-level hooks for building interfaces. It includes patterns such as selection, calendars, overlays and form controls, with documented keyboard and internationalization support. The React Spectrum repository contains multiple libraries, so its repository popularity is broader than React Aria alone.", "whenUseful": "Consider it for data-heavy React products where selection, dates, locale differences and keyboard use are central. Budget time to learn its composition and styling conventions rather than treating it as a ready-made visual theme.", "example": "Proposed workflow: build a review queue with selectable document rows, an explicit bulk-action count and a date filter that follows the chosen locale. Test mixed selection, disabled records and keyboard navigation with synthetic documents before connecting the real service. Our executed check covered a standalone checkbox and its disabled setting, not the queue or calendar.", "expectedResult": "A review interface whose selection states and labels can be inspected independently of its appearance, with locale-specific cases in the test plan.", "cautions": [ "A hidden native input may be the keyboard target while the visible label is the pointer target. Preserve both when restyling.", "A disabled control is a user-interface state, not permission enforcement.", "Publisher accessibility claims and this checkbox sample do not certify every composite interface you build." ], "requirements": [ "A React application, react-aria-components or the relevant hooks, and your own styling. The registry snapshot identified react-aria-components 1.22.1; it was not locally installed for this review.", "Application labels, validation and testing across the locales and assistive technologies you support. The inspected package declares Apache-2.0." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): Adds a foundation for complex selection and internationalized controls, supported by an established multi-library repository with current activity. GitHub reported 15,965 stars for the multi-library React Spectrum repository (adobe/react-spectrum); the sampled default-branch commit is dated 2026-10-16. This is a dated popularity/activity snapshot, not a measured growth rate or safety ranking.", "Public official documentation and declared package requirements reviewed. The example above is a proposed workflow; executed checks are listed separately below.", "Earlier selector, focus-timing and setup probes remain in the retained evidence. Final conclusions use the corrected bounded tests and keep unmet coverage explicit." ], "sources": [ { "label": "Official documentation", "url": "https://react-aria.adobe.com/getting-started" }, { "label": "Official evaluated sample", "url": "https://react-aria.adobe.com/Checkbox" }, { "label": "Upstream repository", "url": "https://github.com/adobe/react-spectrum" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/adobe/react-spectrum", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/adobe/react-spectrum/commit/261344335e54265b2d02dc57a43b911a718de707", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/react-aria-components/1.22.1", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "React Aria overview", "url": "https://react-aria.adobe.com/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The official checkbox changed state with Space and with its visible label, then returned to its initial state. Enabling the demo's disabled setting prevented a synthetic Space event from changing selection. No package or application workflow was installed.", "reportUrl": "/design-evaluations/resource-react-aria.json", "identity": { "target": "https://react-aria.adobe.com/Checkbox", "version": "Unversioned public demo observed 2026-10-19; registry snapshot react-aria-components 1.22.1 was not locally executed.", "integrity": "Public document SHA-256 4c46cdb5b8e5f487d07d36c1b801340a9ce4343a5aa80bd39ab7236e5d88e003; initial response only, not complete application integrity. Source snapshot 261344335e54265b2d02dc57a43b911a718de707 does not identify the hosted deployment." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://react-aria.adobe.com/Checkbox. Reachability only." }, { "name": "Keyboard selection cycle", "mode": "browser", "method": "Focus the first documented checkbox/switch; press Space twice and inspect its checked state.", "result": "pass", "observation": "Checked false -> true -> false. No external form submitted." }, { "name": "Pointer selection cycle", "mode": "browser", "method": "Click the same sample control twice and inspect state restoration.", "result": "pass", "observation": "Pointer toggled state=true; original state restored=true." }, { "name": "Disabled sample boundary", "mode": "browser", "method": "Inspect a documented disabled control and try a synthetic Space key event without force-clicking or altering properties.", "result": "pass", "observation": "Disabled=true; checked unchanged=true. Programmatic events only; tab-order test not included." } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "caution", "basis": "observed", "title": "Visible label and input are separate targets", "detail": "The raw hidden-input pointer probe timed out; clicking the associated visible label worked and keyboard Space changed the native input state. Preserve the label relationship when changing layout instead of removing the input." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included content-security-policy, strict-transport-security. Requests attempted 1 additional host(s), including use.typekit.net. The guard blocked 0 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "caution", "basis": "advice", "title": "Check the installed dependency graph separately", "detail": "The registry snapshot identifies react-aria-components 1.22.1, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "A hidden native input may be the keyboard target while the visible label is the pointer target. Preserve both when restyling.", "A disabled control is a user-interface state, not permission enforcement.", "Publisher accessibility claims and this checkbox sample do not certify every composite interface you build." ], "limits": [ "Only the checkbox demo was exercised. Calendars, drag and drop, tables, localization and screen-reader behavior remain untested.", "The disabled check used programmatic key events after toggling a demo setting; it did not establish full tab-order behavior." ], "sources": [ { "label": "Official documentation", "url": "https://react-aria.adobe.com/getting-started" }, { "label": "Official evaluated sample", "url": "https://react-aria.adobe.com/Checkbox" }, { "label": "Upstream repository", "url": "https://github.com/adobe/react-spectrum" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/adobe/react-spectrum", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/adobe/react-spectrum/commit/261344335e54265b2d02dc57a43b911a718de707", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/react-aria-components/1.22.1", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "React Aria overview", "url": "https://react-aria.adobe.com/" } ] } }, { "id": "headless-ui", "title": "Headless UI", "url": "https://headlessui.com/", "category": "Components", "kind": "Unstyled React and Vue components", "summary": "Add familiar interaction patterns while keeping control of the visual design.", "whatItIs": "Headless UI provides unstyled components maintained by Tailwind Labs. The React and Vue documentation are distinct; this evaluation used the React Switch example. Components expose interaction state for styling, so Tailwind can be convenient without being a substitute for application logic.", "whenUseful": "It is a practical fit for a team already comfortable with utility-based styling that needs menus, dialogs or switches without adopting a complete visual system. Check the component set and framework version before standardizing on it.", "example": "Proposed workflow: build a notification-preferences panel with separately labelled switches for reminders and review updates. Keep local edits reversible until the user saves, show a failure message if persistence fails, and avoid presenting a successful toggle as proof that the server accepted it. The executed sample only toggled an in-memory Switch.", "expectedResult": "A consistent preferences panel with visible local state and a separate, testable persistence step.", "cautions": [ "The hosted React demo runs in an iframe; a successful parent documentation page does not by itself verify the component.", "The disabled selector inspected only the parent document and matched no control. Disabled behavior inside the Switch iframe remains untested.", "Repository popularity does not establish current growth. Its latest recorded commit in this snapshot was April 2026." ], "requirements": [ "Choose the React or Vue package and use the matching documentation. The @headlessui/react registry snapshot was 2.2.10, with React 18 or 19 peers.", "Your own styles, meaningful labels and application behavior. The inspected package is MIT licensed; no account is required to use the open-source components." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): Provides an established comparison point for unstyled React/Vue controls; included for adoption and fit, not claimed as a new trending release. GitHub reported 28,783 stars for the upstream repository (tailwindlabs/headlessui); the sampled default-branch commit is dated 2026-04-13. This is a dated popularity/activity snapshot, not a measured growth rate or safety ranking.", "Public official documentation and declared package requirements reviewed. The example above is a proposed workflow; executed checks are listed separately below.", "Earlier selector, focus-timing and setup probes remain in the retained evidence. Final conclusions use the corrected bounded tests and keep unmet coverage explicit." ], "sources": [ { "label": "Official evaluated sample", "url": "https://headlessui.com/react/switch" }, { "label": "Upstream repository", "url": "https://github.com/tailwindlabs/headlessui" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/tailwindlabs/headlessui", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/tailwindlabs/headlessui/commit/eea57cf46fd6767ed1059012f7073b88eb159fba", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@headlessui/react/2.2.10", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Official isolated React Switch demo", "url": "https://headlessui.com/examples/react-switch" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "Inside the official React example iframe, Space and pointer clicks toggled the Switch and restored its initial state. The disabled-control selector searched only the parent document and matched no control; iframe disabled behavior remains untested. This unmet check is a harness coverage gap, not a product defect finding.", "reportUrl": "/design-evaluations/resource-headless-ui.json", "identity": { "target": "https://headlessui.com/react/switch", "version": "Unversioned public demo observed 2026-10-19; registry snapshot @headlessui/react 2.2.10 was not locally executed.", "integrity": "Public document SHA-256 45a00f702037b4e21f107a3a7eca3eee0b93cea346ff6cbe91f26e385d764900; initial response only, not complete application integrity. Source snapshot eea57cf46fd6767ed1059012f7073b88eb159fba does not identify the hosted deployment." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://headlessui.com/react/switch. Reachability only." }, { "name": "Keyboard selection cycle", "mode": "browser", "method": "Focus the first documented checkbox/switch; press Space twice and inspect its checked state.", "result": "pass", "observation": "Checked false -> true -> false. No external form submitted." }, { "name": "Pointer selection cycle", "mode": "browser", "method": "Click the same sample control twice and inspect state restoration.", "result": "pass", "observation": "Pointer toggled state=true; original state restored=true." }, { "name": "Disabled sample coverage", "mode": "browser", "method": "Search the parent document for a disabled control; the selector did not enter the Switch example iframe.", "result": "fail", "observation": "The parent-document selector matched no disabled control. The working Switch was inside an iframe, which this disabled selector did not inspect. Iframe disabled behavior remains untested; this is a harness coverage gap, not an established product defect." } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "caution", "basis": "advice", "title": "A switch cannot confirm a saved preference", "detail": "Treat an optimistic UI change and a server-accepted preference as separate states. Add failure handling and server-side permission checks when connecting the component to an account." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included strict-transport-security. Requests attempted 2 additional host(s), including static.cloudflareinsights.com, rsms.me. The guard blocked 2 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "caution", "basis": "advice", "title": "Check the installed dependency graph separately", "detail": "The registry snapshot identifies @headlessui/react 2.2.10, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "The hosted React demo runs in an iframe; a successful parent documentation page does not by itself verify the component.", "The disabled selector inspected only the parent document and matched no control. Disabled behavior inside the Switch iframe remains untested.", "Repository popularity does not establish current growth. Its latest recorded commit in this snapshot was April 2026." ], "limits": [ "Only one React Switch was exercised; Vue, dialogs, menus, SSR and package integration were not tested.", "The parent-document disabled probe establishes a harness coverage gap only; it did not inspect disabled controls inside the example iframe. No account, preference save or backend permission was tested." ], "sources": [ { "label": "Official evaluated sample", "url": "https://headlessui.com/react/switch" }, { "label": "Upstream repository", "url": "https://github.com/tailwindlabs/headlessui" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/tailwindlabs/headlessui", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/tailwindlabs/headlessui/commit/eea57cf46fd6767ed1059012f7073b88eb159fba", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@headlessui/react/2.2.10", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Official isolated React Switch demo", "url": "https://headlessui.com/examples/react-switch" } ] } }, { "id": "mantine", "title": "Mantine", "url": "https://mantine.dev/", "category": "Components", "kind": "Styled React component library", "summary": "Build application screens from a coordinated component, hook and theme system.", "whatItIs": "Mantine combines styled React components with hooks, theming and optional packages for concerns such as forms and dates. It gives a team a larger starting surface than unstyled primitives. Core styles and a provider are part of the setup; optional packages need their own configuration.", "whenUseful": "Use it for internal tools, account screens and content-heavy applications where consistency and delivery speed matter more than inventing every control. It is less of a shortcut when the design requires changing most component structures.", "example": "Proposed workflow: create a knowledge-import review screen with an accordion for source details, warnings and transformation notes. Choose heading levels that fit the page, keep the blocking warning visible outside collapsed content, and add a separate approval action. The executed checks covered the fruit accordion demo, not imports or approval storage.", "expectedResult": "A coherent review screen with reusable spacing and field conventions, while critical information remains visible before approval.", "cautions": [ "Older tutorials may target different React and styling requirements. Match documentation to your installed major version.", "Accordion heading order is application-specific and is not imposed automatically by the library.", "Component visibility and disabled states do not authorize imports, approvals or other backend changes." ], "requirements": [ "The current @mantine/core 9.7.3 manifest requires React and React DOM ^19.2.0 plus @mantine/hooks 9.7.3. Keep core and hooks versions aligned.", "Import the required styles and add MantineProvider; evaluate extra packages separately. The inspected core package is MIT licensed." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): Adds a mature, styled application toolkit with recent releases, balancing the expansion's unstyled foundations. GitHub reported 31,837 stars for the upstream repository (mantinedev/mantine); the sampled default-branch commit is dated 2026-10-18. This is a dated popularity/activity snapshot, not a measured growth rate or safety ranking.", "Public official documentation and declared package requirements reviewed. The example above is a proposed workflow; executed checks are listed separately below.", "Earlier selector, focus-timing and setup probes remain in the retained evidence. Final conclusions use the corrected bounded tests and keep unmet coverage explicit." ], "sources": [ { "label": "Official documentation", "url": "https://mantine.dev/getting-started/" }, { "label": "Official evaluated sample", "url": "https://mantine.dev/core/accordion/" }, { "label": "Upstream repository", "url": "https://github.com/mantinedev/mantine" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/mantinedev/mantine", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/mantinedev/mantine/commit/e47e45af06427b3b2497100c2b849935c23af30d", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@mantine/core/9.7.3", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The official accordion toggled with Enter, moved to the next trigger with ArrowDown and exposed a visible panel with matching controls/label references. No Mantine package was installed and no form or import was submitted.", "reportUrl": "/design-evaluations/resource-mantine.json", "identity": { "target": "https://mantine.dev/core/accordion/", "version": "Unversioned public demo observed 2026-10-19; registry snapshot @mantine/core 9.7.3 was not locally executed.", "integrity": "Public document SHA-256 9e5240c5d89a7ec06d11770b7ea012c1cf50cca3c1e3350d2ee8f9b5811090f3; initial response only, not complete application integrity. Source snapshot e47e45af06427b3b2497100c2b849935c23af30d does not identify the hosted deployment." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://mantine.dev/core/accordion/. Reachability only." }, { "name": "Accordion keyboard expansion", "mode": "browser", "method": "Focus the first documented accordion trigger; press Enter twice and inspect aria-expanded.", "result": "pass", "observation": "Expanded true -> false -> true." }, { "name": "Accordion arrow-key navigation", "mode": "browser", "method": "Focus the first trigger, press ArrowDown and inspect whether focus moves to the next trigger.", "result": "pass", "observation": "Focus moved to second trigger=true. Only this adjacent navigation step was exercised." }, { "name": "Accordion panel association", "mode": "browser", "method": "Open the first trigger and verify its aria-controls target is visible with matching label reference.", "result": "pass", "observation": "{\"expanded\":\"true\",\"panelExists\":true,\"panelVisible\":true,\"labelMatches\":true}" } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "caution", "basis": "documented", "title": "Heading structure remains an application decision", "detail": "Mantine's Accordion documentation asks authors to set a suitable order for the page hierarchy. Its component API does not select the right heading level for your screen." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included none of the selected security response headers. Requests attempted 4 additional host(s), including fonts.googleapis.com, img.icons8.com, fonts.gstatic.com, www.googletagmanager.com. The guard blocked 1 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "caution", "basis": "advice", "title": "Check the installed dependency graph separately", "detail": "The registry snapshot identifies @mantine/core 9.7.3, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "Older tutorials may target different React and styling requirements. Match documentation to your installed major version.", "Accordion heading order is application-specific and is not imposed automatically by the library.", "Component visibility and disabled states do not authorize imports, approvals or other backend changes." ], "limits": [ "Only the documented accordion sample was tested; forms, dates, uploads, SSR, responsive layouts and optional packages were not exercised.", "Heading structure and associated labels were inspected for this sample only; no complete accessibility audit was performed." ], "sources": [ { "label": "Official documentation", "url": "https://mantine.dev/getting-started/" }, { "label": "Official evaluated sample", "url": "https://mantine.dev/core/accordion/" }, { "label": "Upstream repository", "url": "https://github.com/mantinedev/mantine" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/mantinedev/mantine", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/mantinedev/mantine/commit/e47e45af06427b3b2497100c2b849935c23af30d", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@mantine/core/9.7.3", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." } ] } }, { "id": "daisyui", "title": "daisyUI", "url": "https://daisyui.com/", "category": "Components", "kind": "Tailwind CSS component plugin", "summary": "Use named CSS components and themes across different application frameworks.", "whatItIs": "daisyUI adds component classes and theme tokens to Tailwind CSS. A button or disclosure can keep familiar HTML while acquiring a consistent appearance. It does not provide an application backend, and many interactions come from native HTML or code the developer supplies.", "whenUseful": "Choose it when a project wants a themed interface with less repeated utility markup, especially across server-rendered or mixed-framework pages. It works best when the team is deliberate about the HTML semantics underneath the classes.", "example": "Proposed workflow: style a support-request triage page with priority buttons, a native details disclosure for source context and explicit light/dark themes. Keep actual submission handling separate, and inspect every modal's name and focus behavior. Our local fixture tested CSS, theme switching and native controls; it did not send a support request.", "expectedResult": "A themed set of reusable classes on readable HTML, with an explicit list of interactions that still need application code.", "cautions": [ "Class names can style an element but cannot turn an unsuitable element into a complete accessible control.", "The first public modal sample had no aria-labelledby reference. Add and verify an accessible name in your own modal composition.", "The shipped stylesheet is not proof that every theme has suitable contrast for your content, states or custom colors." ], "requirements": [ "For the documented plugin setup, use a compatible Tailwind build and daisyUI version. The fixture used daisyUI 5.7.50's shipped CSS directly, without executing its plugin or build script.", "Semantic HTML and any necessary interaction code. The inspected package is MIT licensed and had no runtime dependencies in its manifest." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): Adds a popular CSS-first option that can be compared with the React-specific libraries; recent releases show maintenance, not measured growth. GitHub reported 42,625 stars for the upstream repository (saadeghi/daisyui); the sampled default-branch commit is dated 2026-10-13. This is a dated popularity/activity snapshot, not a measured growth rate or safety ranking.", "Public official documentation and declared package requirements reviewed. The example above is a proposed workflow; executed checks are listed separately below.", "Earlier selector, focus-timing and setup probes remain in the retained evidence. Final conclusions use the corrected bounded tests and keep unmet coverage explicit." ], "sources": [ { "label": "Official documentation", "url": "https://daisyui.com/docs/install/" }, { "label": "Official evaluated sample", "url": "https://daisyui.com/components/modal/" }, { "label": "Upstream repository", "url": "https://github.com/saadeghi/daisyui" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/saadeghi/daisyui", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/saadeghi/daisyui/commit/bf3bac3a397b543e55641ecb2d60a2ed961f09ec", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/daisyui/5.7.50", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "local-fixture" ], "summary": "The public native-dialog sample opened and closed with keyboard focus returning to its trigger. Six local checks passed for compiled styles, theme tokens, native disclosure and checkbox behavior, focus outline and a disabled button. The Tailwind plugin itself was not executed.", "reportUrl": "/design-evaluations/resource-daisyui.json", "identity": { "target": "https://daisyui.com/components/modal/ plus a local daisyui fixture", "version": "Local daisyUI 5.7.50 prebuilt CSS with authored native HTML; no Tailwind plugin execution. Public demo is separately unversioned.", "integrity": "Package archive SHA-256 e8e51df2ac7b077a512242bca51433a95c9b35f6d5b76faec98ce964aba8424c (npm SHA-512 integrity matched). Public document SHA-256 95ca0685443ea57f04ea9083b804861ff5341c66fb520e74fcfb9833a81604ed; response-body scope only." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked.", "Exact direct dependencies; 38-package lock installed with --ignore-scripts, empty user/global npm configs, isolated cache and allowlisted environment. No lifecycle install scripts ran.", "Local browser responses served only the authored fixture, pinned bundle or stylesheet. External HTTP(S) requests were denied, with zero recorded attempts in the final fixture. WebSocket attempts were blocked but not counted.", "Existing Rolldown 1.2.14 bundled inspected prebuilt exports without running upstream build scripts." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://daisyui.com/components/modal/. Reachability only." }, { "name": "Keyboard open and dialog semantics", "mode": "browser", "method": "Focus the first documented dialog trigger; press Enter; inspect visible dialog and accessible-name reference.", "result": "pass", "observation": "A visible dialog opened; aria-labelledby target present=False. Presence of a reference is not a screen-reader test." }, { "name": "Bounded dialog focus containment", "mode": "browser", "method": "Press Tab six times while the sample remains open and inspect focus containment after each press, allowing browser chrome or focus guards.", "result": "pass", "observation": "Six Tab steps alternated between the dialog Close button and browser chrome. No background-page control received focus in these steps; native modal behavior, not library JavaScript." }, { "name": "Escape and focus restoration", "mode": "browser", "method": "Press Escape, wait for exit animation and inspect closed state plus focus on original trigger.", "result": "pass", "observation": "Closed=true; trigger focus restored=true. No save action or form submission." }, { "name": "Compiled component styles", "mode": "local-fixture", "method": "Inspect button geometry and colors with the pinned prebuilt stylesheet.", "result": "pass", "observation": "{\"display\":\"inline-flex\",\"height\":40,\"background\":\"oklch(0.45 0.24 277.023)\",\"radius\":\"4px\"}" }, { "name": "Theme token switch", "mode": "local-fixture", "method": "Switch the synthetic root from light to dark and compare resolved base colors.", "result": "pass", "observation": "{\"light\":\"oklch(100% 0 0)\",\"dark\":\"oklch(25.33% .016 252.42)\"}" }, { "name": "Native disclosure with CSS", "mode": "local-fixture", "method": "Use Enter twice on an authored details/summary element styled with collapse classes.", "result": "pass", "observation": "Open after Enter=true; closed after second Enter=true. Behavior comes from native HTML; daisyUI supplies styling." }, { "name": "Native checkbox with CSS", "mode": "local-fixture", "method": "Use Space twice on the authored styled checkbox.", "result": "pass", "observation": "Native checkbox toggled and restored=true. No library JavaScript used." }, { "name": "Keyboard focus visibility", "mode": "local-fixture", "method": "Focus the styled action after keyboard input and inspect outline.", "result": "pass", "observation": "{\"matches\":true,\"outline\":\"solid\",\"width\":\"2px\"}" }, { "name": "Disabled control boundary", "mode": "local-fixture", "method": "Inspect disabled property and verify a click is not emitted by programmatic click on a native disabled button.", "result": "pass", "observation": "{\"disabled\":true,\"clicks\":0} Native HTML behavior, not a backend permission boundary." } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "caution", "basis": "observed", "title": "Modal naming needs review when copying a sample", "detail": "The first documented dialog opened with visible heading text but no aria-labelledby reference in the sampled DOM. The native dialog handled Escape; verify a usable accessible name rather than assuming the visual heading supplies one." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included none of the selected security response headers. Requests attempted 7 additional host(s), including fonts.googleapis.com, fonts.gstatic.com, api.daisyui.com, cdn.carbonads.com. The guard blocked 1 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "info", "basis": "observed", "title": "Pinned fixture network boundary", "detail": "All six daisyui fixture checks completed with zero recorded HTTP(S) request attempts and zero page errors. WebSocket attempts were blocked but not counted. This applies to the small authored fixture; it is not a claim about every export, dependency or integration." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "Class names can style an element but cannot turn an unsuitable element into a complete accessible control.", "The first public modal sample had no aria-labelledby reference. Add and verify an accessible name in your own modal composition.", "The shipped stylesheet is not proof that every theme has suitable contrast for your content, states or custom colors." ], "limits": [ "Only the pinned prebuilt stylesheet and small native HTML fixtures were exercised; plugin compilation, tree-shaking and application integration were not tested.", "Native checkbox, details and disabled-button behavior belongs to the browser, not daisyUI JavaScript. Theme contrast and full reduced-motion behavior were not audited." ], "sources": [ { "label": "Official documentation", "url": "https://daisyui.com/docs/install/" }, { "label": "Official evaluated sample", "url": "https://daisyui.com/components/modal/" }, { "label": "Upstream repository", "url": "https://github.com/saadeghi/daisyui" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/saadeghi/daisyui", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/saadeghi/daisyui/commit/bf3bac3a397b543e55641ecb2d60a2ed961f09ec", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/daisyui/5.7.50", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." } ] } }, { "id": "heroui", "title": "HeroUI", "url": "https://heroui.com/", "category": "Components", "kind": "Styled React component library", "summary": "Start with coordinated React styling while retaining a structured component API.", "whatItIs": "HeroUI supplies styled React components and a theming system. Its current v3 documentation describes a different setup from v2, including React Aria-based interaction patterns and Tailwind 4 integration. This review covers the open-source web components, not paid Pro templates or its separate native offering.", "whenUseful": "It is useful when a React product wants a polished common visual language without building every styled wrapper. The important decision is whether its current dependency and theme conventions fit the application you already have.", "example": "Proposed workflow: create a document-review preference form with labelled checkboxes, explanatory text and a disabled option that names its prerequisite. Show a separate confirmation after preferences actually save. Test keyboard and pointer paths before adding the service request. Our evaluation used the public checkbox examples and did not persist settings.", "expectedResult": "A consistent preference form with visible selection and disabled states, plus an explicit server-save and error-handling boundary.", "cautions": [ "Major-version migration can affect component names, imports, styling and peer dependencies.", "Preserve the hidden input and visible label relationship when customizing checkbox appearance.", "A disabled option does not protect a restricted operation; the server still needs to reject unauthorized requests." ], "requirements": [ "The @heroui/react 3.2.6 manifest requires React/React DOM 19 or later, Tailwind CSS 4 or later and its listed React Aria peers; verify the full peer set against your lockfile.", "Follow v3 installation and styling guidance rather than v2 snippets. The inspected package is MIT licensed; paid templates have separate terms and were not accessed." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): Adds a widely followed styled React option with current v3 maintenance and a meaningful migration decision for existing users. GitHub reported 30,961 stars for the upstream repository (heroui-inc/heroui); the sampled default-branch commit is dated 2026-10-17. This is a dated popularity/activity snapshot, not a measured growth rate or safety ranking.", "Public official documentation and declared package requirements reviewed. The example above is a proposed workflow; executed checks are listed separately below.", "Earlier selector, focus-timing and setup probes remain in the retained evidence. Final conclusions use the corrected bounded tests and keep unmet coverage explicit." ], "sources": [ { "label": "Official documentation", "url": "https://heroui.com/en/docs/react/getting-started" }, { "label": "Official evaluated sample", "url": "https://heroui.com/en/docs/react/components/checkbox" }, { "label": "Upstream repository", "url": "https://github.com/heroui-inc/heroui" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/heroui-inc/heroui", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/heroui-inc/heroui/commit/ce90ea3ab49d58f6c428f71bfd6fe8ae2a87b960", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@heroui/react/3.2.6", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "HeroUI v2 to v3 migration", "url": "https://heroui.com/en/docs/react/migration" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "The public checkbox changed and restored selection through Space and its visible label. A disabled example ignored synthetic Space events. No HeroUI package was installed; v2 migration, form submission and Pro assets were not tested.", "reportUrl": "/design-evaluations/resource-heroui.json", "identity": { "target": "https://heroui.com/en/docs/react/components/checkbox", "version": "Unversioned public demo observed 2026-10-19; registry snapshot @heroui/react 3.2.6 was not locally executed.", "integrity": "Public document SHA-256 83e3951fce9223fb52fd8853acf1c5ac1973bd46f25719817911a49de907a09c; initial response only, not complete application integrity. Source snapshot ce90ea3ab49d58f6c428f71bfd6fe8ae2a87b960 does not identify the hosted deployment." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://heroui.com/en/docs/react/components/checkbox. Reachability only." }, { "name": "Keyboard selection cycle", "mode": "browser", "method": "Focus the first documented checkbox/switch; press Space twice and inspect its checked state.", "result": "pass", "observation": "Checked false -> true -> false. No external form submitted." }, { "name": "Pointer selection cycle", "mode": "browser", "method": "Click the same sample control twice and inspect state restoration.", "result": "pass", "observation": "Pointer toggled state=true; original state restored=true." }, { "name": "Disabled sample boundary", "mode": "browser", "method": "Inspect a documented disabled control and try a synthetic Space key event without force-clicking or altering properties.", "result": "pass", "observation": "Disabled=true; checked unchanged=true. Programmatic events only; tab-order test not included." } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "caution", "basis": "documented", "title": "Version alignment is a real integration requirement", "detail": "The captured v3 package manifest lists React 19, Tailwind 4 and multiple React Aria peers. A successful hosted demo does not show that an older application's dependency graph can accept those requirements." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included strict-transport-security. Requests attempted 3 additional host(s), including agent.heroui.pro, api.heroui.pro, api.github.com. The guard blocked 0 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "caution", "basis": "advice", "title": "Check the installed dependency graph separately", "detail": "The registry snapshot identifies @heroui/react 3.2.6, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "Major-version migration can affect component names, imports, styling and peer dependencies.", "Preserve the hidden input and visible label relationship when customizing checkbox appearance.", "A disabled option does not protect a restricted operation; the server still needs to reject unauthorized requests." ], "limits": [ "Only public v3 checkbox samples were exercised. The disabled check did not establish full tab order or screen-reader announcements.", "No local bundle, v2 migration, native platform, paid asset, server rendering or application workflow was evaluated." ], "sources": [ { "label": "Official documentation", "url": "https://heroui.com/en/docs/react/getting-started" }, { "label": "Official evaluated sample", "url": "https://heroui.com/en/docs/react/components/checkbox" }, { "label": "Upstream repository", "url": "https://github.com/heroui-inc/heroui" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/heroui-inc/heroui", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/heroui-inc/heroui/commit/ce90ea3ab49d58f6c428f71bfd6fe8ae2a87b960", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@heroui/react/3.2.6", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "HeroUI v2 to v3 migration", "url": "https://heroui.com/en/docs/react/migration" } ] } }, { "id": "ark-ui", "title": "Ark UI", "url": "https://ark-ui.com/", "category": "Components", "kind": "Unstyled components across frameworks", "summary": "Use shared interaction patterns when several front-end frameworks need a consistent foundation.", "whatItIs": "Ark UI offers unstyled components for React, Vue, Solid and Svelte, built around Zag.js state-machine behavior. Teams supply appearance and compose the parts they need. A common behavior foundation can reduce duplication, but framework adapters still have different integration details.", "whenUseful": "Consider it for a design-system team supporting more than one framework, or for an application needing composed controls without a prescribed theme. Start with a small pattern and check the adapter you actually intend to ship.", "example": "Proposed workflow: define an expandable policy-reference pattern for both a React editor and a Vue viewer. Agree on heading structure, whether multiple panels may stay open and the keyboard sequence, then implement each adapter with shared tokens. The executed evaluation covered only the React documentation accordion; cross-framework parity remains a proposed test.", "expectedResult": "A documented interaction contract and matching visual tokens, with adapter-specific regression cases before rollout.", "cautions": [ "A multi-framework offering does not prove every adapter behaves identically in your app.", "Single-open and collapsible accordion settings change what Enter does. Match the configuration to the intended task.", "State-machine transitions organize UI behavior; they do not provide backend authorization or sanitize untrusted content." ], "requirements": [ "Install the adapter for your chosen framework. The captured @ark-ui/react 5.39.3 manifest requires React and React DOM 18 or later and pins its Zag.js dependencies to 1.45.0.", "Your own styles, labels and framework integration tests. The inspected React package is MIT licensed; paid Plus resources were not accessed." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): Adds a smaller but active cross-framework foundation with a distinct state-machine approach, rather than another styled React-only kit. GitHub reported 5,425 stars for the upstream repository (chakra-ui/ark); the sampled default-branch commit is dated 2026-10-16. This is a dated popularity/activity snapshot, not a measured growth rate or safety ranking.", "Public official documentation and declared package requirements reviewed. The example above is a proposed workflow; executed checks are listed separately below.", "Earlier selector, focus-timing and setup probes remain in the retained evidence. Final conclusions use the corrected bounded tests and keep unmet coverage explicit." ], "sources": [ { "label": "Official documentation", "url": "https://ark-ui.com/docs/overview/getting-started" }, { "label": "Official evaluated sample", "url": "https://ark-ui.com/docs/components/accordion" }, { "label": "Upstream repository", "url": "https://github.com/chakra-ui/ark" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/chakra-ui/ark", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/chakra-ui/ark/commit/300f6f39e9ec97a5924b5f816ac73aa484dd196d", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@ark-ui/react/5.39.3", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Framework and state-machine overview", "url": "https://ark-ui.com/docs/overview/about" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser" ], "summary": "In the official React accordion, Enter switched the open panel and restored it, ArrowDown moved focus, and the visible panel's label/control references matched. The first single-panel collapse probe was corrected after inspecting the sample's single-open behavior.", "reportUrl": "/design-evaluations/resource-ark-ui.json", "identity": { "target": "https://ark-ui.com/docs/components/accordion", "version": "Unversioned public demo observed 2026-10-19; registry snapshot @ark-ui/react 5.39.3 was not locally executed.", "integrity": "Public document SHA-256 94585a0dbf699c72341b2cff348a0b4814c4fe99d88e22d3b2a9377473a909fd; initial response only, not complete application integrity. Source snapshot 300f6f39e9ec97a5924b5f816ac73aa484dd196d does not identify the hosted deployment." }, "environment": [ "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.", "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.", "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked." ], "tests": [ { "name": "Public sample response", "mode": "http", "method": "Anonymous public GET; capture status, response-body hash and selected headers.", "result": "pass", "observation": "HTTP 200; https://ark-ui.com/docs/components/accordion. Reachability only." }, { "name": "Accordion keyboard expansion", "mode": "browser", "method": "Use Enter to change the documented accordion state and restore it; single-open samples switch between two panels.", "result": "pass", "observation": "Exclusive selection states [\"false\",\"true\"] then [\"true\",\"false\"]; this sample does not collapse the only open panel." }, { "name": "Accordion arrow-key navigation", "mode": "browser", "method": "Focus the first trigger, press ArrowDown and inspect whether focus moves to the next trigger.", "result": "pass", "observation": "Focus moved to second trigger=true. Only this adjacent navigation step was exercised." }, { "name": "Accordion panel association", "mode": "browser", "method": "Open the first trigger and verify its aria-controls target is visible with matching label reference.", "result": "pass", "observation": "{\"expanded\":\"true\",\"panelExists\":true,\"panelVisible\":true,\"labelMatches\":true}" } ], "security": { "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.", "findings": [ { "level": "caution", "basis": "observed", "title": "Accordion configuration changes the contract", "detail": "The first accordion kept its only open panel expanded when Enter was pressed again. Selecting another item changed the open panel as expected. Choose and test single-open, multiple-open and collapsible behavior explicitly." }, { "level": "info", "basis": "observed", "title": "Sampled response and request surface", "detail": "The anonymous HTTPS demo response included strict-transport-security. Requests attempted 1 additional host(s), including plausible.io. The guard blocked 1 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance." }, { "level": "caution", "basis": "advice", "title": "Check the installed dependency graph separately", "detail": "The registry snapshot identifies @ark-ui/react 5.39.3, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit." } ], "limits": [ "No authentication, authorization, tenant isolation, retention or backend processing was tested.", "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.", "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation." ] }, "practicalCaveats": [ "A multi-framework offering does not prove every adapter behaves identically in your app.", "Single-open and collapsible accordion settings change what Enter does. Match the configuration to the intended task.", "State-machine transitions organize UI behavior; they do not provide backend authorization or sanitize untrusted content." ], "limits": [ "Only the public React accordion was exercised. No local adapter was installed and no Vue, Solid or Svelte parity claim was tested.", "Collections, file uploads, floating panels, SSR, performance and assistive technologies were outside the sample scope." ], "sources": [ { "label": "Official documentation", "url": "https://ark-ui.com/docs/overview/getting-started" }, { "label": "Official evaluated sample", "url": "https://ark-ui.com/docs/components/accordion" }, { "label": "Upstream repository", "url": "https://github.com/chakra-ui/ark" }, { "label": "GitHub repository snapshot endpoint", "url": "https://api.github.com/repos/chakra-ui/ark", "scope": "Star count and repository identity observed 2026-10-19." }, { "label": "Sampled source revision", "url": "https://github.com/chakra-ui/ark/commit/300f6f39e9ec97a5924b5f816ac73aa484dd196d", "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit." }, { "label": "Package manifest snapshot", "url": "https://registry.npmjs.org/@ark-ui/react/5.39.3", "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so." }, { "label": "Framework and state-machine overview", "url": "https://ark-ui.com/docs/overview/about" } ] } }, { "id": "motion", "title": "Motion", "url": "https://motion.dev/", "category": "Motion & effects", "kind": "JavaScript and framework animation library", "summary": "Describe state changes with animation code, then keep the movement subordinate to the task.", "whatItIs": "Motion supplies animation controls for DOM elements, SVG, values and JavaScript objects, with integrations for component frameworks. Its JavaScript API can express a short transition, a spring or a sequence without writing the animation loop yourself. That becomes useful when a panel moves, an item changes position or a state change needs a clear visual connection. The open-source library and the commercial Motion+ examples and tooling are separate offerings; this review exercises the library’s bundled JavaScript API.", "whenUseful": "Use it when a product needs coordinated motion tied to interface state and you want explicit pause, cancellation and cleanup controls. For a simple hover color, ordinary CSS may already be sufficient. Start from the state change the person needs to understand, then choose the effect.", "example": "Proposed workflow: an evaluation queue moves a reviewed item into a completed group. Keep the status text visible immediately, animate only the position and opacity, and cancel the previous transition if the filter changes. Provide a reduced-motion branch that updates the layout directly. This queue workflow was not built in our fixture.", "expectedResult": "A transition specification that explains where an item went while preserving an immediate, readable status and a static alternative.", "cautions": [ "The tested JavaScript animate call continued under reduced motion; the preference is not an automatic guarantee for every API.", "The bundled browser entry was tested. React/Vue lifecycle behavior, layout animation, gestures and Motion+ services were not.", "Core source is MIT. The package manifest also names framer-motion and tslib dependencies; this fixture did not install or audit a full dependency tree." ], "requirements": [ "A JavaScript-capable page or supported framework integration, with the package version pinned.", "A defined animation lifecycle: start, interruption, cancellation and teardown.", "A consumer policy for reduced motion, essential information and focus; Motion+ features have separate access terms." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): a widely adopted programmable-motion foundation with both framework and direct JavaScript routes. GitHub motiondivision/motion showed 34,355 stars; the inspected default-branch commit was dated 2026-10-19. This is one adoption/activity snapshot, not evidence of trend growth or safety.", "The proposed workflow above is an application idea. Executed checks and untested boundaries are stated separately in the evaluation." ], "sources": [ { "label": "JavaScript quick start", "url": "https://motion.dev/docs/quick-start" }, { "label": "Animation controls", "url": "https://motion.dev/docs/animate" }, { "label": "Primary repository", "url": "https://github.com/motiondivision/motion" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "local-fixture", "source-review" ], "summary": "Motion 14.4.0 interpolated 0→50→100 and restored opacity after cancellation. The raw animation still ran under reduced motion. An immediate pause comparison drifted; after two animation frames, the value remained stable for the next 100 ms.", "reportUrl": "/design-evaluations/resource-motion.json", "identity": { "target": "motion", "version": "14.4.0", "integrity": "sha512-JJTIdeNjtF2zi/py0ndRKxQF+8z2pcDUgJYXul7zqbhMvyTLRsPFR9ifE/j4cFCpCMlehQVJkTwd7BZFiPKgQg==" }, "environment": [ "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.", "Synthetic inputs only; no uploads, purchases, accounts or private data.", "Pinned extracted assets/modules; browser HTTP(S) and WebSocket requests denied. No install/lifecycle scripts; no process-wide Node egress guarantee." ], "tests": [ { "name": "Numeric animation seek", "mode": "local-fixture", "method": "Seek a paused linear object animation at 0/0.5/1 seconds", "result": "pass", "observation": "[0,50,100]" }, { "name": "DOM interpolation and cancel", "mode": "local-fixture", "method": "Seek opacity to half time then cancel", "result": "pass", "observation": "{\"values\":[0,50,100],\"opacity\":0.625,\"restored\":0.25}" }, { "name": "Initial immediate pause comparison", "mode": "local-fixture", "method": "Request reduced motion; observe unguarded JS animation and pause", "result": "fail", "observation": "{\"reduced\":true,\"running\":true,\"paused\":false}" }, { "name": "Reduced-motion boundary and pause", "mode": "local-fixture", "method": "Request reduced motion; pause then compare values after two animation frames and a further 100 ms", "result": "pass", "observation": "{\"reduced\":true,\"running\":true,\"immediate\":14.299999999999999,\"settled\":15.1,\"final\":15.1,\"paused\":true}" }, { "name": "Framework integration", "mode": "local-fixture", "method": "Mount/unmount animated components in a real framework application", "result": "not-run", "observation": "No framework dependency tree or application was installed; lifecycle behavior remains untested." } ], "security": { "scope": "Manifest/license and selected entry/source inspection, plus the named synthetic local fixture. No active exploitation or full security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Motion policy belongs to the application", "detail": "The reduced-motion fixture still advanced the unguarded animation. Add an explicit preference branch and leave essential state changes readable without waiting for animation." }, { "level": "caution", "basis": "observed", "title": "Pause measurement needs a settled rendered value", "detail": "The initial immediate-after-pause comparison failed. The follow-up recorded 14.3 immediately, 15.1 after two frames and 15.1 another 100 ms later. That supports settled pause behavior; it does not establish that every pending update stops synchronously." }, { "level": "info", "basis": "observed", "title": "Pinned sample and network boundary", "detail": "The fetched archive matched its registry SHA-512. The selected fixture made zero outbound attempts under an HTTP/WebSocket deny rule. No package lifecycle scripts executed; this does not audit all package code or dependencies." } ], "limits": [ "No React/Vue mount cycle, scroll-linked effects, touch gestures, frame-rate profiling, Motion+ access or real application state.", "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification." ] }, "practicalCaveats": [ "Choose interruption and teardown behavior before adding springs or scroll-linked effects.", "Test reduced motion with the exact API and framework adapter you ship; the JavaScript fixture does not certify another integration." ], "limits": [ "Only the pinned global browser bundle, numeric interpolation, opacity cancellation and a short pause/motion-preference probe.", "No React/Vue mount cycle, scroll-linked effects, touch gestures, frame-rate profiling, Motion+ access or real application state." ], "sources": [ { "label": "JavaScript quick start", "url": "https://motion.dev/docs/quick-start" }, { "label": "Animation controls", "url": "https://motion.dev/docs/animate" }, { "label": "Dated repository snapshot source", "url": "https://github.com/motiondivision/motion" }, { "label": "Exact evaluated package archive", "url": "https://registry.npmjs.org/motion/-/motion-14.4.0.tgz" } ] } }, { "id": "gsap", "title": "GSAP", "url": "https://gsap.com/", "category": "Motion & effects", "kind": "Animation engine and timeline toolkit", "summary": "Coordinate several animated properties on one timeline, with explicit control over timing and cleanup.", "whatItIs": "GSAP is a JavaScript animation engine built around tweens and timelines. A tween changes values over time; a timeline coordinates several tweens so an entrance, emphasis and exit can be adjusted as one sequence. It can work with ordinary JavaScript objects as well as DOM properties, which makes it useful beyond a particular UI framework. Its plugins cover additional tasks, but a successful core animation says nothing about every plugin or scroll interaction.", "whenUseful": "Use it for sequences whose timing matters across several elements, or for an existing site that needs animation without changing its component framework. It is especially useful when the effect needs to be paused, scrubbed, interrupted or reverted. Keep navigation and task completion independent of the sequence.", "example": "Proposed workflow: a product walkthrough highlights three controls in order. Put the highlights on a paused timeline, advance only after the person selects Next, and revert all temporary styles when the walkthrough closes. When reduced motion is requested, show the current highlight without a moving transition. This walkthrough is a proposed application, not the tested fixture.", "expectedResult": "A maintainable sequence with one timing model, deliberate interruption behavior and a cleanup path that restores the underlying interface.", "cautions": [ "The current no-charge license permits commercial website/interface use but restricts certain competing visual animation builders; no-charge does not mean unrestricted open-source licensing.", "A raw tween ran under reduced motion in the fixture. The authored matchMedia no-preference branch prevented its own animation branch from starting.", "Core tests do not establish ScrollTrigger, SplitText, SVG morphing or third-party plugin correctness." ], "requirements": [ "A JavaScript-capable page and a pinned core/plugin combination.", "Explicit ownership of timeline creation, cancellation and cleanup, including navigation away from the view.", "Review the current GSAP Standard License for the intended product; it is a custom license, not MIT." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): an established timeline engine with a broad adoption signal and a distinct custom-license boundary worth making visible. GitHub greensock/GSAP showed 29,475 stars; the inspected default-branch commit was dated 2026-04-13. This is one adoption/activity snapshot, not evidence of trend growth or safety.", "The proposed workflow above is an application idea. Executed checks and untested boundaries are stated separately in the evaluation." ], "sources": [ { "label": "GSAP documentation", "url": "https://gsap.com/docs/v3/" }, { "label": "Current Standard License", "url": "https://gsap.com/community/standard-license/" }, { "label": "Primary repository", "url": "https://github.com/greensock/GSAP" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "local-fixture", "source-review" ], "summary": "GSAP 3.15.0 passed four local checks: numeric seeking, sequential timeline positions, context style restoration and a consumer reduced-motion branch. Browser HTTP(S) and WebSocket requests were blocked; no plugins were exercised.", "reportUrl": "/design-evaluations/resource-gsap.json", "identity": { "target": "gsap", "version": "3.15.0", "integrity": "sha512-dMW4CWBTUK1AEEDeZc1g4xpPGIrSf9fJF960qbTZmN/QwZIWY5wgliS6JWl9/25fpTGJrMRtSjGtOmPnfjZB+A==" }, "environment": [ "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.", "Synthetic inputs only; no uploads, purchases, accounts or private data.", "Pinned extracted assets/modules; browser HTTP(S) and WebSocket requests denied. No install/lifecycle scripts; no process-wide Node egress guarantee." ], "tests": [ { "name": "Numeric interpolation", "mode": "local-fixture", "method": "Seek paused object tween at 0/0.5/1 seconds", "result": "pass", "observation": "[0,50,100]" }, { "name": "Timeline sequencing", "mode": "local-fixture", "method": "Seek two sequential one-second tweens to 1.5 seconds", "result": "pass", "observation": "{\"first\":100,\"second\":100}" }, { "name": "Context cleanup", "mode": "local-fixture", "method": "Seek transform/opacity then revert GSAP context", "result": "pass", "observation": "{\"values\":[0,50,100],\"timeline\":{\"first\":100,\"second\":100},\"middle\":{\"x\":50,\"opacity\":0.625},\"restored\":{\"opacity\":\"0.25\",\"transform\":\"\"}}" }, { "name": "Consumer motion policy", "mode": "local-fixture", "method": "Compare raw tween with no-preference matchMedia branch", "result": "pass", "observation": "{\"reduced\":true,\"rawRuns\":true,\"guardedBranch\":false}" }, { "name": "Plugin behavior", "mode": "local-fixture", "method": "Exercise scroll, text or SVG plugins", "result": "not-run", "observation": "Only core GSAP was loaded; plugin behavior and integration remain untested." } ], "security": { "scope": "Manifest/license and selected entry/source inspection, plus the named synthetic local fixture. No active exploitation or full security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Cleanup restored authored styles", "detail": "The local context changed transform and opacity, then revert restored opacity 0.25 and removed its transform. Test the same ownership boundary when multiple systems can write styles." }, { "level": "caution", "basis": "observed", "title": "Reduced motion is not a universal core default", "detail": "The raw tween advanced after reduced motion was requested. A separately authored no-preference matchMedia branch did not run; that is consumer policy, not blanket automatic suppression." }, { "level": "caution", "basis": "documented", "title": "Custom licensing affects tool builders", "detail": "The linked Standard License restricts specified competing visual animation-building uses. Check those terms before embedding GSAP inside an editor or builder." }, { "level": "info", "basis": "observed", "title": "Pinned sample and network boundary", "detail": "The fetched archive matched its registry SHA-512. The selected fixture made zero outbound attempts under an HTTP/WebSocket deny rule. No package lifecycle scripts executed; this does not audit all package code or dependencies." } ], "limits": [ "No plugin execution, framework adapter, touch/scroll behavior, performance benchmark or complete accessibility review.", "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification." ] }, "practicalCaveats": [ "Keep each view’s temporary animations in a cleanup scope and verify the state after closing or navigating.", "Do not make important copy or controls depend on a long timeline finishing." ], "limits": [ "Only core GSAP 3.15.0 with synthetic objects and one DOM element.", "No plugin execution, framework adapter, touch/scroll behavior, performance benchmark or complete accessibility review." ], "sources": [ { "label": "GSAP documentation", "url": "https://gsap.com/docs/v3/" }, { "label": "Current Standard License", "url": "https://gsap.com/community/standard-license/" }, { "label": "Dated repository snapshot source", "url": "https://github.com/greensock/GSAP" }, { "label": "Exact evaluated package archive", "url": "https://registry.npmjs.org/gsap/-/gsap-3.15.0.tgz" } ] } }, { "id": "lucide", "title": "Lucide", "url": "https://lucide.dev/", "category": "Brand & assets", "kind": "SVG icon library and framework packages", "summary": "Give interface actions a consistent visual vocabulary without turning icons into the only explanation.", "whatItIs": "Lucide is an SVG icon collection with packages for several UI frameworks and a direct JavaScript replacement API. Its consistent outline treatment makes it useful for navigation, controls and status indicators that need to feel like one system. You can select the icons your application actually uses and control dimensions, color and stroke. The library supplies shapes; it does not decide whether a symbol is understandable, whether a button has a name or what a status means.", "whenUseful": "Use it when a product has accumulated mismatched icons or a new interface needs a small, reusable set of action symbols. Establish semantic names such as export or retry in your design system, then map those names to selected icons so a later visual change does not alter the task vocabulary.", "example": "Proposed workflow: standardize a review toolbar with Download, Retry and More actions. Pair visible text with the primary actions; give any icon-only control its own accessible name and focus treatment. Import only the selected icon data and define a visible fallback for unknown names. The fixture used a synthetic Confirm button, not this toolbar.", "expectedResult": "A small icon map with consistent rendering and explicit text, focus and missing-icon behavior.", "cautions": [ "An unavailable icon name left its placeholder in place in the fixture; the library did not create a visible fallback.", "The tested native button supplied its own accessible name. That result is not evidence that an unlabeled SVG is an accessible control.", "The full global bundle was used to make the fixture self-contained; bundle-size and tree-shaking claims were not measured." ], "requirements": [ "Choose the package for the actual framework or the plain JavaScript API, and pin its version.", "Keep accessible names on controls and hide purely decorative icons from assistive technology.", "Preserve the shipped license notices: ISC, plus the listed Feather-derived icons’ MIT notice." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): a popular shared icon vocabulary with framework options and clear consumer responsibilities around labels and missing names. GitHub lucide-icons/lucide showed 25,145 stars; the inspected default-branch commit was dated 2026-10-19. This is one adoption/activity snapshot, not evidence of trend growth or safety.", "The proposed workflow above is an application idea. Executed checks and untested boundaries are stated separately in the evaluation." ], "sources": [ { "label": "Lucide guide", "url": "https://lucide.dev/guide/" }, { "label": "Accessibility guidance", "url": "https://lucide.dev/how-to/accessibility" }, { "label": "Full license including Feather notices", "url": "https://github.com/lucide-icons/lucide/blob/main/LICENSE" }, { "label": "Primary repository", "url": "https://github.com/lucide-icons/lucide" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "local-fixture", "source-review" ], "summary": "Lucide 1.59.0 replaced a known icon, honored size/stroke settings and avoided duplication on a second initialization. An unknown name remained a placeholder. The authored Confirm button retained its name while the decorative SVG stayed hidden.", "reportUrl": "/design-evaluations/resource-lucide.json", "identity": { "target": "lucide", "version": "1.59.0", "integrity": "sha512-0KTOAFYlTuLHdJOqnRCuPhscU29xtx/QnlHyrOfK0FynDhuPm50O3BH/e4wRnOS67ph0z7uovveCVcXUPLTPBw==" }, "environment": [ "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.", "Synthetic inputs only; no uploads, purchases, accounts or private data.", "Pinned extracted assets/modules; browser HTTP(S) and WebSocket requests denied. No install/lifecycle scripts; no process-wide Node egress guarantee." ], "tests": [ { "name": "Icon replacement and dimensions", "mode": "local-fixture", "method": "Replace a known Check placeholder with named icon data", "result": "pass", "observation": "{\"count\":1,\"after\":1,\"viewBox\":\"0 0 24 24\",\"width\":\"32\",\"stroke\":\"1.5\",\"hidden\":\"true\",\"unknownRetained\":true}" }, { "name": "Repeat initialization", "mode": "local-fixture", "method": "Initialize icons a second time and count SVGs", "result": "pass", "observation": "{\"before\":1,\"after\":1}" }, { "name": "Unknown-name boundary", "mode": "local-fixture", "method": "Include an unavailable icon name", "result": "pass", "observation": "Unknown icon placeholder remains; this is not a visible fallback or validation error." }, { "name": "Decorative icon label boundary", "mode": "local-fixture", "method": "Inspect authored parent label and propagated hidden attribute", "result": "pass", "observation": "Authored button label remains Confirm; decorative SVG is hidden. Semantic labeling belongs to the consumer." }, { "name": "Framework-specific behavior", "mode": "local-fixture", "method": "Render icons through framework packages", "result": "not-run", "observation": "Only the plain JavaScript bundle was used; framework rendering and hydration were not tested." } ], "security": { "scope": "Manifest/license and selected entry/source inspection, plus the named synthetic local fixture. No active exploitation or full security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Unknown icon names need an application fallback", "detail": "The missing-name fixture retained its original placeholder. Validate icon identifiers and provide a readable fallback rather than assuming every requested name will render." }, { "level": "caution", "basis": "observed", "title": "Control semantics come from the wrapper", "detail": "The fixture supplied the button element, Confirm label and decorative hidden attribute. The passing label check covers that composition, not every use of Lucide." }, { "level": "caution", "basis": "documented", "title": "Keep the complete notice file", "detail": "The upstream license combines ISC terms with MIT notices for identified Feather-derived icons. Retain the complete applicable notices with redistributed assets." }, { "level": "info", "basis": "observed", "title": "Pinned sample and network boundary", "detail": "The fetched archive matched its registry SHA-512. The selected fixture made zero outbound attempts under an HTTP/WebSocket deny rule. No package lifecycle scripts executed; this does not audit all package code or dependencies." } ], "limits": [ "No React/Vue package runtime, whole-catalog SVG inspection, screen-reader session, contrast audit or bundle-size measurement.", "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification." ] }, "practicalCaveats": [ "Map product actions to a small approved icon set and keep essential labels visible.", "Review stroke weight, contrast, target size and meaning at the actual display size." ], "limits": [ "One named Check icon, one unknown name and the plain JavaScript initialization API.", "No React/Vue package runtime, whole-catalog SVG inspection, screen-reader session, contrast audit or bundle-size measurement." ], "sources": [ { "label": "Lucide guide", "url": "https://lucide.dev/guide/" }, { "label": "Accessibility guidance", "url": "https://lucide.dev/how-to/accessibility" }, { "label": "Full license including Feather notices", "url": "https://github.com/lucide-icons/lucide/blob/main/LICENSE" }, { "label": "Dated repository snapshot source", "url": "https://github.com/lucide-icons/lucide" }, { "label": "Exact evaluated package archive", "url": "https://registry.npmjs.org/lucide/-/lucide-1.59.0.tgz" } ] } }, { "id": "phosphor-icons", "title": "Phosphor Icons", "url": "https://phosphoricons.com/", "category": "Brand & assets", "kind": "Icon family with multiple visual weights", "summary": "Choose one icon family, then use weight deliberately instead of mixing unrelated styles.", "whatItIs": "Phosphor provides a coordinated icon family in multiple weights, including regular, bold and duotone treatments. Its core package includes raw SVG assets and catalog metadata, while separate integrations adapt the family to UI frameworks and design tools. That gives a team a useful way to vary emphasis while keeping recognizable geometry. The choice of weight is a visual decision; it does not replace labels, contrast checks or an explicit indication of state.", "whenUseful": "Use it when an interface needs a related set of navigation and status icons, or when a design system needs stronger and quieter variants without changing icon families. Pick a default weight and reserve exceptions for a named purpose so the interface stays predictable.", "example": "Proposed workflow: use regular icons for a document list and a stronger Check Circle next to the written status Reviewed. Define the semantic status separately from the icon name and color. Keep the same label in narrow layouts and high-contrast modes. Our local check rendered three Check Circle weights; it did not validate this complete document-list workflow.", "expectedResult": "A consistent asset specification with a default weight, clear state labels and reusable icon wrappers.", "cautions": [ "The core asset catalog is distinct from the homepage repository whose dated star count is shown in the inclusion note.", "Only three Check Circle SVGs were inspected and rendered. Their lack of matched active-content patterns does not certify all SVG files.", "Duotone and color choices still need contrast, forced-color and legibility checks in the actual interface." ], "requirements": [ "Use the appropriate framework package or selected raw SVG files; pin the exact asset version.", "Give interactive wrappers names and focus behavior; mark decorative copies hidden.", "Keep MIT notices and check any separately obtained artwork or integration terms." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): an established icon family that adds weight choices and raw assets useful across frameworks. GitHub phosphor-icons/homepage showed 7,678 stars; the inspected default-branch commit was dated 2026-08-26. This is one adoption/activity snapshot, not evidence of trend growth or safety.", "The proposed workflow above is an application idea. Executed checks and untested boundaries are stated separately in the evaluation." ], "sources": [ { "label": "Core assets and catalog documentation", "url": "https://github.com/phosphor-icons/core" }, { "label": "Core license", "url": "https://github.com/phosphor-icons/core/blob/main/LICENSE" }, { "label": "Phosphor homepage source", "url": "https://github.com/phosphor-icons/homepage" }, { "label": "Primary repository", "url": "https://github.com/phosphor-icons/homepage" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "local-fixture", "source-review" ], "summary": "Pinned Phosphor core 2.1.1 regular, bold and duotone Check Circle SVGs rendered at 24 px and inherited the wrapper’s color. Three bounded SVG scans found no selected active-content patterns. Labels and hidden semantics were authored by the fixture.", "reportUrl": "/design-evaluations/resource-phosphor-icons.json", "identity": { "target": "@phosphor-icons/core", "version": "2.1.1", "integrity": "sha512-v4ARvrip4qBCImOE5rmPUylOEK4iiED9ZyKjcvzuezqMaiRASCHKcRIuvvxL/twvLpkfnEODCOJp5dM4eZilxQ==" }, "environment": [ "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.", "Synthetic inputs only; no uploads, purchases, accounts or private data.", "Pinned extracted assets/modules; browser HTTP(S) and WebSocket requests denied. No install/lifecycle scripts; no process-wide Node egress guarantee." ], "tests": [ { "name": "Three SVG weights render", "mode": "local-fixture", "method": "Render pinned regular/bold/duotone Check Circle assets in authored wrapper", "result": "pass", "observation": "[{\"weight\":\"regular\",\"viewBox\":\"0 0 256 256\",\"width\":24,\"fill\":\"rgb(30, 64, 175)\",\"paths\":1,\"hidden\":\"true\",\"scripts\":0,\"events\":0,\"externalRefs\":0},{\"weight\":\"bold\",\"viewBox\":\"0 0 256 256\",\"width\":24,\"fill\":\"rgb(30, 64, 175)\",\"paths\":1,\"hidden\":\"true\",\"scripts\":0,\"events\":0,\"externalRefs\":0},{\"weight\":\"duotone\",\"viewBox\":\"0 0 256 256\",\"width\":24,\"fill\":\"rgb(30, 64, 175)\",\"paths\":2,\"hidden\":\"true\",\"scripts\":0,\"events\":0,\"externalRefs\":0}]" }, { "name": "currentColor and accessible wrapper", "mode": "local-fixture", "method": "Read inherited color and authored button name", "result": "pass", "observation": "Three SVGs inherit the authored color; the wrapper supplies Confirm and aria-hidden. The raw assets alone do not define a control." }, { "name": "Bounded SVG active-content scan", "mode": "source-review", "method": "Inspect these three parsed SVGs for script/foreignObject/event attributes/HTTP references", "result": "pass", "observation": "Zero matched patterns in three selected SVGs. Not a sanitizer or a claim about every icon." }, { "name": "Framework and design-tool integration", "mode": "local-fixture", "method": "Use a framework wrapper or design plugin", "result": "not-run", "observation": "The fixture rendered raw SVG assets only; no integration package or plugin was installed." } ], "security": { "scope": "Manifest/license and selected entry/source inspection, plus the named synthetic local fixture. No active exploitation or full security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "Three selected SVGs were self-contained in the fixture", "detail": "The sampled SVGs rendered without external requests. No script, foreignObject, event attribute or HTTP-reference pattern matched in those files; this is a small sample, not a sanitizer." }, { "level": "caution", "basis": "advice", "title": "An asset is not an interactive control", "detail": "Wrap actionable icons in native controls and supply understandable labels, focus states and adequate targets. Changing an icon’s weight alone may not communicate a status to everyone." }, { "level": "info", "basis": "observed", "title": "Pinned sample and network boundary", "detail": "The fetched archive matched its registry SHA-512. The selected fixture made zero outbound attempts under an HTTP/WebSocket deny rule. No package lifecycle scripts executed; this does not audit all package code or dependencies." } ], "limits": [ "No framework package, Figma/plugin workflow, complete SVG corpus, screen-reader, contrast or forced-colors evaluation.", "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification." ] }, "practicalCaveats": [ "Choose a default weight, then document why a stronger weight appears in a particular state.", "Keep the selected SVGs and their license version together so visual changes remain reviewable." ], "limits": [ "Only three raw Check Circle assets from core 2.1.1; the catalog data module was not executed.", "No framework package, Figma/plugin workflow, complete SVG corpus, screen-reader, contrast or forced-colors evaluation." ], "sources": [ { "label": "Core assets and catalog documentation", "url": "https://github.com/phosphor-icons/core" }, { "label": "Core license", "url": "https://github.com/phosphor-icons/core/blob/main/LICENSE" }, { "label": "Phosphor homepage source", "url": "https://github.com/phosphor-icons/homepage" }, { "label": "Dated repository snapshot source", "url": "https://github.com/phosphor-icons/homepage" }, { "label": "Exact evaluated package archive", "url": "https://registry.npmjs.org/@phosphor-icons/core/-/core-2.1.1.tgz" } ] } }, { "id": "tailwindcss", "title": "Tailwind CSS", "url": "https://tailwindcss.com/", "category": "Tokens & playbooks", "kind": "Utility CSS compiler and design-token workflow", "summary": "Generate styling from explicit utility classes while keeping the design decisions in a shared token system.", "whatItIs": "Tailwind CSS turns recognized utility classes and theme definitions into CSS. A class can describe spacing, color, layout or a state such as focus, while variants apply the rule at a breakpoint or under a media preference. The benefit is a consistent styling vocabulary close to the markup. It still needs design decisions: unrestricted one-off values can produce an inconsistent interface just as easily as an unmanaged stylesheet.", "whenUseful": "Use it when a team wants reusable spacing and color conventions across many components and has a build process that can generate CSS. It works well when components collect repeated class combinations behind meaningful names. Audit existing styles and browser requirements before adding it to a large legacy site.", "example": "Proposed workflow: define semantic colors and spacing for a review panel, then use responsive padding and a focus-visible treatment on its controls. Map component states to complete class strings rather than assembling fragments at runtime. Keep motion-safe effects optional. The fixture tested a synthetic theme and explicit candidates, not a production component build.", "expectedResult": "A repeatable styling recipe whose tokens, responsive rules and interactive states can be reviewed together.", "cautions": [ "The local test called the 4.3.3 compiler with an explicit candidate list. It did not exercise CLI/Vite/PostCSS integration or filesystem scanning.", "The compiler omitted an unknown utility in the fixture. Missing generated CSS can therefore be a candidate/configuration problem rather than a browser failure.", "MIT covers the framework; separately purchased Tailwind Plus assets have their own terms." ], "requirements": [ "A compatible build integration for the chosen version and browsers that support its generated CSS.", "Complete detectable class names or explicitly registered candidates; review the source-scanning rules for the project layout.", "A token and component convention, plus separate keyboard, contrast and content-layout checks." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): a widely adopted CSS workflow that connects token choices, component implementation and reviewable interaction variants. GitHub tailwindlabs/tailwindcss showed 97,934 stars; the inspected default-branch commit was dated 2026-10-19. This is one adoption/activity snapshot, not evidence of trend growth or safety.", "The proposed workflow above is an application idea. Executed checks and untested boundaries are stated separately in the evaluation." ], "sources": [ { "label": "Installation and integrations", "url": "https://tailwindcss.com/docs/installation/using-vite" }, { "label": "Class detection boundaries", "url": "https://tailwindcss.com/docs/detecting-classes-in-source-files" }, { "label": "State variants", "url": "https://tailwindcss.com/docs/hover-focus-and-other-states" }, { "label": "Primary repository", "url": "https://github.com/tailwindlabs/tailwindcss" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "local-fixture", "source-review" ], "summary": "Tailwind 4.3.3 compiled a synthetic theme and explicit candidates. Generated CSS changed padding from 16 to 32 px across the tested widths, supplied a 2 px keyboard outline and stopped a motion-safe animation under reduced motion. Unknown utility input was omitted.", "reportUrl": "/design-evaluations/resource-tailwindcss.json", "identity": { "target": "tailwindcss", "version": "4.3.3", "integrity": "sha512-gOhV3P7ufE62QDGg1zVaTgCR+EtPv92k2nIhVcVKcLmxT1sUBsQGhnZj175j+MqRt4zLF7ic+sCYjfhxMxj7YQ==" }, "environment": [ "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.", "Synthetic inputs only; no uploads, purchases, accounts or private data.", "Pinned extracted assets/modules; browser HTTP(S) and WebSocket requests denied. No install/lifecycle scripts; no process-wide Node egress guarantee." ], "tests": [ { "name": "Compile explicit candidates", "mode": "local-fixture", "method": "Compile synthetic theme and class candidate list", "result": "pass", "observation": "{\"padding\":\"16px\",\"background\":\"rgb(30, 64, 175)\",\"generatedBytes\":997}" }, { "name": "Responsive variant", "mode": "local-fixture", "method": "Resize the 320 px fixture to 1024 px", "result": "pass", "observation": "{\"small\":\"16px\",\"wide\":\"32px\"}" }, { "name": "Unknown candidate boundary", "mode": "local-fixture", "method": "Include not-a-real-utility in build candidates", "result": "pass", "observation": "Unknown utility was omitted rather than producing a runtime error; candidate discovery was supplied by the fixture, not the filesystem scanner." }, { "name": "Focus-visible utility", "mode": "local-fixture", "method": "Focus authored button with Tab", "result": "pass", "observation": "{\"focused\":true,\"width\":\"2px\",\"style\":\"solid\"}" }, { "name": "Motion-safe variant", "mode": "local-fixture", "method": "Request reduced motion on the generated motion-safe animation", "result": "pass", "observation": "{\"normal\":1,\"reduced\":0}" }, { "name": "Production build integration", "mode": "local-fixture", "method": "Run the project’s scanner and bundler adapter", "result": "not-run", "observation": "No CLI/Vite/PostCSS integration or project filesystem scan was executed." } ], "security": { "scope": "Manifest/license and selected entry/source inspection, plus the named synthetic local fixture. No active exploitation or full security audit.", "findings": [ { "level": "caution", "basis": "observed", "title": "The compiled sample needed no runtime network", "detail": "The compiler modules and generated 997-byte stylesheet ran in the isolated browser without outbound attempts. This covers the named core compiler path, not arbitrary plugins or build dependencies." }, { "level": "caution", "basis": "documented", "title": "Class discovery is a separate boundary", "detail": "Official guidance explains that source scanning reads text rather than evaluating string interpolation. Keep class names complete and verify the sources included by your actual build." }, { "level": "caution", "basis": "advice", "title": "Generated CSS does not validate the interface", "detail": "A focus utility or responsive rule can compile correctly while a layout still has unclear labels, poor contrast or inaccessible behavior. Test the composed component with real content." }, { "level": "info", "basis": "observed", "title": "Pinned sample and network boundary", "detail": "The fetched archive matched its registry SHA-512. The selected fixture made zero outbound attempts under an HTTP/WebSocket deny rule. No package lifecycle scripts executed; this does not audit all package code or dependencies." } ], "limits": [ "No scanner, CLI, native build adapter, plugin, production bundler, migration, full Preflight/reset behavior or cross-browser compatibility test.", "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification." ] }, "practicalCaveats": [ "Treat theme tokens and reusable component classes as a shared contract, not an unlimited list of one-off values.", "Check generated CSS and actual browser styles when a class appears to do nothing." ], "limits": [ "Core compiler 4.3.3 in a browser fixture with explicit candidates, one theme and a small generated stylesheet.", "No scanner, CLI, native build adapter, plugin, production bundler, migration, full Preflight/reset behavior or cross-browser compatibility test." ], "sources": [ { "label": "Installation and integrations", "url": "https://tailwindcss.com/docs/installation/using-vite" }, { "label": "Class detection boundaries", "url": "https://tailwindcss.com/docs/detecting-classes-in-source-files" }, { "label": "State variants", "url": "https://tailwindcss.com/docs/hover-focus-and-other-states" }, { "label": "Dated repository snapshot source", "url": "https://github.com/tailwindlabs/tailwindcss" }, { "label": "Exact evaluated package archive", "url": "https://registry.npmjs.org/tailwindcss/-/tailwindcss-4.3.3.tgz" } ] } }, { "id": "storybook", "title": "Storybook", "url": "https://storybook.js.org/", "category": "Design systems", "kind": "Component workshop and UI-state documentation", "summary": "Make difficult UI states easy to open, discuss and test without navigating the whole application.", "whatItIs": "Storybook runs a collection of component examples called stories. Each story supplies a particular set of props, mock data or interaction state, so a reviewer can open an empty list, an error or a long label directly. It also provides a place for component controls, reference pages and test-runner integrations. The useful artifact is the set of carefully chosen states; an extensive story count does not help much if the examples avoid the conditions that cause failures.", "whenUseful": "Use it for a shared component library or a product where engineers and designers repeatedly need to reproduce unusual states. Start with components that have several meaningful outcomes. Keep a smaller end-to-end suite for behavior that depends on the real application, permissions or backend.", "example": "Proposed workflow: document a review card in waiting, selected, failed and completed states using synthetic records. Add a long-title case and a keyboard interaction test, then link the relevant story from the component’s change review. Keep actual customer data out of the story bundle. Our evaluation used the publisher’s hosted Checkbox story, not this proposed story set.", "expectedResult": "A reproducible set of UI states that reviewers can inspect and developers can reuse as focused test fixtures.", "cautions": [ "A published Storybook is an application bundle; stories, fixtures and client-exposed configuration may become readable by its audience.", "The tested public demo is a mutable hosted build. It does not establish the version or correctness of a new local installation.", "Storybook source is MIT; addons and hosted services have separate dependency and account boundaries." ], "requirements": [ "A supported framework/builder integration and a development dependency setup maintained with the application.", "Synthetic fixtures and mocks that represent useful edge cases without embedding private data or secrets.", "Separate decisions for addons, published access, CI and optional hosted visual-testing services." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): a widely adopted component-review workflow that makes state coverage explicit rather than relying only on screenshots. GitHub storybookjs/storybook showed 91,337 stars; the inspected default-branch commit was dated 2026-10-19. This is one adoption/activity snapshot, not evidence of trend growth or safety.", "The proposed workflow above is an application idea. Executed checks and untested boundaries are stated separately in the evaluation." ], "sources": [ { "label": "Why Storybook and story workflow", "url": "https://storybook.js.org/docs/get-started/why-storybook" }, { "label": "Officially documented public demo destination", "url": "https://storybook.js.org/docs/sharing/storybook-composition" }, { "label": "Telemetry controls", "url": "https://storybook.js.org/docs/configure/telemetry" }, { "label": "Primary repository", "url": "https://github.com/storybookjs/storybook" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "browser", "source-review" ], "summary": "The public Storybook design-system demo loaded its Checkbox Playground story, and Space toggled the first checkbox false→true→false. This verifies one built-story interaction; no local build, addon or visual-testing service was run.", "reportUrl": "/design-evaluations/resource-storybook.json", "identity": { "target": "https://master--5ccbc373887ca40020446347.chromatic.com/", "version": "Unversioned public build observed 2026-10-19", "integrity": "Entry-response SHA-256 ac924094ea3fe0a921f5cd5e345f2162f4512322c7790275abdade025beb4845; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.", "Synthetic inputs only; no uploads, purchases, accounts or private data.", "Exact allowlisted public HTTPS origins with GET/HEAD; credentials, non-default ports, forms, downloads, service writes, auth/telemetry routes and WebSockets blocked. Restrictions may change page behavior." ], "tests": [ { "name": "Public application entry", "mode": "browser", "method": "Load fresh browser document and inspect visible controls", "result": "pass", "observation": "HTTP 200; 45 sampled button controls, 1 visible inputs. Reachability alone does not establish product functionality." }, { "name": "Hosted story keyboard interaction", "mode": "browser", "method": "Select public Checkbox story and toggle its first checkbox with Space twice", "result": "pass", "observation": "{\"story\":\"Playground\",\"before\":false,\"after\":true,\"restored\":false,\"limit\":\"Public built story only; no local Storybook build/addon/test-runner or authenticated Chromatic workflow.\"}" }, { "name": "Local build and test pipeline", "mode": "browser", "method": "Install/build a project and execute its story test runner", "result": "not-run", "observation": "Only a public built story was exercised; local integration and automated test coverage remain unverified." } ], "security": { "scope": "Passive inspection of the named public response headers, requested origins and bounded public controls. No exploitation, authentication or backend permission tests.", "findings": [ { "level": "caution", "basis": "observed", "title": "The sampled story executed in its preview frame", "detail": "The checkbox inside the preview iframe responded to keyboard input and returned to its starting state. That is stronger than iframe presence, but covers only this one public story." }, { "level": "caution", "basis": "documented", "title": "Local development telemetry has an opt-out boundary", "detail": "Official documentation describes a boot event before configuration is evaluated and recommends STORYBOOK_DISABLE_TELEMETRY when that event must also be disabled. This pass did not start a local Storybook process." }, { "level": "caution", "basis": "advice", "title": "Keep published stories free of private fixtures", "detail": "Review mock data, embedded URLs, source examples and browser-exposed environment configuration before sharing a story build. A development tool can still publish sensitive material if its inputs contain it." } ], "limits": [ "No install/build process, addon execution, CI test runner, Chromatic login, visual regression service or real backend interaction.", "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification." ] }, "practicalCaveats": [ "Pick stories that represent failures, loading, empty states and awkward content rather than only the default appearance.", "Keep local component tests and full-application authorization tests as separate checks." ], "limits": [ "One public Checkbox Playground story from the documented design-system demo; no pinned Storybook runtime build.", "No install/build process, addon execution, CI test runner, Chromatic login, visual regression service or real backend interaction." ], "sources": [ { "label": "Why Storybook and story workflow", "url": "https://storybook.js.org/docs/get-started/why-storybook" }, { "label": "Officially documented public demo destination", "url": "https://storybook.js.org/docs/sharing/storybook-composition" }, { "label": "Telemetry controls", "url": "https://storybook.js.org/docs/configure/telemetry" }, { "label": "Dated repository snapshot source", "url": "https://github.com/storybookjs/storybook" }, { "label": "Evaluated public sample", "url": "https://master--5ccbc373887ca40020446347.chromatic.com/" } ] } }, { "id": "penpot", "title": "Penpot", "url": "https://penpot.app/", "category": "Design systems", "kind": "Interface design, prototyping and design-system workspace", "summary": "Bring interface design and implementation conversations into a workspace built around open web concepts.", "whatItIs": "Penpot is a collaborative interface-design platform with vector editing, prototypes, components, shared libraries and design tokens. Its layout model includes CSS Grid and Flex concepts, which can help designers and developers discuss rules rather than only fixed pictures. A hosted service and self-hosting options are available. Those options create different operational responsibilities; a public template directory is only a way to discover starting material, not evidence that a team workspace is configured safely.", "whenUseful": "Use it when a team wants a shared place to define interface rules and review prototypes, especially when self-hosting or open-source tooling matters to the operating model. Compare the actual collaboration, import and handoff workflow against the team’s needs before migrating a working design system.", "example": "Proposed workflow: explore a wireframing kit, confirm its author and reuse terms, then build a synthetic intake flow in a dedicated test workspace. Define reusable fields and errors, prototype the next/back sequence and compare the intended layout with the implementation. Our check browsed the public kit directory; it did not import a kit or create this flow.", "expectedResult": "A reviewable prototype and component vocabulary, with an explicit decision about hosting, access and asset reuse.", "cautions": [ "This evaluation is limited to the public template directory. Editing, live collaboration, prototype execution, imports and export fidelity were not tested.", "A minified React hydration error 418 appeared during directory-to-detail browsing, although the measured search and navigation completed. Its user impact was not established.", "Penpot source uses MPL 2.0; community template and asset licenses remain separate. Self-hosting does not by itself prove a secure deployment." ], "requirements": [ "A hosted account or an administered self-hosted instance for actual design work.", "An operator for authentication, updates, backups and storage if self-hosting.", "Separate permission and license checks for community libraries, plugins, fonts and uploaded assets." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): a prominent open-source design-workspace option with a meaningful hosted-versus-self-hosted operating choice. GitHub penpot/penpot showed 61,374 stars; the inspected default-branch commit was dated 2026-10-19. This is one adoption/activity snapshot, not evidence of trend growth or safety.", "The proposed workflow above is an application idea. Executed checks and untested boundaries are stated separately in the evaluation." ], "sources": [ { "label": "Product capabilities", "url": "https://penpot.app/" }, { "label": "Self-hosting options", "url": "https://penpot.app/self-host" }, { "label": "Public library directory", "url": "https://penpot.app/penpothub/libraries-templates" }, { "label": "Inspected wireframing-kit detail", "url": "https://penpot.app/penpothub/libraries-templates/minimalistic-wireframing-kit" }, { "label": "Primary repository", "url": "https://github.com/penpot/penpot" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "browser", "source-review" ], "summary": "The public directory narrowed after a wireframe query and opened the Minimalistic Wireframing Kit detail. A hydration error was logged during the visit, while both assertions passed. No design editor, account, import or collaboration workflow was tested.", "reportUrl": "/design-evaluations/resource-penpot.json", "identity": { "target": "https://penpot.app/penpothub/libraries-templates", "version": "Unversioned public build observed 2026-10-19", "integrity": "Entry-response SHA-256 5c7151767a95f2552e9a44e6cbacd75b7ec0b577a0e4f8ae1b1fd701b39f5685; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.", "Synthetic inputs only; no uploads, purchases, accounts or private data.", "Exact allowlisted public HTTPS origins with GET/HEAD; credentials, non-default ports, forms, downloads, service writes, auth/telemetry routes and WebSockets blocked. Restrictions may change page behavior." ], "tests": [ { "name": "Public application entry", "mode": "browser", "method": "Load fresh browser document and inspect visible controls", "result": "pass", "observation": "HTTP 200; 45 sampled button controls, 1 visible inputs. Reachability alone does not establish product functionality." }, { "name": "Template-directory search", "mode": "browser", "method": "Search public library directory for wireframe", "result": "pass", "observation": "{\"before\":77,\"after\":29,\"matches\":[\"Submit a Library\",\"How to contribute\",\"\",\"\",\"Community wireframes\",\"\",\"\",\"Wireframes kit\",\"\",\"\",\"Minimalistic Wireframing Kit\",\"\"]}" }, { "name": "Template detail navigation", "mode": "browser", "method": "Open observed Minimalistic Wireframing Kit link without importing/downloading", "result": "pass", "observation": "{\"url\":\"https://penpot.app/penpothub/libraries-templates/minimalistic-wireframing-kit\",\"h1\":[\"Minimalistic Wireframing Kit\"],\"downloadControls\":1,\"limit\":\"No hosted editor, import, account, prototype or export workflow was exercised.\"}" }, { "name": "Design workspace runtime", "mode": "browser", "method": "Edit, prototype or collaborate in a workspace", "result": "not-run", "observation": "The account-free pass stayed in the public directory; the editor and workspace permissions remain untested." } ], "security": { "scope": "Passive inspection of the named public response headers, requested origins and bounded public controls. No exploitation, authentication or backend permission tests.", "findings": [ { "level": "caution", "basis": "observed", "title": "The public directory has separate delivery dependencies", "detail": "The sampled page requested Plasmic assets/data, Google Fonts and GitHub API resources. The recorded response included HSTS and nosniff; neither those headers nor successful browsing certify the hosted editor or a self-hosted instance." }, { "level": "caution", "basis": "observed", "title": "A browser error remains an inspection limit", "detail": "A React 418 hydration error appeared during the public directory/detail run. The search and detail assertions still passed. We did not diagnose its cause or extrapolate it to editor reliability." }, { "level": "caution", "basis": "advice", "title": "Hosting and imported material need their own review", "detail": "Choose who administers the workspace, controls access and restores backups. Inspect the selected library/plugin’s terms and data access before introducing it to a private project." } ], "limits": [ "No account, design editor, self-host installation, imported file, prototype interaction, export, collaboration, MCP or server authorization test.", "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification." ] }, "practicalCaveats": [ "Trial the exact component, prototype and handoff workflow in a dedicated workspace before moving production designs.", "Document which party owns backups, updates, access removal and external plugin review." ], "limits": [ "Public library search and one detail page only; counts include duplicate card links and directory navigation, not unique assets.", "No account, design editor, self-host installation, imported file, prototype interaction, export, collaboration, MCP or server authorization test." ], "sources": [ { "label": "Product capabilities", "url": "https://penpot.app/" }, { "label": "Self-hosting options", "url": "https://penpot.app/self-host" }, { "label": "Public library directory", "url": "https://penpot.app/penpothub/libraries-templates" }, { "label": "Inspected wireframing-kit detail", "url": "https://penpot.app/penpothub/libraries-templates/minimalistic-wireframing-kit" }, { "label": "Dated repository snapshot source", "url": "https://github.com/penpot/penpot" }, { "label": "Evaluated public sample", "url": "https://penpot.app/penpothub/libraries-templates" } ] } }, { "id": "tldraw", "title": "tldraw", "url": "https://tldraw.dev/", "category": "Components", "kind": "React infinite-canvas editor SDK", "summary": "Start with a working canvas interaction model when your product needs a spatial editing surface.", "whatItIs": "The tldraw SDK provides a React canvas editor with tools, shapes, selection, camera movement and undo/redo behavior. It is a foundation for applications where arranging objects in space is part of the work, rather than a replacement for every form or document editor. The application still chooses its data model, persistence, asset handling and collaboration architecture. The SDK is source-available under its own license; examples with permissive licenses do not change the SDK’s production terms.", "whenUseful": "Use it when a diagram, planning board or visual annotation workflow needs dependable editing primitives and custom shapes. Define what a shape represents in the business process before building a large toolbar. A simple ordered checklist may remain easier to use when spatial relationships add little value.", "example": "Proposed workflow: create a process-review canvas with cards for steps and connectors for handoffs. Store business identifiers separately from visual positions, validate incoming records, and define who may edit or view each board. Provide a non-canvas summary of the process. Our public-example check created one rectangle and used undo/redo; it did not implement this application.", "expectedResult": "A canvas prototype with explicit document, permission, persistence and accessibility boundaries before collaboration is introduced.", "cautions": [ "The SDK is not permissively open-source licensed. Production use requires the applicable trial, commercial or hobby license arrangement.", "The basic example is documented as nonpersistent by default; a passing draw/undo/redo cycle says nothing about reload recovery or multi-user consistency.", "External assets, embeds, uploads and collaboration introduce data flows and permission checks that were not exercised." ], "requirements": [ "A React application, the SDK stylesheet and a container with usable dimensions.", "A valid applicable production license/key; the default SDK license covers development rather than unrestricted production use.", "Application-owned decisions for persistence, assets, validation, collaboration, authorization and non-canvas access." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included (2026-10-19): a heavily followed canvas SDK that exposes useful editing primitives and a production-license boundary easy to overlook. GitHub tldraw/tldraw showed 50,991 stars; the inspected default-branch commit was dated 2026-10-19. This is one adoption/activity snapshot, not evidence of trend growth or safety.", "The proposed workflow above is an application idea. Executed checks and untested boundaries are stated separately in the evaluation." ], "sources": [ { "label": "Basic component example", "url": "https://tldraw.dev/examples/basic" }, { "label": "SDK licensing and data collection", "url": "https://tldraw.dev/community/license" }, { "label": "Persistence concepts", "url": "https://tldraw.dev/docs/persistence" }, { "label": "Primary repository", "url": "https://github.com/tldraw/tldraw" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "browser", "source-review" ], "summary": "The official basic example created one rectangle, removed it with Undo and restored it with Redo. No service-write or WebSocket request was allowed. Persistence, collaboration, uploads and production-license behavior were not tested.", "reportUrl": "/design-evaluations/resource-tldraw.json", "identity": { "target": "https://examples.tldraw.com/basic/full", "version": "Unversioned public build observed 2026-10-19", "integrity": "Entry-response SHA-256 db15b4efa9f78c814ca87572098ccc691a8a805e54c0e18552d6bebe24aac696; not whole-application integrity." }, "environment": [ "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.", "Synthetic inputs only; no uploads, purchases, accounts or private data.", "Exact allowlisted public HTTPS origins with GET/HEAD; credentials, non-default ports, forms, downloads, service writes, auth/telemetry routes and WebSockets blocked. Restrictions may change page behavior." ], "tests": [ { "name": "Public application entry", "mode": "browser", "method": "Load fresh browser document and inspect visible controls", "result": "pass", "observation": "HTTP 200; 45 sampled button controls, 0 visible inputs. Reachability alone does not establish product functionality." }, { "name": "Draw a rectangle", "mode": "browser", "method": "Select observed Rectangle tool and drag a synthetic shape on blank basic-example canvas", "result": "pass", "observation": "{\"before\":0,\"created\":1}" }, { "name": "Undo shape creation", "mode": "browser", "method": "Activate observed Undo button", "result": "pass", "observation": "{\"created\":1,\"undone\":0}" }, { "name": "Redo shape creation", "mode": "browser", "method": "Activate observed Redo button", "result": "pass", "observation": "{\"redone\":1}" }, { "name": "Persistence and collaboration", "mode": "browser", "method": "Save/reload or share a multi-user canvas", "result": "not-run", "observation": "The basic anonymous example was used without persistence or collaboration; no server data or room was created." } ], "security": { "scope": "Passive inspection of the named public response headers, requested origins and bounded public controls. No exploitation, authentication or backend permission tests.", "findings": [ { "level": "caution", "basis": "observed", "title": "The basic sample worked without a write request", "detail": "The isolated public example moved through 0→1→0→1 rendered shapes. No blocked service-write/WebSocket attempt was recorded in this run; that does not establish the network behavior of other examples or integrations." }, { "level": "caution", "basis": "documented", "title": "Production licensing and trial telemetry are explicit", "detail": "Official SDK guidance requires an applicable production license/key and describes trial-license usage pings. License enforcement and telemetry behavior were not tested or modified." }, { "level": "caution", "basis": "advice", "title": "The application must protect its canvas records", "detail": "Validate records and assets and enforce authorization on the server that owns persistence or collaboration. A working local editor is not an access-control system." } ], "limits": [ "No reload persistence, asset transfer, upload, multiplayer room, synchronization server, authorization, custom record or production license test.", "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification." ] }, "practicalCaveats": [ "Prototype a small domain-specific shape set before adding custom tools and collaboration.", "Test non-canvas task access, keyboard paths and recovery from interrupted saves in the actual application." ], "limits": [ "Official mutable basic example, one rectangle and two history controls; no pinned SDK build.", "No reload persistence, asset transfer, upload, multiplayer room, synchronization server, authorization, custom record or production license test." ], "sources": [ { "label": "Basic component example", "url": "https://tldraw.dev/examples/basic" }, { "label": "SDK licensing and data collection", "url": "https://tldraw.dev/community/license" }, { "label": "Persistence concepts", "url": "https://tldraw.dev/docs/persistence" }, { "label": "Dated repository snapshot source", "url": "https://github.com/tldraw/tldraw" }, { "label": "Evaluated public sample", "url": "https://examples.tldraw.com/basic/full" } ] } }, { "id": "a11y-project", "title": "The A11Y Project", "url": "https://www.a11yproject.com/", "category": "Evidence", "kind": "Accessibility checklist and learning reference", "summary": "A practical starting point for turning accessibility intent into review tasks people can actually perform.", "whatItIs": "The A11Y Project is a community-maintained collection of accessibility explanations, resources and a manual review checklist. It helps a team notice common content, keyboard, form and media problems before those problems become a release surprise. Its checklist is a prompt for investigation; it does not inspect your application for you.", "whenUseful": "Use it when a designer, content author and developer need a shared review agenda. It is especially useful for a small team that has automated checks but no consistent way to record manual findings and ownership.", "example": "For a new service-request form, assign the content items to an editor and the keyboard and form items to a developer. Test a synthetic request from first field to confirmation, then record the page, observed failure, expected behavior and fix owner for each relevant item.", "expectedResult": "A scoped accessibility issue list with reproducible evidence and owners, plus an explicit list of items that still need specialist or user testing.", "cautions": [ "The checklist says it is not comprehensive. Completing its boxes is not a WCAG conformance decision or proof that disabled users can complete your workflow.", "Check the version of each linked criterion. The reviewed checklist still links to 4.1.1 Parsing, which W3C marks obsolete and removed in WCAG 2.2; useful HTML hygiene and current conformance criteria are different things.", "A checklist item can cover several contexts. Test errors, dialogs, zoom and keyboard states in the actual product instead of accepting one screenshot as evidence." ], "requirements": [ "A browser for the reference and access to the product you are reviewing.", "Someone who can perform manual keyboard and content checks, with assistive-technology expertise for the checks that require it.", "A separate issue tracker or review log; clicking a website checkbox is not a durable team audit record." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included — 2026-10-19: the official community repository had 3,902 stars and 619 forks in the unauthenticated GitHub API snapshot. That supports established community interest; a single snapshot does not establish recent trend growth.", "The checklist and current W3C parsing note were reviewed. One checkbox was exercised with the keyboard; the 64 checklist controls were counted, not individually tested." ], "sources": [ { "label": "Project and learning resources", "url": "https://www.a11yproject.com/" }, { "label": "Manual accessibility checklist", "url": "https://www.a11yproject.com/checklist/" }, { "label": "Official repository", "url": "https://github.com/a11yproject/a11yproject.com" }, { "label": "W3C: Parsing is obsolete and removed in WCAG 2.2", "url": "https://www.w3.org/WAI/WCAG22/Understanding/parsing.html" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The public checklist loaded and one item toggled on and off with Space. This checks the reference page’s control, not the accessibility of any application or the completeness of the checklist.", "reportUrl": "/design-evaluations/resource-a11y-project.json", "identity": { "target": "https://www.a11yproject.com/checklist/", "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.", "integrity": "Recorded document SHA-256 0ef7aed28e1c7969902251e87a4fe3c2cc5659524ac70abed2507563e3890996. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service." }, "environment": [ "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.", "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.", "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence." ], "tests": [ { "name": "Public document response", "mode": "http", "method": "Navigate to the recorded public target in a fresh anonymous browser.", "result": "pass", "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 0ef7aed28e1c7969902251e87a4fe3c2cc5659524ac70abed2507563e3890996; this fingerprints only the recorded HTML response." }, { "name": "Keyboard checklist toggle", "mode": "browser", "method": "Focus the plain-language checkbox in a fresh anonymous browser; press Space twice.", "result": "pass", "observation": "The checkbox changed false → true → false. The page contained 64 checkbox controls; only this control was exercised." }, { "name": "Primary-source scope review", "mode": "source-review", "method": "Read the official pages and relevant repository or standard references linked below.", "result": "pass", "observation": "Reviewed the project’s purpose, checklist coverage and W3C’s current note that Parsing 4.1.1 was removed from WCAG 2.2." }, { "name": "Broader workflow and assurance coverage", "mode": "browser", "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.", "result": "not-run", "observation": "No application audit, screen-reader session, checklist persistence test or full traversal of all 64 controls was performed." } ], "security": { "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.", "findings": [ { "level": "info", "basis": "observed", "title": "Small sampled request surface", "detail": "The checklist sample requested its own origin and a Google Cloud Storage asset origin. No non-GET request or page error was observed during this bounded interaction." }, { "level": "info", "basis": "observed", "title": "HTTPS response hardening", "detail": "The sampled checklist response included Strict-Transport-Security with max-age 31536000. This describes one response and does not establish an application-wide security posture." }, { "level": "caution", "basis": "advice", "title": "Keep review evidence in your own system", "detail": "The public checkbox is a learning aid. Record actual findings, affected pages and sensitive screenshots in an approved internal review system rather than treating this public page as a team evidence store." } ], "limits": [ "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.", "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling." ] }, "practicalCaveats": [ "Use the checklist to generate work, then record verifiable findings and owners.", "Map the chosen checks to the current standard and product scope; do not infer conformance from a filled checklist." ], "limits": [ "No application audit, screen-reader session, checklist persistence test or full traversal of all 64 controls was performed.", "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.", "Proposed use-case examples in this review were not implemented as a production workflow." ], "sources": [ { "label": "Project and learning resources", "url": "https://www.a11yproject.com/" }, { "label": "Manual accessibility checklist", "url": "https://www.a11yproject.com/checklist/" }, { "label": "Official repository", "url": "https://github.com/a11yproject/a11yproject.com" }, { "label": "W3C: Parsing is obsolete and removed in WCAG 2.2", "url": "https://www.w3.org/WAI/WCAG22/Understanding/parsing.html" } ] } }, { "id": "webaim-contrast", "title": "WebAIM Contrast Checker", "url": "https://webaim.org/resources/contrastchecker/", "category": "Evidence", "kind": "Color contrast calculator", "summary": "A focused way to check a foreground/background pair before an attractive color choice becomes unreadable text.", "whatItIs": "WebAIM Contrast Checker takes foreground and background colors and reports a contrast ratio with text and interface-component thresholds. The tool comes from WebAIM, a nonprofit service center at Utah State University. It is useful because a precise pair-level result is easier to act on than a general instruction to make a screen more accessible.", "whenUseful": "Use it while choosing body text, secondary text, borders and controls, and when a design review needs a concrete answer about one pair. It also helps explain why a color can work for a large heading but fail for ordinary text.", "example": "Check a proposed muted label, #777777, on #FFFFFF before using it in a dense settings form. Compare the normal-text result with a darker candidate, then record the approved token pair and check its hover, disabled and error contexts in the implemented page.", "expectedResult": "A documented color-pair decision with the relevant text size and state, followed by page-level verification rather than an unexplained green checkmark.", "cautions": [ "A passing pair does not evaluate text size, spacing, content, focus visibility, keyboard use or the rest of a page.", "Use the actual background and composited color. Gradients, photographs, opacity and overlapping layers can make a single assumed pair misleading.", "Do not round a failing ratio up to a threshold. In this sample #777777 on white displayed 4.47:1 and failed normal-text AA." ], "requirements": [ "The actual foreground and background values, including transparency where relevant.", "A decision about the text or non-text use case and actual rendered size.", "Separate checks for the live interface and other accessibility requirements." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included — 2026-10-19: WebAIM identifies itself as a Utah State University nonprofit service center established in 1999. Its specialist provenance and directly inspectable calculator make it an established reference; no recent popularity-growth claim is made.", "Three synthetic color pairs were entered in the public calculator. The API, bookmarklet, website-audit submission and commercial evaluation service were not exercised." ], "sources": [ { "label": "Contrast checker and threshold explanation", "url": "https://webaim.org/resources/contrastchecker/" }, { "label": "WebAIM institutional background", "url": "https://webaim.org/about/" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "Three synthetic foreground/background pairs produced the expected extremes and near-threshold classifications in the public calculator. This is a bounded calculator check, not a website accessibility audit.", "reportUrl": "/design-evaluations/resource-webaim-contrast.json", "identity": { "target": "https://webaim.org/resources/contrastchecker/", "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.", "integrity": "Recorded document SHA-256 19069d55223e58b7caddca00d563fb9f251ebf159b16d76620f82e577bba2c9a. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service." }, "environment": [ "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.", "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.", "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence." ], "tests": [ { "name": "Public document response", "mode": "http", "method": "Navigate to the recorded public target in a fresh anonymous browser.", "result": "pass", "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 19069d55223e58b7caddca00d563fb9f251ebf159b16d76620f82e577bba2c9a; this fingerprints only the recorded HTML response." }, { "name": "Maximum-contrast pair", "mode": "browser", "method": "Enter #000000 foreground and #FFFFFF background in the public HEX fields.", "result": "pass", "observation": "The tool displayed 21:1 and passed the displayed normal-text, large-text and graphical-object thresholds." }, { "name": "Near-threshold pair", "mode": "browser", "method": "Enter #777777 on #FFFFFF and inspect the displayed ratio and classifications.", "result": "pass", "observation": "The tool displayed 4.47:1: normal text failed AA and AAA; large text passed AA and failed AAA; graphical objects passed AA." }, { "name": "Equal-color pair", "mode": "browser", "method": "Enter #FFFFFF foreground and background.", "result": "pass", "observation": "The tool displayed 1:1 and failed all displayed contrast thresholds." }, { "name": "Primary-source scope review", "mode": "source-review", "method": "Read the official pages and relevant repository or standard references linked below.", "result": "pass", "observation": "Reviewed the calculator’s explanation and WebAIM’s institutional background. The three numeric cases were checked in the page, not inferred from documentation." }, { "name": "Broader workflow and assurance coverage", "mode": "browser", "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.", "result": "not-run", "observation": "The API, bookmarklet, WAVE URL submission, alpha blending edge cases, every color combination and any paid audit were not tested." } ], "security": { "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.", "findings": [ { "level": "caution", "basis": "observed", "title": "Analytics and advertising requests", "detail": "The sample requested Google font, tag, analytics and advertising origins. Six POST requests to analytics/advertising endpoints were blocked by the test guard; this is not a local-only or zero-telemetry claim." }, { "level": "info", "basis": "observed", "title": "Use pair values, not sensitive page content", "detail": "Only synthetic HEX values were entered. The separate website-audit URL field and bookmarklet were not used. Do not infer that testing a color pair authorizes submission of a private application URL." }, { "level": "caution", "basis": "advice", "title": "Calculator output has a narrow boundary", "detail": "Use the result as evidence about a specific color pair. It does not assess an authenticated page, protect uploaded content or validate a complete accessibility claim." } ], "limits": [ "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.", "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling." ] }, "practicalCaveats": [ "Retain the actual ratio and the relevant text-size/state decision; do not round a failure into a pass.", "Check the final page after colors are mapped to tokens and combined with images, transparency or gradients." ], "limits": [ "The API, bookmarklet, WAVE URL submission, alpha blending edge cases, every color combination and any paid audit were not tested.", "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.", "Proposed use-case examples in this review were not implemented as a production workflow." ], "sources": [ { "label": "Contrast checker and threshold explanation", "url": "https://webaim.org/resources/contrastchecker/" }, { "label": "WebAIM institutional background", "url": "https://webaim.org/about/" } ] } }, { "id": "govuk-design-system", "title": "GOV.UK Design System", "url": "https://design-system.service.gov.uk/", "category": "Design systems", "kind": "Service design patterns and frontend components", "summary": "A detailed reference for forms and service journeys where clear instructions, errors and recovery matter more than novelty.", "whatItIs": "GOV.UK Design System brings together styles, components and task patterns maintained by the Government Digital Service. Its value extends beyond a set of buttons: the guidance explains the situations a component supports and the content decisions around it. Teams outside government can learn from those decisions while keeping their own identity and user research.", "whenUseful": "Use it for applications, eligibility questions, addresses, account steps and other form-heavy services. It is a strong reference when a team keeps redesigning the same validation and instruction patterns without recording why.", "example": "For a support request with a genuine 200-character constraint, prototype the character-count pattern with a clear hint and error message. Test a short entry, exactly 200 characters and an over-limit entry, then check that the server rejects invalid submissions without losing what the person typed.", "expectedResult": "A form pattern with an explained limit, readable feedback and a recovery path that survives both client-side and server-side validation.", "cautions": [ "Use a character limit only when the service has a reason for it. A counter does not make an arbitrary restriction helpful.", "The public character counter permits over-limit typing and changes its feedback. It is not a substitute for backend validation, and silently truncating a person’s input would change that behavior.", "Check the terms for code, content, fonts and government branding separately. Reusing a pattern should not imply that an unrelated service is an official government service.", "A design-system component still needs testing in your content, templates, language and service journey." ], "requirements": [ "HTML/CSS/JavaScript integration or the documented template tooling for the components you choose.", "A supported, pinned GOV.UK Frontend version and a plan to review release notes when updating.", "Service-specific content, validation rules and user research." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included — 2026-10-19: this is the official GDS-maintained design system. Its homepage announced GOV.UK Frontend v6.6.0 on 15 October 2026, including character-count improvements; that is a dated maintenance signal, not evidence of trending growth.", "The public character-count example was checked with 15 and 205 characters. The hosted example was not independently tied to a package build, and no production service or backend was tested." ], "sources": [ { "label": "Official design system", "url": "https://design-system.service.gov.uk/" }, { "label": "Character count guidance", "url": "https://design-system.service.gov.uk/components/character-count/" }, { "label": "Public character-count example", "url": "https://design-system.service.gov.uk/components/character-count/default/index.html" }, { "label": "GOV.UK Frontend repository", "url": "https://github.com/alphagov/govuk-frontend" }, { "label": "v6.6.0 release", "url": "https://github.com/alphagov/govuk-frontend/releases/tag/v6.6.0" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The public 200-character example reported the correct remaining and excess counts and preserved an over-limit value. No form submission or backend validation was exercised.", "reportUrl": "/design-evaluations/resource-govuk-design-system.json", "identity": { "target": "https://design-system.service.gov.uk/components/character-count/default/index.html", "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.", "integrity": "Recorded document SHA-256 387d07b0f08b718668941ecaf11604412d91962b8f425fca57552beb42f66235. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service." }, "environment": [ "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.", "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.", "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence." ], "tests": [ { "name": "Public document response", "mode": "http", "method": "Navigate to the recorded public target in a fresh anonymous browser.", "result": "pass", "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 387d07b0f08b718668941ecaf11604412d91962b8f425fca57552beb42f66235; this fingerprints only the recorded HTML response." }, { "name": "Within-limit counter", "mode": "browser", "method": "Type the 15-character synthetic string “Synthetic note.” into the default public textarea.", "result": "pass", "observation": "The value length was 15 and the visible feedback reported 185 characters remaining." }, { "name": "Over-limit feedback without truncation", "mode": "browser", "method": "Replace the value with 205 synthetic x characters and leave the field.", "result": "pass", "observation": "All 205 characters remained. The feedback reported 5 characters too many and the textarea received its error class." }, { "name": "Primary-source scope review", "mode": "source-review", "method": "Read the official pages and relevant repository or standard references linked below.", "result": "pass", "observation": "Reviewed character-count use guidance and the official v6.6.0 release announcement. The hosted demo’s exact package build was not independently established." }, { "name": "Broader workflow and assurance coverage", "mode": "browser", "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.", "result": "not-run", "observation": "No server-side validation, submission, screen-reader announcement, other component variant, non-Latin length rule or installation was tested." } ], "security": { "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.", "findings": [ { "level": "info", "basis": "observed", "title": "No service submission in the sample", "detail": "The isolated example requested only the design-system origin. No non-GET request or page error was observed, and the synthetic text was never submitted to a service endpoint." }, { "level": "caution", "basis": "observed", "title": "Frontend counters are not enforcement", "detail": "The sample deliberately retained 205 characters despite a 200-character limit. Enforce service constraints on the server as well as providing usable client-side feedback." }, { "level": "caution", "basis": "advice", "title": "Treat real service data separately", "detail": "Do not paste personal applications or case histories into public examples. Integrate and test the component in the approved service environment before using real data." } ], "limits": [ "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.", "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling." ] }, "practicalCaveats": [ "Choose a justified limit and explain it before the user starts typing.", "Preserve entered text on error and test the same rule in the backend; this counter alone cannot establish that behavior." ], "limits": [ "No server-side validation, submission, screen-reader announcement, other component variant, non-Latin length rule or installation was tested.", "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.", "Proposed use-case examples in this review were not implemented as a production workflow." ], "sources": [ { "label": "Official design system", "url": "https://design-system.service.gov.uk/" }, { "label": "Character count guidance", "url": "https://design-system.service.gov.uk/components/character-count/" }, { "label": "Public character-count example", "url": "https://design-system.service.gov.uk/components/character-count/default/index.html" }, { "label": "GOV.UK Frontend repository", "url": "https://github.com/alphagov/govuk-frontend" }, { "label": "v6.6.0 release", "url": "https://github.com/alphagov/govuk-frontend/releases/tag/v6.6.0" } ] } }, { "id": "carbon-design-system", "title": "Carbon Design System", "url": "https://www.carbondesignsystem.com/", "category": "Design systems", "kind": "Enterprise design system and React components", "summary": "IBM’s design-system foundation for coherent product interfaces, with guidance that explains when a component earns its place.", "whatItIs": "Carbon combines IBM’s visual language with component guidance, implementation packages and interactive examples. It is particularly relevant to products with dense information and repeated interactions across many screens. The documentation is useful even before adoption because it gives teams a shared vocabulary for behavior, structure and exceptions.", "whenUseful": "Use it when several teams need compatible tables, forms, navigation and disclosure patterns in an enterprise product. It can also serve as a review reference when a custom component has attractive styling but unclear keyboard behavior.", "example": "Build a settings page where optional deployment details live in an accordion while the required save action remains visible. Start with Carbon’s disclosure behavior, name each section by its contents, and test opening and closing it with Enter and Space before adding application-specific styles.", "expectedResult": "A consistent disclosure pattern with visible state, keyboard operation and essential information available without guessing which panel to open.", "cautions": [ "An accordion hides content. Keep instructions that everyone must read and critical errors visible instead of compressing the whole page by default.", "A successful React demo is not proof that a customized application preserves the same semantics, focus behavior or contrast.", "Current documentation discusses several libraries and future work. Pin the package and API you actually adopt rather than mixing examples from different versions.", "Review dependencies and component changes as part of the application’s normal maintenance process; the design-system name is not a security guarantee." ], "requirements": [ "A compatible application stack for the selected Carbon package; the sampled implementation was React.", "Time to map product needs to tokens, components and content guidance.", "Application-level accessibility and regression tests after customization." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included — 2026-10-19: Carbon is IBM’s design system, and its official repository had 9,562 stars and 2,293 forks in the GitHub API snapshot. The accordion guidance was marked updated 9 September 2026; these are authority, adoption and maintenance signals, not a measured growth ranking.", "One public React accordion demo was exercised with Enter and Space. No package was installed, and no claim is made about all Carbon components or a particular application." ], "sources": [ { "label": "Carbon design system", "url": "https://www.carbondesignsystem.com/" }, { "label": "Accordion guidance", "url": "https://www.carbondesignsystem.com/building-blocks/core/components/accordion/guidelines" }, { "label": "Public React accordion demo", "url": "https://react.carbondesignsystem.com/iframe.html?id=components-accordion--default&globals=theme:white" }, { "label": "Official repository", "url": "https://github.com/carbon-design-system/carbon" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "A public React accordion opened with Enter and closed with Space while its expanded state and visible content stayed aligned. This covers one default demo in one browser.", "reportUrl": "/design-evaluations/resource-carbon-design-system.json", "identity": { "target": "https://react.carbondesignsystem.com/iframe.html?id=components-accordion--default&globals=theme:white", "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.", "integrity": "Recorded document SHA-256 c18b96285d72f81918cf621af9d4c597ea3a7ddd7ca194c2283d785ef5e0102a. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service." }, "environment": [ "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.", "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.", "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence." ], "tests": [ { "name": "Public document response", "mode": "http", "method": "Navigate to the recorded public target in a fresh anonymous browser.", "result": "pass", "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was c18b96285d72f81918cf621af9d4c597ea3a7ddd7ca194c2283d785ef5e0102a; this fingerprints only the recorded HTML response." }, { "name": "Accordion keyboard operation", "mode": "browser", "method": "Focus the first button in the public default React accordion; press Enter, then Space.", "result": "pass", "observation": "The “Choose your plan” button changed aria-expanded false → true → false. Its supporting content appeared and disappeared, and focus remained on the button." }, { "name": "Primary-source scope review", "mode": "source-review", "method": "Read the official pages and relevant repository or standard references linked below.", "result": "pass", "observation": "Reviewed IBM’s design-system overview, the dated accordion guidance and the official repository metadata. No package or installed dependency graph was evaluated." }, { "name": "Broader workflow and assurance coverage", "mode": "browser", "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.", "result": "not-run", "observation": "No package installation, full Storybook sweep, screen-reader test, employee login or application data flow was performed." } ], "security": { "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.", "findings": [ { "level": "info", "basis": "observed", "title": "Isolated demo request surface", "detail": "The standalone accordion sample requested only react.carbondesignsystem.com. No non-GET request, HTTP error or page error was observed during its toggle. The main documentation site has a different request surface." }, { "level": "caution", "basis": "advice", "title": "Disclosure is not authorization", "detail": "Collapsing a panel hides presentation; it must not be used to protect information the current user is not allowed to receive. Apply authorization before rendering or returning sensitive content." }, { "level": "caution", "basis": "advice", "title": "Review the installed implementation", "detail": "The public Storybook sample does not establish the security of your dependency versions, custom handlers or server data. Pin and review the components you ship." } ], "limits": [ "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.", "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling." ] }, "practicalCaveats": [ "Keep essential instructions and blocking errors discoverable outside optional collapsed sections.", "After styling or adding content, retest state, focus, long labels and keyboard operation in the integrated page." ], "limits": [ "No package installation, full Storybook sweep, screen-reader test, employee login or application data flow was performed.", "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.", "Proposed use-case examples in this review were not implemented as a production workflow." ], "sources": [ { "label": "Carbon design system", "url": "https://www.carbondesignsystem.com/" }, { "label": "Accordion guidance", "url": "https://www.carbondesignsystem.com/building-blocks/core/components/accordion/guidelines" }, { "label": "Public React accordion demo", "url": "https://react.carbondesignsystem.com/iframe.html?id=components-accordion--default&globals=theme:white" }, { "label": "Official repository", "url": "https://github.com/carbon-design-system/carbon" } ] } }, { "id": "coolors", "title": "Coolors", "url": "https://coolors.co/", "category": "Color & backgrounds", "kind": "Palette generator and color exploration tools", "summary": "A fast way to explore a color direction, provided the chosen palette gets a second pass as an actual interface.", "whatItIs": "Coolors is a browser-based collection of palette generation and color exploration tools. Its generator makes it easy to compare sets of colors quickly, while the wider product offers palette browsing and other color workflows. A good palette is raw material: the team still needs to assign colors to text, surfaces, actions and states.", "whenUseful": "Use it at the beginning of a visual direction or when a fixed brand color needs supporting neutrals and accents. It is most useful for generating candidates that can then be evaluated in realistic UI content.", "example": "Generate a five-color candidate for a workshop registration page, then assign a neutral background, text color and primary action color. Test those actual pairs in a contrast checker and compare the page with success, error and disabled states before approving the palette.", "expectedResult": "A short palette with named interface roles and a list of approved contrast pairs, rather than five attractive swatches with no usage rules.", "cautions": [ "Rapid palette changes can be visually intense. The generator’s welcome screen includes a warning about flashing colors; avoid repeated rapid generation if that is unsuitable for you.", "The public generator loads advertising, analytics and other third-party resources. Account-free use does not mean the page makes no external requests.", "A generated palette does not establish accessible text or reliable status communication. Check each assigned pair and avoid using color as the only status cue.", "Saving, account features, paid access and image-based workflows were outside this review. Confirm the current feature boundaries before building a workflow around them." ], "requirements": [ "A modern browser for the public generator.", "A separate contrast and interface review after choosing colors.", "Permission to use any images or other materials you later introduce; this review used no uploads." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included — 2026-10-19: the publisher’s current homepage claims use by more than eight million creative users and offers more than ten million palettes to explore. These are publisher-reported scale claims, not independently audited users or verified trend growth.", "The public generator produced a new five-color palette using Space under a GET/HEAD-only guard. Initial text-fetch access failed, but a fresh anonymous browser reached the homepage and generator successfully." ], "sources": [ { "label": "Product and publisher-reported scale", "url": "https://coolors.co/" }, { "label": "Public palette generator", "url": "https://coolors.co/generate" }, { "label": "Privacy policy", "url": "https://coolors.co/privacy-policy", "scope": "Publisher-linked policy destination; text retrieval returned 403 in this pass, so policy contents were not reviewed." } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The public generator produced a different five-color palette when Space was pressed. Hosted advertising and analytics requests were present, and non-GET requests were blocked throughout.", "reportUrl": "/design-evaluations/resource-coolors.json", "identity": { "target": "https://coolors.co/generate", "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.", "integrity": "Recorded document SHA-256 6c596bcd87ddb8c94e10143eacbbc2716cefe320815560c2927bdeb34f5d2ed7. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service." }, "environment": [ "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.", "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.", "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence." ], "tests": [ { "name": "Public document response", "mode": "http", "method": "Navigate to the recorded public target in a fresh anonymous browser.", "result": "pass", "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 6c596bcd87ddb8c94e10143eacbbc2716cefe320815560c2927bdeb34f5d2ed7; this fingerprints only the recorded HTML response." }, { "name": "Generate a palette", "mode": "browser", "method": "Dismiss the welcome and tutorial overlays, focus the page and press Space once.", "result": "pass", "observation": "The five-color URL changed from 393d3f-d5bbb1-9cc4b2-c98ca7-e76d83 to c4bbb8-f5b0cb-dc6acf-745c97-39375b. All five resulting codes appeared in the page, and the tutorial was no longer visible." }, { "name": "Primary-source scope review", "mode": "source-review", "method": "Read the official pages and relevant repository or standard references linked below.", "result": "pass", "observation": "The fresh browser reached the product homepage and recorded its publisher-reported scale claim. A text-fetch attempt failed earlier; that access difference does not contradict the successful browser sample." }, { "name": "Broader workflow and assurance coverage", "mode": "browser", "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.", "result": "not-run", "observation": "Palette locking, image extraction, AI functions, saved projects, account permissions, payments and downloaded exports were not tested." } ], "security": { "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.", "findings": [ { "level": "caution", "basis": "observed", "title": "Third-party hosted surface", "detail": "The final generator sample requested 16 origins including advertising, analytics, authentication assets and CDNs. Seven POST requests, including analytics and challenge traffic, were blocked. Account-free operation is not evidence of zero tracking." }, { "level": "caution", "basis": "observed", "title": "Rapid color changes carry a warning", "detail": "The welcome screen displayed a warning about flashing colors and photosensitive seizures. This sample generated one palette; no rapid flashing or photosensitivity assessment was performed." }, { "level": "caution", "basis": "advice", "title": "Uploads and accounts have separate risks", "detail": "This review used no images, credentials or saved palettes. Inspect the relevant privacy and retention terms before using image extraction or account storage with business materials." } ], "limits": [ "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.", "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling." ] }, "practicalCaveats": [ "Generate slowly enough to compare deliberate candidates; the tool’s own warning makes rapid repeated changes unsuitable for some people.", "Assign semantic roles and run pair-specific contrast checks before using the palette in a product." ], "limits": [ "Palette locking, image extraction, AI functions, saved projects, account permissions, payments and downloaded exports were not tested.", "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.", "Proposed use-case examples in this review were not implemented as a production workflow.", "The publisher-linked privacy policy was not retrievable through the text-fetch path; no retention or privacy-policy assurance is made." ], "sources": [ { "label": "Product and publisher-reported scale", "url": "https://coolors.co/" }, { "label": "Public palette generator", "url": "https://coolors.co/generate" }, { "label": "Privacy policy", "url": "https://coolors.co/privacy-policy", "scope": "Publisher-linked policy destination; text retrieval returned 403 in this pass, so policy contents were not reviewed." } ] } }, { "id": "realtime-colors", "title": "Realtime Colors", "url": "https://www.realtimecolors.com/", "category": "Color & backgrounds", "kind": "Live color and typography preview", "summary": "See a palette in page context, then export its color roles for a more useful design handoff.", "whatItIs": "Realtime Colors applies text, background, primary, secondary and accent colors to an example website as you work. It also exposes typography controls and export formats, so the output can become the start of a token discussion. The example page supplies context for comparison; it is not a tested replacement for your own product’s content and states.", "whenUseful": "Use it when a palette looks convincing in isolation but a team cannot picture its distribution across headings, buttons and surfaces. It is also helpful for explaining the difference between a collection of colors and a set of assigned UI roles.", "example": "Set a proposed primary action color to #1E40AF, keep a light background and inspect headings, buttons and supporting surfaces together. Export the CSS variables, then map them to your application’s semantic tokens and separately test focus, error and disabled states.", "expectedResult": "A reviewable palette in context and a small CSS starting point, with explicit work remaining for semantic tokens and accessibility.", "cautions": [ "The page’s pricing cards and testimonials are explicitly demonstration content. They should not be read as verified customer evidence or actual plan details.", "The publisher permits use of generated colors, while the repository’s website code and materials carry a CC BY-NC-ND license. Do not treat palette export as permission to clone or relicense the website.", "Check contrast with the actual text size, background and component state. A simple status light is not a complete readability or accessibility assessment.", "Share links include palette and font choices in their URL. Treat those links as public design references and keep confidential information out of inputs." ], "requirements": [ "A browser for the public preview.", "A CSS or design-token workflow if you want to use the exported values.", "Separate review of font permissions and the final application’s accessibility." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included — 2026-10-19: the homepage reports more than 300,000 users, and the linked repository had 935 stars in the GitHub API snapshot. The user count is a publisher claim; neither signal establishes current trend growth, and the repository’s last push was dated 3 October 2023.", "Changing the visible primary HEX field updated the CSS variable and share URL; the CSS export displayed the chosen value. The Figma plugin, font installation, file downloads and other exports were not tested." ], "sources": [ { "label": "Live preview, feature explanation and publisher-reported use", "url": "https://www.realtimecolors.com/" }, { "label": "Project documentation", "url": "https://www.realtimecolors.com/docs/about-realtime-colors" }, { "label": "Official linked repository", "url": "https://github.com/juxtopposed/realtimecolors" }, { "label": "Website-code license", "url": "https://github.com/juxtopposed/realtimecolors/blob/main/LICENSE.md" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "A synthetic primary color changed the visible picker value, CSS variable and share URL; the CSS export displayed the same value. The tool still made third-party requests under the account-free guard.", "reportUrl": "/design-evaluations/resource-realtime-colors.json", "identity": { "target": "https://www.realtimecolors.com/", "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.", "integrity": "Recorded document SHA-256 13d027c8f2249e33ced4d1453f608b0dd12654887bc4138881f6c7354db61824. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service." }, "environment": [ "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.", "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.", "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence." ], "tests": [ { "name": "Public document response", "mode": "http", "method": "Navigate to the recorded public target in a fresh anonymous browser.", "result": "pass", "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 13d027c8f2249e33ced4d1453f608b0dd12654887bc4138881f6c7354db61824; this fingerprints only the recorded HTML response." }, { "name": "Change the primary role", "mode": "browser", "method": "Open the visible Primary picker and enter #1e40af in its HEX field.", "result": "pass", "observation": "The primary value and --primary CSS variable became #1e40af, and the palette share URL changed to include 1e40af." }, { "name": "Inspect CSS export", "mode": "browser", "method": "Open the export panel with Ctrl+E after the color change.", "result": "pass", "observation": "The visible CSS output included --primary: #1e40af; alongside the other four role values. No download or clipboard read was performed." }, { "name": "Primary-source scope review", "mode": "source-review", "method": "Read the official pages and relevant repository or standard references linked below.", "result": "pass", "observation": "Reviewed the role-based preview, publisher-reported use, documentation and the website repository’s CC BY-NC-ND license. Generated colors and website source reuse were treated as separate scopes." }, { "name": "Broader workflow and assurance coverage", "mode": "browser", "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.", "result": "not-run", "observation": "No plugin, local font installation, downloaded archive, full contrast-engine validation, account workflow or repository execution was tested. Initial attempts targeted a hidden input; the final check used the visible HEX control." } ], "security": { "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.", "findings": [ { "level": "caution", "basis": "observed", "title": "Network activity despite account-free editing", "detail": "The confirmed sample requested 10 origins, including Google font/tag resources and other services. Two analytics POST requests were blocked. The footer’s no-cookies wording should not be read as no external network activity." }, { "level": "caution", "basis": "observed", "title": "Share URLs expose design choices", "detail": "The chosen synthetic color appeared in the URL’s colors parameter. Shared links therefore reveal those palette choices and may be retained in browser or service logs." }, { "level": "caution", "basis": "documented", "title": "Palette export and code reuse differ", "detail": "The website FAQ permits generated color use, while its linked website-code license is CC BY-NC-ND. Review the actual material and terms before copying or republishing site code." } ], "limits": [ "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.", "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling." ] }, "practicalCaveats": [ "Use the exported values as a starting point for semantic tokens and separately test application states.", "The generic pricing and imaginary testimonial sections are visual samples, not product-plan or customer-evidence sources." ], "limits": [ "No plugin, local font installation, downloaded archive, full contrast-engine validation, account workflow or repository execution was tested. Initial attempts targeted a hidden input; the final check used the visible HEX control.", "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.", "Proposed use-case examples in this review were not implemented as a production workflow." ], "sources": [ { "label": "Live preview, feature explanation and publisher-reported use", "url": "https://www.realtimecolors.com/" }, { "label": "Project documentation", "url": "https://www.realtimecolors.com/docs/about-realtime-colors" }, { "label": "Official linked repository", "url": "https://github.com/juxtopposed/realtimecolors" }, { "label": "Website-code license", "url": "https://github.com/juxtopposed/realtimecolors/blob/main/LICENSE.md" } ] } }, { "id": "inclusive-components", "title": "Inclusive Components", "url": "https://inclusive-components.design/", "category": "Evidence", "kind": "Accessible interaction pattern essays", "summary": "An explanation-first reference for understanding the semantics and keyboard decisions inside familiar interface patterns.", "whatItIs": "Inclusive Components is Heydon Pickering’s collection of long-form articles about interface patterns and inclusive design. Each article works through the reasoning behind a component rather than offering only a visual snippet. That makes it useful when a team needs to understand why a disclosure, tab or menu behaves the way it does.", "whenUseful": "Use it during component design reviews or when training developers to question the semantics hidden behind a styled control. It is particularly helpful when the team can implement a pattern but cannot yet explain its keyboard and assistive-technology behavior.", "example": "Review the collapsible-sections article before designing an optional details area in a policy page. Write down the heading, native button, expanded state and content-visibility requirements, then implement a small prototype and test keyboard operation and the no-JavaScript reading order.", "expectedResult": "A component decision record that connects behavior to user needs, followed by a tested implementation in the current application.", "cautions": [ "The reviewed collapsible-sections article dates to 2017. Recheck browser support and current platform options before adopting historical compatibility workarounds.", "An explanatory pattern is not a conformance certificate. Test the resulting implementation with current browsers, assistive technology and real content.", "Embedded demonstrations depend on CodePen. In this review they returned access challenges, so the article’s proposed behavior was not verified in the live demo.", "Keep public learning examples separate from confidential content, and review the applicable terms before republishing article text or code." ], "requirements": [ "Time to read the reasoning, not just copy the final snippet.", "HTML, CSS and JavaScript knowledge to adapt a pattern responsibly.", "A local prototype and an accessibility test plan for the chosen current implementation." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included — 2026-10-19: this is an established authored pattern reference by Heydon Pickering, with dated public component essays and a linked book. Its inclusion is based on explicit interaction reasoning and a long-running reference body, not a claim that it is newly trending.", "The project and collapsible-sections explanation were reviewed. The article returned HTTP 200, while four embedded demos returned HTTP 403 and a direct embed check showed a challenge page; runtime coverage remains limited." ], "sources": [ { "label": "Pattern article collection", "url": "https://inclusive-components.design/" }, { "label": "Author and project background", "url": "https://inclusive-components.design/about-the-project/" }, { "label": "Collapsible sections, published 26 October 2017", "url": "https://inclusive-components.design/collapsible-sections/" }, { "label": "Linked public CodePen example", "url": "https://codepen.io/heydon/pen/QqzRvQ/", "scope": "Example destination; its embedded runtime was blocked in this review." } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser", "source-review" ], "summary": "The article and its component reasoning were reviewed, but its public CodePen examples did not render in the account-free session. No working component interaction is claimed.", "reportUrl": "/design-evaluations/resource-inclusive-components.json", "identity": { "target": "https://inclusive-components.design/collapsible-sections/", "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.", "integrity": "Recorded document SHA-256 4791e6f714d443268a46ea9fc5acacade04039427ee41da402a2a584beaf2cc3. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service." }, "environment": [ "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.", "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.", "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence." ], "tests": [ { "name": "Public document response", "mode": "http", "method": "Navigate to the recorded public target in a fresh anonymous browser.", "result": "pass", "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 4791e6f714d443268a46ea9fc5acacade04039427ee41da402a2a584beaf2cc3; this fingerprints only the recorded HTML response." }, { "name": "Access linked public examples", "mode": "browser", "method": "Load the collapsible-sections article and scroll to its embedded demonstrations; also open the first embed directly.", "result": "blocked", "observation": "The article returned 200, but all four embed requests returned 403. The direct embed showed a challenge page; challenge POST requests remained blocked." }, { "name": "Primary-source scope review", "mode": "source-review", "method": "Read the official pages and relevant repository or standard references linked below.", "result": "pass", "observation": "Reviewed the author/project background and the 2017 collapsible-sections article. Its button, expanded-state and progressive-enhancement reasoning was read, not runtime-validated." }, { "name": "Broader workflow and assurance coverage", "mode": "browser", "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.", "result": "not-run", "observation": "No live disclosure toggle, local reproduction, screen-reader interaction, purchased book content or site-wide pattern audit was executed." } ], "security": { "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.", "findings": [ { "level": "caution", "basis": "observed", "title": "Embedded host is a separate trust boundary", "detail": "The public article requested Google fonts and four CodePen examples. Those examples were inaccessible in this session. A working article page does not establish the availability or behavior of its external demos." }, { "level": "info", "basis": "observed", "title": "Access controls were preserved", "detail": "The direct CodePen embed returned a challenge page. No account, challenge bypass or non-GET request was used to try to obtain the demo." }, { "level": "caution", "basis": "advice", "title": "Review code in current context", "detail": "Treat historical example code as material to understand and review before use. Recheck current platform behavior, sanitize application data and avoid inserting untrusted content into markup merely because an educational example uses static labels." } ], "limits": [ "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.", "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling." ] }, "practicalCaveats": [ "Use the article to write behavioral requirements, then test your own current implementation.", "The date matters: historical browser workarounds and present-day native alternatives should be reviewed before copying a pattern." ], "limits": [ "No live disclosure toggle, local reproduction, screen-reader interaction, purchased book content or site-wide pattern audit was executed.", "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.", "Proposed use-case examples in this review were not implemented as a production workflow." ], "sources": [ { "label": "Pattern article collection", "url": "https://inclusive-components.design/" }, { "label": "Author and project background", "url": "https://inclusive-components.design/about-the-project/" }, { "label": "Collapsible sections, published 26 October 2017", "url": "https://inclusive-components.design/collapsible-sections/" }, { "label": "Linked public CodePen example", "url": "https://codepen.io/heydon/pen/QqzRvQ/", "scope": "Example destination; its embedded runtime was blocked in this review." } ] } }, { "id": "kibo-ui", "title": "Kibo UI", "url": "https://www.kibo-ui.com/", "category": "Components", "kind": "Composable shadcn/ui component registry", "summary": "Higher-level React components for teams that already use shadcn/ui and need more than basic controls.", "whatItIs": "Kibo UI provides a registry of composable components built for the shadcn/ui ecosystem. Its catalog includes richer product interactions such as comboboxes, calendars and project-management views. Adding one can save assembly work, but the copied code and any additional dependencies become part of the application you maintain.", "whenUseful": "Use it when an existing React and shadcn/ui product needs a specific richer interaction and the team is prepared to inspect its implementation. It is a better fit for deliberate component selection than for installing a whole catalog without a use case.", "example": "Prototype a searchable environment selector with a small synthetic list such as Development, Staging and Production. Start from the combobox pattern, verify search and keyboard selection, then add an explicit label and enforce permitted values on the server before connecting it to deployment controls.", "expectedResult": "A usable selection control with an understood dependency footprint and an application-owned authorization boundary.", "cautions": [ "The setup workflow adds code and required dependencies. Review the selected component, package versions and resulting changes before accepting an install command.", "A rich demo is not a backend. Upload handling, permissions, validation, collaboration and persistence need their own implementation and testing.", "The setup documentation gives minimum versions; use a currently supported runtime and confirm compatibility instead of treating an old minimum as a security recommendation.", "A component advertised as accessible still needs labels, content and behavior testing in the surrounding product." ], "requirements": [ "A compatible React application with shadcn/ui initialized and Tailwind configured.", "The CSS Variables theming mode described in Kibo’s setup guide.", "Time to review added dependencies and maintain copied component code." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included — 2026-10-19: the current official repository is shadcnblocks/kibo; its GitHub API snapshot showed 3,966 stars and 180 forks. The last push was dated 4 May 2026, so this review treats it as an established-interest catalog addition and does not claim fresh release activity or verified trend growth.", "One public combobox was searched and selected by keyboard, then reopened and dismissed with Escape. No CLI, dependency installation, file upload, account or backend workflow was run." ], "sources": [ { "label": "Product and component catalog", "url": "https://www.kibo-ui.com/" }, { "label": "Setup requirements", "url": "https://www.kibo-ui.com/docs/setup" }, { "label": "Public combobox examples", "url": "https://www.kibo-ui.com/components/combobox" }, { "label": "Current official repository", "url": "https://github.com/shadcnblocks/kibo" } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The public combobox filtered to SvelteKit, selected it by keyboard, and returned focus after Escape closed the reopened popup. No registry installer, backend or application package was run.", "reportUrl": "/design-evaluations/resource-kibo-ui.json", "identity": { "target": "https://www.kibo-ui.com/components/combobox", "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.", "integrity": "Recorded document SHA-256 ee015e8d22cdbf2ae69fba17591d90e76882a8a2bdb3326c2b943273712b9b3f. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service." }, "environment": [ "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.", "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.", "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence." ], "tests": [ { "name": "Public document response", "mode": "http", "method": "Navigate to the recorded public target in a fresh anonymous browser.", "result": "pass", "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was ee015e8d22cdbf2ae69fba17591d90e76882a8a2bdb3326c2b943273712b9b3f; this fingerprints only the recorded HTML response." }, { "name": "Keyboard search and selection", "mode": "browser", "method": "Open the first framework picker with Enter; type Svelte, then use ArrowDown and Enter on the filtered list.", "result": "pass", "observation": "The filtered list contained SvelteKit. The same trigger changed its label to SvelteKit and reported aria-expanded=false after selection." }, { "name": "Escape and focus return", "mode": "browser", "method": "Reopen the selected picker, press Escape and inspect focus after the close transition settled.", "result": "pass", "observation": "The popup closed and aria-expanded returned false. After 350 ms, focus was back on the same trigger." }, { "name": "Primary-source scope review", "mode": "source-review", "method": "Read the official pages and relevant repository or standard references linked below.", "result": "pass", "observation": "Reviewed the current official repository, documented setup requirements and combobox examples. Repository metadata establishes current identity and a dated interest snapshot, not security or trend growth." }, { "name": "Broader workflow and assurance coverage", "mode": "browser", "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.", "result": "not-run", "observation": "No CLI, dependency installation, upload, editor persistence, collaborative service, server validation, screen reader or authenticated workflow was tested. Early selector and immediate-focus probes were superseded by the stable-element check after the close transition." } ], "security": { "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.", "findings": [ { "level": "info", "basis": "observed", "title": "Public demo and external resources", "detail": "The sample requested four origins, including Plausible and third-party image/CDN hosts. No non-GET request or page error was recorded. One external avatar request returned 404 without preventing the control checks." }, { "level": "caution", "basis": "documented", "title": "Installation changes your project", "detail": "Kibo’s setup guide says its CLI or shadcn workflow adds component code and required dependencies. That is a code and dependency review boundary; the hosted demo does not establish those downloads’ safety." }, { "level": "caution", "basis": "advice", "title": "Selection is not permission", "detail": "Client-side filtering and selection do not authorize a deployment, account change or other sensitive action. Validate the chosen value and the caller’s permissions on the server before using it." } ], "limits": [ "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.", "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling." ] }, "practicalCaveats": [ "Choose a single component for a real use case, inspect its dependencies and keep its code maintainable.", "Retest naming, focus and keyboard behavior with your actual content and validation; this pass covers one default combobox only." ], "limits": [ "No CLI, dependency installation, upload, editor persistence, collaborative service, server validation, screen reader or authenticated workflow was tested. Early selector and immediate-focus probes were superseded by the stable-element check after the close transition.", "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.", "Proposed use-case examples in this review were not implemented as a production workflow." ], "sources": [ { "label": "Product and component catalog", "url": "https://www.kibo-ui.com/" }, { "label": "Setup requirements", "url": "https://www.kibo-ui.com/docs/setup" }, { "label": "Public combobox examples", "url": "https://www.kibo-ui.com/components/combobox" }, { "label": "Current official repository", "url": "https://github.com/shadcnblocks/kibo" } ] } }, { "id": "transitions-dev", "title": "transitions.dev", "url": "https://transitions.dev/", "category": "Motion & effects", "kind": "Transition library and motion tooling", "summary": "Study a small UI motion, try its behavior, and decide whether it helps the task before adding it to your interface.", "whatItIs": "A public collection of CSS transition examples, with optional React snippets, agent skills and motion tooling. The library is useful as a motion reference on its own. The code-editing agent, component builder and Refine workflow have separate execution, account and licensing considerations.", "whenUseful": "Use it when a state change needs to be understandable: a panel opening, an action completing or a control changing size. Start with the transition that explains the change. A decorative effect still needs a reason to be there.", "example": "Prototype a review queue where opening an item expands a compact summary into its details. Compare the resize motion with an immediate state change using synthetic records. Keep focus on the activated item, preserve scroll position, and provide a reduced-motion version. Ask reviewers to find the next action in both versions.", "expectedResult": "Two comparable prototypes and a short decision record: whether the motion helps people follow the state change, what it costs on a slower device, and how reduced motion behaves. This is a proposed application, not a measured usability result.", "cautions": [ "The transition collection has its own license. Do not assume the MIT tooling license permits repackaging the library; check template, redistribution and paid-feature terms for your use.", "Motion snippets do not supply complete dialog semantics, keyboard behavior or focus management. Keep those responsibilities in the component.", "Optional agent and Refine tools can change project files and consume model quota. Review their exact version and permissions before running them against a repository." ], "requirements": [ "A browser for the public examples; HTML/CSS knowledge to adapt a transition. React is optional for applicable snippets.", "A component with defined states, a reduced-motion alternative and time to test real content and keyboard behavior.", "Additional setup, access or payment may apply to Pro content, hosted generation and agent workflows; those paths were not exercised." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included: the GitHub weekly HTML trending page observed on 19 October 2026 listed this repository with 571 stars gained that week. That platform snapshot supports a dated activity claim, not quality, adoption or safety.", "The live homepage, publisher README and terms establish identity and separate the reference library from optional automation. We exercised the public filter and one resize sample, not installed skills or code-editing tools.", "Repository metadata and commit API requests returned 5xx responses during evidence collection. The public site, README and license remained available; no exact installed commit or package execution is claimed." ], "sources": [ { "label": "Publisher repository", "url": "https://github.com/Jakubantalik/transitions.dev", "scope": "Product identity, CSS library, optional CLI/skill/Refine paths; source reviewed, tools not installed." }, { "label": "Public transition library", "url": "https://transitions.dev/", "scope": "Account-free filter and Card resize interaction." }, { "label": "Publisher terms and license", "url": "https://transitions.dev/terms.html", "scope": "Library redistribution restrictions and separate tooling, hosted and agent scopes; reviewed 19 October 2026." }, { "label": "GitHub weekly HTML trending list", "url": "https://github.com/trending/html?since=weekly", "scope": "Observed 19 October 2026: transitions.dev listed with 571 stars this week. Dynamic list, not a permanent ranking." } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "checked", "modes": [ "http", "browser", "source-review" ], "summary": "The public category filter and one resize animation passed bounded browser checks. Optional automation, Pro content and generated components remain untested.", "reportUrl": "/design-evaluations/resource-transitions-dev.json", "identity": { "target": "https://transitions.dev/", "version": "Public website snapshot observed 19 October 2026; no installed package version was evaluated.", "integrity": "SHA-256 of the observed main-document response: 468bf67e60992f80915d4eb3329ea6ce50a3d812b3892e69caf3afd3c066a575. This identifies one response, not all loaded assets or a reproducible SDK build." }, "environment": [ "Fresh Chromium 155.0.8059.82 context; 1280 by 900 viewport; no account or retained browser storage.", "Only approved public HTTPS hosts and GET/HEAD requests allowed. Authentication/API paths, telemetry, writes, service workers and WebSockets blocked; no downloads accepted." ], "tests": [ { "name": "Public response", "mode": "http", "method": "Read the public landing page and selected response headers without authentication.", "result": "pass", "observation": "HTTP 200 at https://transitions.dev/. Reachability does not establish product functionality." }, { "name": "Filter and restore", "mode": "browser", "method": "Select Effects, inspect visible card categories, then restore All.", "result": "pass", "observation": "The initial three cards changed to three Effects cards, all tagged effects, then returned to the original three titles." }, { "name": "Resize sample and restore", "mode": "browser", "method": "Activate the visible Card resize sample and compare settled dimensions; activate again to restore.", "result": "pass", "observation": "The sample changed from 220 by 112 CSS pixels to 154 by 128, then returned to 220 by 112 after the second activation." }, { "name": "Source and trend cross-check", "mode": "source-review", "method": "Compare the publisher site, README, terms and fresh GitHub weekly listing.", "result": "pass", "observation": "Identity and separate tool/library scopes agreed; the weekly listing reported 571 stars this week on the observation date." }, { "name": "Automation and paid workflows", "mode": "source-review", "method": "Keep CLI installation, agent edits, hosted generation and Pro access outside the account-free browser scope.", "result": "not-run", "observation": "No skill installed, project edited by upstream code, model invoked, paid content downloaded or account accessed." } ], "security": { "scope": "Passive public-response and documentation review with bounded browser interaction. No exploit testing, package audit or account-permission test.", "findings": [ { "level": "info", "basis": "observed", "title": "Public sample worked under a network guard", "detail": "The observed run recorded no page exceptions. Nine requests for telemetry, repository counters or API/account/community data were blocked; those paths were not evaluated." }, { "level": "caution", "basis": "observed", "title": "Response headers have a narrow evidence scope", "detail": "None of the six inspected policy headers was present on this main-document response: CSP, HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy or Permissions-Policy. This is a response observation, not proof of an exploitable weakness." }, { "level": "caution", "basis": "documented", "title": "Optional automation crosses a larger boundary", "detail": "The publisher describes Refine as invoking a local coding agent and applying accepted changes to project files. Its terms also describe model quota consumption. A working CSS demo does not validate that automation." }, { "level": "caution", "basis": "advice", "title": "Keep motion and semantics separate", "detail": "Use an established component for roles, labels, focus and Escape behavior; add the transition after those states work. Review imported code and avoid sharing private source with hosted tools by default." } ], "limits": [ "No penetration test, vulnerability scan, dependency audit, tenant isolation test or security certification.", "Blocked analytics/API requests alter the normal site environment. These checks cannot describe all ordinary network activity." ] }, "practicalCaveats": [ "The homepage shows a short sample row. Filtering that row does not test every transition or the full library.", "The tested resize is visual state behavior, not an accessibility, frame-rate or user-comprehension result.", "Check the exact license and entitlement for the snippet and workflow you choose." ], "limits": [ "One desktop Chromium session, one filter cycle and one resize cycle; no mobile, assistive-technology or reduced-motion execution.", "No CLI, skill, Refine session, agent scan/fix, project integration, paid download or model generation.", "The current site can change independently of the saved response; the response hash does not pin its dependent assets." ], "sources": [ { "label": "Publisher repository", "url": "https://github.com/Jakubantalik/transitions.dev", "scope": "Product identity, CSS library, optional CLI/skill/Refine paths; source reviewed, tools not installed." }, { "label": "Public transition library", "url": "https://transitions.dev/", "scope": "Account-free filter and Card resize interaction." }, { "label": "Publisher terms and license", "url": "https://transitions.dev/terms.html", "scope": "Library redistribution restrictions and separate tooling, hosted and agent scopes; reviewed 19 October 2026." }, { "label": "GitHub weekly HTML trending list", "url": "https://github.com/trending/html?since=weekly", "scope": "Observed 19 October 2026: transitions.dev listed with 571 stars this week. Dynamic list, not a permanent ranking." } ] } }, { "id": "openui", "title": "OpenUI (Thesys)", "url": "https://www.openui.com/", "category": "Components", "kind": "Generative UI framework", "summary": "Let a model compose approved interface components while your application keeps responsibility for data access, actions and recovery.", "whatItIs": "OpenUI from Thesys describes an interface in a compact language that a renderer maps to components supplied by your application. It can support streamed charts, forms and other responses. The open-source framework and hosted services such as Gateway, correction and monitoring are separate parts of the decision.", "whenUseful": "Consider it when a useful response changes shape with the question: a comparison needs a table, a trend needs a chart, and a missing detail needs a form. It is a development framework requiring an application and backend, not a finished design tool.", "example": "Build a synthetic SOP lookup prototype with only three allowed components: ProcedureSummary, SourceList and ClarifyingQuestion. Let a model choose a layout, but obtain the procedure text from a read-only server endpoint. Reject unsupported actions and show a plain-text fallback if rendering fails. Test empty, conflicting and incomplete responses before adding any write capability.", "expectedResult": "A constrained prototype and an error log showing which responses render, which fall back and which actions are rejected. Use repeated test cases to judge reliability; the proposed prototype was not executed in this review.", "cautions": [ "Generated component choices and arguments remain untrusted input. Authorize every backend read and write independently of what the UI displays.", "A syntactically valid response can still be misleading, inaccessible or wrong. Retain source context, failure states and a useful fallback.", "The documentation describes installation telemetry enabled by default and runtime telemetry requiring opt-in. Confirm the behavior and opt-out settings for the exact package version you adopt.", "Hosted model, correction and observability services add data-handling and cost decisions. Do not infer private-data suitability from a public preview." ], "requirements": [ "A supported application stack, a defined component library and backend engineering; the documented starter requires Node.js 20 or later.", "A model provider or local inference setup for generation; hosted paths may require accounts, API credentials and paid usage. Keep provider keys server-side.", "Input validation, authorization, accessible components, failure handling and representative evaluation cases owned by the application team." ], "reviewStatus": "documentation-reviewed", "reviewedOn": "2026-10-19", "reviewNotes": [ "Why included: the GitHub weekly TypeScript trending list observed on 19 October 2026 listed thesysdev/openui with 1,288 stars gained that week. This is a dated platform signal, not independent evidence for its performance claims.", "This review covers the Thesys project. The public comparison tabs switched as expected, but fixed previews cannot establish model generation, parser safety or production integration. Runtime coverage is therefore labelled limited.", "The published token, speed and reliability benchmarks were not reproduced. GitHub repository/commit API probes returned 5xx responses; public README, license and documentation were available." ], "sources": [ { "label": "Thesys OpenUI repository", "url": "https://github.com/thesysdev/openui", "scope": "Correct project identity and public framework source; distinct from other projects named OpenUI." }, { "label": "Framework introduction", "url": "https://www.openui.com/docs", "scope": "Component-library and streamed-rendering model." }, { "label": "Getting started", "url": "https://www.openui.com/docs/getting-started", "scope": "Node requirement, model/backend integration and server-side credential handling." }, { "label": "Queries and mutations", "url": "https://www.openui.com/docs/openui-lang/queries-mutations", "scope": "Generated UI can call application-provided tools; backend authorization remains an application concern." }, { "label": "Telemetry documentation", "url": "https://www.openui.com/docs/openui-lang/telemetry", "scope": "Documented installation telemetry defaults and opt-out; not independently executed." }, { "label": "Reliability guidance", "url": "https://www.openui.com/docs/openui-lang/reliability", "scope": "Malformed or incomplete model output and correction/monitoring boundaries." }, { "label": "Public comparison previews", "url": "https://www.openui.com/", "scope": "Fixed Forms and Charts tabs exercised without sending prompts." }, { "label": "GitHub weekly TypeScript trending list", "url": "https://github.com/trending/typescript?since=weekly", "scope": "Observed 19 October 2026: thesysdev/openui listed with 1,288 stars this week. Dynamic platform observation." } ], "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "http", "browser", "source-review" ], "summary": "The fixed public Forms and Charts previews switched successfully. No SDK, model generation or tool-backed workflow was executed, so framework runtime and security behavior remain unverified.", "reportUrl": "/design-evaluations/resource-openui.json", "identity": { "target": "https://www.openui.com/", "version": "Public website snapshot observed 19 October 2026; no installed package version was evaluated.", "integrity": "SHA-256 of the observed main-document response: 0391f4bc9f9f87c6727fb5140def7b00977d50c95abbbf5bc702d2a44f740759. This identifies one response, not all loaded assets or a reproducible SDK build." }, "environment": [ "Fresh Chromium 155.0.8059.82 context; 1280 by 900 viewport; no account or retained browser storage.", "Only approved public HTTPS hosts and GET/HEAD requests allowed. Authentication/API paths, telemetry, writes, service workers and WebSockets blocked; no downloads accepted." ], "tests": [ { "name": "Public response", "mode": "http", "method": "Read the public landing page and selected response headers without authentication.", "result": "pass", "observation": "HTTP 200 at https://www.openui.com/. Reachability does not establish product functionality." }, { "name": "Fixed preview switching", "mode": "browser", "method": "Select the Forms and Charts tabs and inspect selected state plus the visible comparison panel.", "result": "pass", "observation": "Both tabs became selected and displayed distinct panel content. These were fixed public examples; no prompt was submitted, live generation invoked or form completed." }, { "name": "Architecture and security-boundary review", "mode": "source-review", "method": "Read the published introduction, setup, queries/mutations, telemetry and reliability documentation.", "result": "pass", "observation": "The docs describe application-provided components/tools, server-side model credentials, possible incomplete output, installation telemetry enabled by default and runtime telemetry requiring opt-in. Those documented behaviors were not exercised as an installed SDK." }, { "name": "Generation and integration", "mode": "source-review", "method": "Exclude model requests, package installation, Gateway and application-provided tools from this browser-only evaluation.", "result": "not-run", "observation": "No model credentials, generated output, parser fixture, mutation, hosted correction, monitoring workspace or account permission was tested." } ], "security": { "scope": "Passive public-response and documentation review with bounded browser interaction. No exploit testing, package audit or account-permission test.", "findings": [ { "level": "info", "basis": "observed", "title": "Browser preview boundary", "detail": "The page returned HTTP 200 with HSTS max-age=63072000. Eight requests were blocked, including a telemetry POST and off-allowlist assets; no page exception was recorded. This is not a complete traffic or transport audit." }, { "level": "caution", "basis": "documented", "title": "Generated interfaces can reach application tools", "detail": "The queries/mutations guide describes a toolProvider that connects generated statements to application functions or an MCP client. Treat exposed tools as authority: constrain arguments and enforce permissions on the server." }, { "level": "caution", "basis": "documented", "title": "Installation telemetry is a separate decision", "detail": "The telemetry guide says installation collection is enabled by default, while runtime telemetry is disabled until enabled. It documents OPENUI_TELEMETRY_DISABLED=1 or DO_NOT_TRACK=1 for opt-out. No package was installed to verify these controls." }, { "level": "caution", "basis": "advice", "title": "Rendering validation does not authorize an action", "detail": "Restrict component and tool capabilities, validate server requests, keep credentials out of browser code and require a deliberate confirmation for consequential writes. Test malformed output and readable fallbacks before production use." } ], "limits": [ "No penetration test, vulnerability scan, dependency audit, tenant isolation test or security certification.", "Blocked analytics/API requests alter the normal site environment. These checks cannot describe all ordinary network activity." ] }, "practicalCaveats": [ "Fixed previews demonstrate presentation changes, not a working end-to-end generation system.", "A component allowlist helps constrain output but does not replace server authorization or content validation.", "Evaluate your own component set, model, prompts and failure cases repeatedly; publisher benchmark results are not a prediction for your application." ], "limits": [ "No package installation, pinned parser/renderer fixture, model invocation or generated-interface interaction.", "No account, Gateway, Autofix, monitoring, private data, MCP connection or backend query/mutation was used.", "No attack simulation, complete accessibility audit, mobile check or independent benchmark replication." ], "sources": [ { "label": "Thesys OpenUI repository", "url": "https://github.com/thesysdev/openui", "scope": "Correct project identity and public framework source; distinct from other projects named OpenUI." }, { "label": "Framework introduction", "url": "https://www.openui.com/docs", "scope": "Component-library and streamed-rendering model." }, { "label": "Getting started", "url": "https://www.openui.com/docs/getting-started", "scope": "Node requirement, model/backend integration and server-side credential handling." }, { "label": "Queries and mutations", "url": "https://www.openui.com/docs/openui-lang/queries-mutations", "scope": "Generated UI can call application-provided tools; backend authorization remains an application concern." }, { "label": "Telemetry documentation", "url": "https://www.openui.com/docs/openui-lang/telemetry", "scope": "Documented installation telemetry defaults and opt-out; not independently executed." }, { "label": "Reliability guidance", "url": "https://www.openui.com/docs/openui-lang/reliability", "scope": "Malformed or incomplete model output and correction/monitoring boundaries." }, { "label": "Public comparison previews", "url": "https://www.openui.com/", "scope": "Fixed Forms and Charts tabs exercised without sending prompts." }, { "label": "GitHub weekly TypeScript trending list", "url": "https://github.com/trending/typescript?since=weekly", "scope": "Observed 19 October 2026: thesysdev/openui listed with 1,288 stars this week. Dynamic platform observation." } ] } } ], "laws": [ { "id": "hicks-law", "title": "Hick's Law", "kind": "empirical", "category": "Choices and navigation", "summary": "Make the next decision understandable. Removing useful choices is only one possible way to do that.", "explanation": "Hick studied choice reaction time under controlled conditions. More uncertainty generally required more decision time. In an interface, clear labels, meaningful groups and relevant defaults can make choices easier to distinguish. A sprawling menu and a well-organized directory are different problems, even when they contain the same number of links.", "evidence": "Laboratory choice-reaction research. Applying it to menus is a design inference; the study does not establish a universal maximum number of navigation items or calls to action.", "useCases": [ { "title": "Choose an export format", "example": "A report offers CSV for spreadsheets and PDF for sharing, with short explanations and advanced formats in a labelled disclosure.", "expected": "People can identify the format that fits their next task.", "caveat": "Keep advanced formats discoverable and remember a preference only when the user can change it." }, { "title": "Browse a large tool catalog", "example": "Group tools by job, then provide search and filters for platform, account requirements and cost.", "expected": "A visitor can narrow the catalog using criteria they understand.", "caveat": "Test the group names. More levels can add work if the categories do not match the visitor's task." } ], "practices": [ "Name the decision before simplifying the screen.", "Use distinct labels and explain consequential defaults.", "Compare task completion and wrong selections in realistic tasks." ], "cautions": [ "There is no evidence-based four-to-seven-item rule here.", "Experts, familiar choices, unequal choice probabilities and search tasks change the situation.", "Do not hide necessary options merely to produce a shorter menu." ], "sources": [ { "label": "Hick, On the Rate of Gain of Information (1952)", "url": "https://journals.sagepub.com/doi/pdf/10.1080/17470215208416600", "scope": "Original choice-reaction research; publisher abstract reviewed." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The example preserved keyboard selection and a labelled path to advanced options. We did not measure decision time or establish an ideal menu size.", "reportUrl": "/design-evaluations/principle-hicks-law.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Native choice", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Keyboard ArrowDown selected PDF and the visible label matched." }, { "name": "Advanced disclosure", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "The advanced JSON/XML choices remained available through a labelled disclosure." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Keep consequential choices discoverable", "detail": "Simplifying a menu must not bury privacy, cancellation or permission controls. Test wrong selections as well as speed." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Test category names with intended users; the fixture only establishes that the controls remained operable." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Hick, On the Rate of Gain of Information (1952)", "url": "https://journals.sagepub.com/doi/pdf/10.1080/17470215208416600", "scope": "Original choice-reaction research; publisher abstract reviewed." } ] } }, { "id": "fitts-law", "title": "Fitts's Law and target distance", "kind": "empirical", "category": "Action and feedback", "summary": "Give controls enough room to hit and put related actions within a sensible reach.", "explanation": "Fitts modelled aimed movement using distance and target width. A larger target or a shorter movement can make pointing easier within the model's conditions. Keeping related actions near the point of interaction applies this same relationship. For interfaces, consider the whole interaction: where the pointer or hand starts, competing controls, keyboard access and the consequence of a mistake.", "evidence": "Controlled motor-performance experiments support the size-and-distance relationship. Web target-size criteria are separate accessibility requirements, not numbers derived directly from Fitts's equation.", "useCases": [ { "title": "Edit a row in a table", "example": "Place a clearly labelled Edit control beside each record and give its hit area enough space without overlapping adjacent rows.", "expected": "The action is close to the item being changed and easier to select accurately.", "caveat": "Keep keyboard focus visible and provide an accessible name that identifies the relevant record." }, { "title": "Delete a saved project", "example": "Keep Delete comfortably selectable, separate it from Save, name the project in the confirmation when needed, and offer recovery when the system supports it.", "expected": "The person can act deliberately and understand the consequence.", "caveat": "Shrinking a destructive target is not a safety mechanism. Use clear meaning, appropriate confirmation and reliable reversal." } ], "practices": [ "Measure the actual clickable area and spacing, not just the visible icon.", "Check WCAG 2.2 SC 2.5.8: 24 by 24 CSS pixels at Level AA, with defined spacing alternatives and exceptions; SC 2.5.5 uses 44 by 44 at Level AAA with exceptions.", "Check reach, zoom, keyboard operation and accidental activation on representative devices." ], "cautions": [ "CSS pixels, physical pixels, points and density-independent platform units are different measurements.", "A viewport edge is not automatically an infinitely large target; pointer confinement and device behavior matter.", "A convenient thumb zone varies with hand, device, grip and assistive technology." ], "sources": [ { "label": "Fitts, The Information Capacity of the Human Motor System (1954)", "url": "https://www2.psychology.uiowa.edu/faculty/mordkoff/infoproc/pdfs/Fitts%201954.pdf", "scope": "Original paper, university-hosted copy." }, { "label": "W3C: Target Size Minimum", "url": "https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html", "scope": "WCAG 2.2 AA size, spacing and exceptions." }, { "label": "W3C: Target Size Enhanced", "url": "https://www.w3.org/WAI/WCAG22/Understanding/target-size-enhanced.html", "scope": "Separate AAA criterion." }, { "label": "W3C: Error Prevention for Legal, Financial and Data Actions", "url": "https://www.w3.org/WAI/WCAG22/Understanding/error-prevention-legal-financial-data.html", "scope": "Reversal, checking or confirmation for the criterion's specified consequential submissions." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The example kept a comfortably sized Delete target, keyboard confirmation, cancellation and recovery. Target geometry alone did not provide the safety boundary.", "reportUrl": "/design-evaluations/principle-fitts-law.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Target size", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Delete button measured 99.5625 by 44 CSS pixels at 1280px viewport." }, { "name": "Confirm focus", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Keyboard activation opened confirmation with focus on Keep draft." }, { "name": "Cancel is nondestructive", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Cancel retained the synthetic draft and returned focus to Delete." }, { "name": "Recovery", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Confirmed deletion changed only memory state; Restore brought it back." }, { "name": "Small screen", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "At 320px the fixture had no horizontal document overflow and retained the 44px minimum example target." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Confirmation is only a UI boundary", "detail": "The synthetic confirmation protected tab-memory state. A real service still needs server authorization, duplicate-action handling and a recovery policy." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Measure the clickable area at relevant zoom and device sizes, then separately check consequence and reversal." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Fitts, The Information Capacity of the Human Motor System (1954)", "url": "https://www2.psychology.uiowa.edu/faculty/mordkoff/infoproc/pdfs/Fitts%201954.pdf", "scope": "Original paper, university-hosted copy." }, { "label": "W3C: Target Size Minimum", "url": "https://www.w3.org/WAI/WCAG22/Understanding/target-size-minimum.html", "scope": "WCAG 2.2 AA size, spacing and exceptions." }, { "label": "W3C: Target Size Enhanced", "url": "https://www.w3.org/WAI/WCAG22/Understanding/target-size-enhanced.html", "scope": "Separate AAA criterion." }, { "label": "W3C: Error Prevention for Legal, Financial and Data Actions", "url": "https://www.w3.org/WAI/WCAG22/Understanding/error-prevention-legal-financial-data.html", "scope": "Reversal, checking or confirmation for the criterion's specified consequential submissions." } ] } }, { "id": "jakobs-law", "title": "Jakob's Law", "kind": "heuristic", "category": "Choices and navigation", "summary": "Use familiar interaction patterns so people can spend their attention on the task.", "explanation": "People arrive with expectations learned elsewhere. Recognizable labels, controls and navigation reduce the amount of interface behavior they need to figure out. Familiarity is a starting point for testing, and the relevant conventions depend on the audience and platform.", "evidence": "Jakob Nielsen's usability heuristic, presented by its author. It is not a universal experimental law or a requirement to copy another product's layout.", "useCases": [ { "title": "Build account settings", "example": "Use recognizable Profile, Notifications and Security labels, with consistent Save behavior across panels.", "expected": "A new user can predict where to find a setting and how a change takes effect.", "caveat": "Existing customers may have a different learned model; test migrations and explain changed behavior." }, { "title": "Introduce a novel AI workflow", "example": "Keep ordinary file selection and review controls familiar while explaining the unfamiliar model action in plain language.", "expected": "People can focus on what the AI will do with their input.", "caveat": "A familiar-looking button must not conceal new data sharing or an irreversible action." } ], "practices": [ "Identify the products and platforms your intended users already know.", "Use familiar controls with accurate labels and consistent behavior.", "Test first-use comprehension before relying on convention." ], "cautions": [ "A widespread pattern can still be inaccessible or confusing.", "Conventions vary across languages, cultures and devices.", "Familiarity does not authorize copying protected assets or another product's branding." ], "sources": [ { "label": "Jakob Nielsen: Jakob's Law of Internet User Experience", "url": "https://www.nngroup.com/videos/jakobs-law-internet-ux/", "scope": "Author's statement of the heuristic." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "Familiar native controls behaved consistently in the local example. No first-use comprehension or cross-cultural expectation study was run.", "reportUrl": "/design-evaluations/principle-jakobs-law.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Native choice", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Keyboard ArrowDown selected PDF and the visible label matched." }, { "name": "Cancel is nondestructive", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Cancel retained the synthetic draft and returned focus to Delete." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Familiar appearance does not establish consent", "detail": "A standard-looking button can trigger unfamiliar data sharing. Name the actual destination and consequence before a service write." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Keep Save, Share and Publish meanings distinct; validate what new users expect rather than assuming familiarity." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Jakob Nielsen: Jakob's Law of Internet User Experience", "url": "https://www.nngroup.com/videos/jakobs-law-internet-ux/", "scope": "Author's statement of the heuristic." } ] } }, { "id": "proximity", "title": "Proximity", "kind": "perceptual", "category": "Visual organization", "summary": "Spacing should tell the same story as the content: related things belong together.", "explanation": "Nearby elements tend to form perceptual groups. Use that tendency to associate labels, values, explanations and actions. Relative spacing matters more than a universal gap size. A label that sits halfway between two fields leaves the relationship needlessly ambiguous.", "evidence": "A Gestalt grouping principle demonstrated in perceptual displays. Specific spacing tokens and layout choices are design applications, not experimental constants.", "useCases": [ { "title": "Clarify a form", "example": "Keep each field's label and hint close to its input, with a larger gap before the next field group.", "expected": "The visual association between an input and its explanation is easier to follow.", "caveat": "Also associate the label and hint in code; spacing alone does not provide a screen-reader relationship." }, { "title": "Explain dashboard metrics", "example": "Place the reporting period beside the metric it qualifies and separate unrelated metrics with additional space.", "expected": "Readers can tell which time range belongs to which number.", "caveat": "Preserve those associations when cards stack on narrow screens." } ], "practices": [ "Compare spacing within a group with spacing between groups.", "Check associations at zoom and after responsive reflow.", "Use semantic labels, headings and table relationships alongside visual grouping." ], "cautions": [ "Proximity interacts with similarity, boundaries and other cues.", "More whitespace is not automatically clearer.", "Visual position cannot carry essential meaning on its own." ], "sources": [ { "label": "Wertheimer: Laws of Organization in Perceptual Forms", "url": "https://psychclassics.yorku.ca/Wertheimer/Forms/forms.htm", "scope": "University-hosted translation of the 1923 original." }, { "label": "W3C: Info and Relationships", "url": "https://www.w3.org/WAI/WCAG22/Understanding/info-and-relationships.html", "scope": "Preserving structural relationships beyond visual presentation." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The example associated a label and hint with its input programmatically, and retained that relationship without authored CSS. Spacing comprehension was not measured.", "reportUrl": "/design-evaluations/principle-proximity.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Semantic group", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "A fieldset/legend, explicit label and described-by link identify the input independently of spacing." }, { "name": "No style order", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "With authored CSS disabled, the named input and ordered process remained present." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Visual grouping is not a trust boundary", "detail": "Keep permission labels and explanatory text programmatically tied to the correct control. Proximity cannot prevent a forged or misleading label." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Check labels and descriptions after responsive reflow, not just at the design canvas width." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Wertheimer: Laws of Organization in Perceptual Forms", "url": "https://psychclassics.yorku.ca/Wertheimer/Forms/forms.htm", "scope": "University-hosted translation of the 1923 original." }, { "label": "W3C: Info and Relationships", "url": "https://www.w3.org/WAI/WCAG22/Understanding/info-and-relationships.html", "scope": "Preserving structural relationships beyond visual presentation." } ] } }, { "id": "millers-law", "title": "Miller's Law and working memory", "kind": "empirical", "category": "Memory and attention", "summary": "Keep needed information available instead of making people hold it in memory.", "explanation": "Miller's famous seven-plus-or-minus-two discussion concerns particular judgment and memory tasks, including how meaningful chunks change recall. Later work by Cowan describes a smaller capacity under specified conditions. Neither paper supplies a navigation-item limit. A visible list can be searched and recognized without being memorized.", "evidence": "Memory research with task-dependent limits. Seven and four are not universal UI caps; grouping and external reminders are practical applications that still need usability testing.", "useCases": [ { "title": "Review a booking", "example": "Keep dates, guests and the total visible on the review step, with direct links to edit each part.", "expected": "The person can compare the decision against visible information.", "caveat": "Show the current values and include consequential conditions; a compact summary must not omit them." }, { "title": "Compare tools", "example": "Let a visitor pin tools into a comparison table with aligned requirements and limits.", "expected": "They can compare facts without remembering details from several pages.", "caveat": "Keep the table usable at narrow widths and provide labelled relationships for assistive technology." } ], "practices": [ "Find steps that require remembering details from a previous screen.", "Group information by meaningful task concepts.", "Reuse information already entered within a process when appropriate, with a way to inspect and correct it." ], "cautions": [ "Do not use seven, five or four as an automatic navigation ceiling.", "Chunking depends on familiarity; a category meaningful to an expert may not help a beginner.", "Memory demands also vary with interruption, stress and accessibility needs." ], "sources": [ { "label": "Miller: The Magical Number Seven (1956)", "url": "https://cse.buffalo.edu/~rapaport/575/F01/miller56.html", "scope": "Original paper in a university-hosted transcription." }, { "label": "Cowan: The Magical Number 4 (2001)", "url": "https://pubmed.ncbi.nlm.nih.gov/11515286/", "scope": "Author abstract and conditions for the proposed capacity estimate." }, { "label": "W3C: Redundant Entry", "url": "https://www.w3.org/WAI/WCAG22/Understanding/redundant-entry.html", "scope": "Same-process entry assistance, subject to specified exceptions." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The example retained a visible review summary and could resume a synthetic note within the same tab. No memory-capacity experiment was performed.", "reportUrl": "/design-evaluations/principle-millers-law.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Persistent summary", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Changed input was echoed in a visible review summary." }, { "name": "Resume memory", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "The draft could be resumed from explicitly scoped tab memory. No storage or account synchronization was used." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Persistence creates a separate data-handling decision", "detail": "This fixture used memory only. Real autosave needs a retention scope, deletion behavior and safeguards for shared devices and sensitive fields." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Make important facts available during decisions; do not convert a memory heuristic into an arbitrary navigation limit." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Miller: The Magical Number Seven (1956)", "url": "https://cse.buffalo.edu/~rapaport/575/F01/miller56.html", "scope": "Original paper in a university-hosted transcription." }, { "label": "Cowan: The Magical Number 4 (2001)", "url": "https://pubmed.ncbi.nlm.nih.gov/11515286/", "scope": "Author abstract and conditions for the proposed capacity estimate." }, { "label": "W3C: Redundant Entry", "url": "https://www.w3.org/WAI/WCAG22/Understanding/redundant-entry.html", "scope": "Same-process entry assistance, subject to specified exceptions." } ] } }, { "id": "doherty-threshold", "title": "Doherty Threshold and responsiveness", "kind": "engineering", "category": "Action and feedback", "summary": "Respond promptly and show what is happening. A single timing number cannot describe every interaction.", "explanation": "Doherty and Thadhani's historical report describes productivity gains from faster terminal responses. The familiar 400-millisecond shorthand should not become a universal cutoff. Modern web measurement separates input response from task completion: a button can acknowledge a request quickly while a report takes longer to generate.", "evidence": "Historical system-performance observations plus current engineering guidance. The reviewed report transcription supports benefits from faster responses, not a universal 400 ms boundary across tasks and devices.", "useCases": [ { "title": "Generate a large report", "example": "Acknowledge the request, display a truthful queued or running state, and provide the finished download when it exists.", "expected": "The person knows whether the request was accepted and what can happen next.", "caveat": "Do not fabricate a percentage or show success before the output is ready." }, { "title": "Save an editable preference", "example": "Update a low-risk preference promptly, show its saving state, and restore or explain the prior value if the server rejects it.", "expected": "The interface stays responsive while making the persistence result visible.", "caveat": "Optimistic feedback needs a recovery path; payment, permission and destructive operations need explicit treatment of pending and confirmed states." } ], "practices": [ "Measure response and completion separately on representative devices.", "For web responsiveness, use INP guidance: 200 ms or less at the 75th percentile of field page loads is the good threshold, segmented by mobile and desktop.", "Make relevant status messages available to assistive technology without unnecessary focus changes." ], "cautions": [ "INP is a defined browser metric, not a total task-duration target or an accessibility certification.", "Average latency can conceal slow interactions and devices.", "Loading animation does not fix a slow operation, and apparent success must not hide failure." ], "sources": [ { "label": "Doherty and Thadhani: The Economic Value of Rapid Response Time (1982)", "url": "https://jlelliotton.blogspot.com/p/the-economic-value-of-rapid-response.html", "scope": "Third-party transcription of the original report; scan fidelity not independently established." }, { "label": "web.dev: Interaction to Next Paint", "url": "https://web.dev/articles/inp", "scope": "Metric definition and current field-performance thresholds." }, { "label": "W3C: Status Messages", "url": "https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html", "scope": "Programmatic status communication." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The simulated operation exposed pending, failure and success states in order and disabled duplicate activation while pending. Its fixed delay is not a performance benchmark.", "reportUrl": "/design-evaluations/principle-doherty-threshold.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Pending is not success", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Pending state appeared and duplicate activation was disabled before the simulated operation completed." }, { "name": "Honest failure", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Failure was stated in text and did not erase the input or claim a successful save." }, { "name": "Honest completion", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Completion offered review/edit wording after the simulated success state." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Fast feedback must not invent success", "detail": "The fixture announced success only after its simulated outcome. Production systems need truthful server outcomes, idempotency and uncertainty handling." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Measure real interaction latency and task completion separately; a spinner does not prove acceptable performance." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Doherty and Thadhani: The Economic Value of Rapid Response Time (1982)", "url": "https://jlelliotton.blogspot.com/p/the-economic-value-of-rapid-response.html", "scope": "Third-party transcription of the original report; scan fidelity not independently established." }, { "label": "web.dev: Interaction to Next Paint", "url": "https://web.dev/articles/inp", "scope": "Metric definition and current field-performance thresholds." }, { "label": "W3C: Status Messages", "url": "https://www.w3.org/WAI/WCAG22/Understanding/status-messages.html", "scope": "Programmatic status communication." } ] } }, { "id": "isolation-effect", "title": "Von Restorff effect", "kind": "empirical", "category": "Memory and attention", "summary": "A meaningful difference can help something stand out in memory. Make the difference worth noticing.", "explanation": "An item that differs from a surrounding set can be remembered differently from the other items. The isolation effect concerns memory in context, and perceptual salience alone is not its complete explanation. In a UI, reserve distinction for meaningful information and state what the distinction means.", "evidence": "Experimental memory literature, with Hunt's original research discussion clarifying the role of similarity and distinctiveness. Better recall is not the same as comprehension, immediate attention or conversion.", "useCases": [ { "title": "Flag a changed permission", "example": "In a review table, mark the newly requested permission with a Changed label and a concise explanation of its effect.", "expected": "The change has a meaningful distinction from unchanged rows.", "caveat": "A badge is a cue, not proof that the person understood the permission." }, { "title": "Identify the next workflow action", "example": "Give the next action a clear label and stronger visual emphasis while keeping secondary actions readable.", "expected": "The action hierarchy is easier to interpret.", "caveat": "Do not make cancellation or a privacy-preserving option hard to see in order to favor the business outcome." } ], "practices": [ "Tie emphasis to a specific meaning or decision.", "Keep the surrounding design consistent enough for the distinction to be useful.", "Use text or another visible cue alongside meaningful color differences." ], "cautions": [ "The effect does not prove that every page needs exactly one bright button.", "Excessive badges and emphasis compete with one another.", "Test understanding and errors, not only whether users noticed the decoration." ], "sources": [ { "label": "Hunt: The Subtlety of Distinctiveness (1995)", "url": "https://link.springer.com/article/10.3758/BF03214414", "scope": "Publisher abstract; full text behind subscription access on this route." }, { "label": "W3C: Use of Color", "url": "https://www.w3.org/WAI/WCAG22/Understanding/use-of-color.html", "scope": "Meaning must not rely only on color." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The example exposed failure in text rather than depending on a distinctive color. We did not test whether the highlighted item was better remembered.", "reportUrl": "/design-evaluations/principle-isolation-effect.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "No style order", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "With authored CSS disabled, the named input and ordered process remained present." }, { "name": "Honest failure", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Failure was stated in text and did not erase the input or claim a successful save." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Emphasis must not obscure material choices", "detail": "Do not make data-sharing consent vivid while hiding refusal or privacy controls. Attention is not informed authorization." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Evaluate label comprehension, contrast and errors alongside visual prominence." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Hunt: The Subtlety of Distinctiveness (1995)", "url": "https://link.springer.com/article/10.3758/BF03214414", "scope": "Publisher abstract; full text behind subscription access on this route." }, { "label": "W3C: Use of Color", "url": "https://www.w3.org/WAI/WCAG22/Understanding/use-of-color.html", "scope": "Meaning must not rely only on color." } ] } }, { "id": "serial-position", "title": "Serial position effect", "kind": "empirical", "category": "Memory and attention", "summary": "Order can affect recall. Choose an order that also makes the task easier to complete.", "explanation": "Free-recall experiments often find different recall for items near the beginning, middle and end of a presented list. The pattern depends on the task and conditions. A navigation menu that remains visible is not the same as a word list recalled from memory, so menu order needs its own rationale.", "evidence": "Experimental list-memory research, including Murdock's original study and a later laboratory preprint. It does not establish universal first-and-last placement rules for visible interfaces.", "useCases": [ { "title": "Introduce a short procedure", "example": "State the goal before the steps, then finish with a compact checklist the person can keep open while working.", "expected": "The purpose and completion criteria remain available after the introduction.", "caveat": "External reference reduces the need to rely on recall; do not move a required step out of its logical order." }, { "title": "Arrange a settings menu", "example": "Order related settings by a tested task model, then check whether people can locate infrequent settings as well as common ones.", "expected": "The order supports predictable retrieval.", "caveat": "Do not place an item last solely because a memory experiment found recency effects." } ], "practices": [ "Distinguish a recall task from a visible search task.", "Preserve procedural, alphabetical or categorical order when it helps retrieval.", "Measure whether people can find and use the needed item." ], "cautions": [ "Presentation pace, delay and recall instructions affect the pattern.", "First or last placement does not guarantee attention.", "Keep essential information available rather than depending on memory effects." ], "sources": [ { "label": "Murdock: The Serial Position Effect of Free Recall (1962)", "url": "https://doi.org/10.1037/h0045106", "scope": "Original study identity verified; direct publisher retrieval restricted." }, { "label": "Herrema and Kahana: First Recall Costs and Benefits", "url": "https://memory.psych.upenn.edu/files/pubs/HerrKaha24.pdf", "scope": "Authors' laboratory preprint re-evaluating immediate free recall; indexed text reviewed and authorship checked against the lab's publication list. Peer-reviewed publication status not established." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The example retained an explicit Choose, Review, Confirm sequence and visible summary. No primacy, recency or recall outcome was measured.", "reportUrl": "/design-evaluations/principle-serial-position.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Persistent summary", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Changed input was echoed in a visible review summary." }, { "name": "No style order", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "With authored CSS disabled, the named input and ordered process remained present." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Order cannot replace a final consequence check", "detail": "Keep destination, data scope and irreversible effects available at confirmation; placing them first or last is not a safeguard by itself." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Preserve meaning in DOM reading order and let people revisit details before committing." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Murdock: The Serial Position Effect of Free Recall (1962)", "url": "https://doi.org/10.1037/h0045106", "scope": "Original study identity verified; direct publisher retrieval restricted." }, { "label": "Herrema and Kahana: First Recall Costs and Benefits", "url": "https://memory.psych.upenn.edu/files/pubs/HerrKaha24.pdf", "scope": "Authors' laboratory preprint re-evaluating immediate free recall; indexed text reviewed and authorship checked against the lab's publication list. Peer-reviewed publication status not established." } ] } }, { "id": "peak-end", "title": "Peak-end rule", "kind": "empirical", "category": "Memory and attention", "summary": "How an experience ends can influence how it is remembered. Make completion useful and honest.", "explanation": "Research on retrospective evaluation shows that salient moments and endings can influence people's later assessment of an experience. That does not make the rest of the journey disposable. A clear ending can confirm what happened, explain remaining work and give the person a useful next step.", "evidence": "Experiments on retrospective affect and observational research on memories of medical procedures. Applying these findings to product journeys is an inference, not a promise that a pleasant finish outweighs earlier friction.", "useCases": [ { "title": "Finish an application", "example": "Show the submission reference, what was received, the expected review process and a way to retrieve the record.", "expected": "The applicant leaves with a clear account of the completed step.", "caveat": "Submitted is different from approved; keep those states distinct." }, { "title": "Recover from a failed import", "example": "Explain which rows were imported, preserve the rejected rows and provide a corrected retry path.", "expected": "The person can finish with a workable recovery plan.", "caveat": "A friendly message cannot compensate for missing or silently changed data." } ], "practices": [ "Define a truthful completion state for the task.", "Give people a useful receipt, result or recovery action.", "Study the whole journey as well as the final screen." ], "cautions": [ "Peak and end effects are context-dependent, not an exact formula for every experience.", "Do not prolong an unpleasant task to improve its remembered ending.", "Completion quality includes correctness and recoverability, not just celebration." ], "sources": [ { "label": "Fredrickson and Kahneman: Duration Neglect (1993)", "url": "https://pubmed.ncbi.nlm.nih.gov/8355141/", "scope": "Author abstract describing two affective-experience experiments." }, { "label": "Redelmeier and Kahneman: Patients' Memories of Painful Medical Treatments (1996)", "url": "https://pubmed.ncbi.nlm.nih.gov/8857625/", "scope": "Original observational study linking retrospective evaluation with peak and final pain; author abstract reviewed. This guide provides no medical advice." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The local success and failure paths used accurate completion language, retained input after failure and allowed synthetic recovery. No retrospective satisfaction was measured.", "reportUrl": "/design-evaluations/principle-peak-end.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Recovery", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Confirmed deletion changed only memory state; Restore brought it back." }, { "name": "Honest failure", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Failure was stated in text and did not erase the input or claim a successful save." }, { "name": "Honest completion", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Completion offered review/edit wording after the simulated success state." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Completion must match what actually happened", "detail": "Do not celebrate a submission that is pending, rejected or only partially processed. Show what remains and how to recover." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Test the failure ending as carefully as the successful one; a pleasant finish does not repair lost data." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Fredrickson and Kahneman: Duration Neglect (1993)", "url": "https://pubmed.ncbi.nlm.nih.gov/8355141/", "scope": "Author abstract describing two affective-experience experiments." }, { "label": "Redelmeier and Kahneman: Patients' Memories of Painful Medical Treatments (1996)", "url": "https://pubmed.ncbi.nlm.nih.gov/8857625/", "scope": "Original observational study linking retrospective evaluation with peak and final pain; author abstract reviewed. This guide provides no medical advice." } ] } }, { "id": "zeigarnik-effect", "title": "Zeigarnik effect and unfinished tasks", "kind": "empirical", "category": "Memory and attention", "summary": "Help people resume real work. Do not assume unfinished tasks create a reliable memory or engagement advantage.", "explanation": "The familiar claim is that unfinished tasks are remembered better. A 2025 meta-analysis found no overall memory advantage for unfinished tasks in the included interrupted-task studies, while finding a tendency to resume them. Saving progress is still useful because it preserves work, without requiring a psychological engagement claim.", "evidence": "Contested memory effect with a recent quantitative research synthesis. Resumption, often discussed as the Ovsiankina effect, is distinct from superior recall and does not establish product retention gains.", "useCases": [ { "title": "Resume a long application", "example": "Save completed sections and offer a return link to the first unfinished required section.", "expected": "The person can continue without re-entering completed work.", "caveat": "Explain draft retention and access controls; saving sensitive information requires an appropriate privacy design." }, { "title": "Show optional setup work", "example": "Separate required setup from optional personalization and allow the optional list to be dismissed.", "expected": "People can see what is necessary and decide whether to continue.", "caveat": "Do not invent incompleteness or use a permanent progress deficit to pressure engagement." } ], "practices": [ "Preserve valid progress and show what remains.", "Make completion criteria accurate and distinguish required from optional work.", "Measure successful resumption instead of assuming a memory advantage." ], "cautions": [ "Do not advertise a universal Zeigarnik memory benefit.", "The meta-analysis concerns specified research paradigms, not every interruption in everyday life.", "Reminders need user control and should serve the user's task." ], "sources": [ { "label": "Ghibellini and Meier: Interruption, Recall and Resumption (2025)", "url": "https://www.nature.com/articles/s41599-025-05000-w", "scope": "Open-access meta-analysis; memory advantage and task resumption assessed separately." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The fixture resumed an explicitly scoped tab-memory draft and left the reminder opt-in. It did not test a memory or engagement advantage from unfinished work.", "reportUrl": "/design-evaluations/principle-zeigarnik-effect.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Reminder opt in", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "The optional reminder began unchecked; the fixture has no deadline/countdown." }, { "name": "Resume memory", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "The draft could be resumed from explicitly scoped tab memory. No storage or account synchronization was used." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Resumption and reminders need user control", "detail": "Real reminders and saved drafts can expose sensitive context on shared devices. Offer control over retention, notifications and deletion." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Use unfinished-state cues to support a real task, with clear save scope; do not manufacture pressure to return." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Ghibellini and Meier: Interruption, Recall and Resumption (2025)", "url": "https://www.nature.com/articles/s41599-025-05000-w", "scope": "Open-access meta-analysis; memory advantage and task resumption assessed separately." } ] } }, { "id": "pragnanz", "title": "Prägnanz", "kind": "perceptual", "category": "Visual organization", "summary": "Make the structure easy to perceive without removing the information that makes it useful.", "explanation": "Prägnanz describes the Gestalt tendency toward coherent, stable perceptual organization. It is a broad account of perception, not a rule that the fewest shapes or controls produce the best interface. A readable hierarchy can make a detailed screen understandable.", "evidence": "A Gestalt organizing principle. Visual simplicity and product simplicity are different concepts; the proposed UI practices are interpretations to test.", "useCases": [ { "title": "Explain a workflow", "example": "Use aligned steps, explicit branch labels and a consistent direction in a process diagram.", "expected": "Readers can identify the main sequence and its exceptions.", "caveat": "Keep required branches visible and provide a text equivalent for the diagram." }, { "title": "Organize a dense review page", "example": "Use clear headings and a repeated label-value pattern for requirements, costs and caveats.", "expected": "A reader can follow the structure without losing necessary detail.", "caveat": "Visual regularity should not erase important differences between entries." } ], "practices": [ "Establish a clear hierarchy before adding decoration.", "Use consistent alignment and grouping where the content warrants it.", "Check whether people can explain the structure in their own words." ], "cautions": [ "This principle does not prove that minimalist aesthetics improve every task.", "Unlabelled icons can look simple while demanding more interpretation.", "Preserve semantic structure and meaningful reading order." ], "sources": [ { "label": "Wertheimer: Laws of Organization in Perceptual Forms", "url": "https://psychclassics.yorku.ca/Wertheimer/Forms/forms.htm", "scope": "Original Gestalt discussion of organization, available in translation." }, { "label": "Nielsen: Aesthetic and Minimalist Design", "url": "https://www.nngroup.com/articles/ten-usability-heuristics/", "scope": "Separate usability heuristic supporting relevant content and clear hierarchy; not experimental proof of Prägnanz in UI." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "Named controls and an ordered process remained understandable to the DOM checks when authored styling was disabled. Perceptual simplicity was not measured.", "reportUrl": "/design-evaluations/principle-pragnanz.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Semantic group", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "A fieldset/legend, explicit label and described-by link identify the input independently of spacing." }, { "name": "No style order", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "With authored CSS disabled, the named input and ordered process remained present." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "A simpler appearance can hide important meaning", "detail": "Do not remove labels, permission explanations or failure states just to reduce visual detail. Semantic clarity and authorization are separate concerns." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Check reading order and explicit labels after visual simplification; do not use icon-only controls merely for neatness." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Wertheimer: Laws of Organization in Perceptual Forms", "url": "https://psychclassics.yorku.ca/Wertheimer/Forms/forms.htm", "scope": "Original Gestalt discussion of organization, available in translation." }, { "label": "Nielsen: Aesthetic and Minimalist Design", "url": "https://www.nngroup.com/articles/ten-usability-heuristics/", "scope": "Separate usability heuristic supporting relevant content and clear hierarchy; not experimental proof of Prägnanz in UI." } ] } }, { "id": "similarity", "title": "Similarity", "kind": "perceptual", "category": "Visual organization", "summary": "Use a shared visual treatment when elements share a role or meaning.", "explanation": "Elements with similar properties tend to group perceptually. A consistent component vocabulary can use that tendency to communicate repeated roles. When two controls look alike but behave differently, the visual pattern creates an expectation the product does not meet.", "evidence": "A Gestalt grouping principle. Component consistency is a practical application; similarity alone does not establish a control's meaning or accessibility.", "useCases": [ { "title": "Standardize status labels", "example": "Use the same text, icon and treatment for Pending across lists, details and exports.", "expected": "People can recognize the same state in different views.", "caveat": "Include text rather than relying on color alone, and distinguish genuinely different states." }, { "title": "Separate links from commands", "example": "Use a consistent link treatment for navigation and button treatment for actions such as saving a preference.", "expected": "The visual vocabulary supports predictable interaction.", "caveat": "Use the correct underlying elements and keyboard behavior; styling does not supply semantics." } ], "practices": [ "Document what each repeated visual treatment means.", "Review component variants for conflicting behaviors.", "Keep states distinguishable with text and other cues when color carries meaning." ], "cautions": [ "Similar-looking items need not be identical; retain differences that matter.", "Similarity competes or cooperates with other grouping cues.", "A consistent inaccessible pattern remains inaccessible." ], "sources": [ { "label": "Wertheimer: Laws of Organization in Perceptual Forms", "url": "https://psychclassics.yorku.ca/Wertheimer/Forms/forms.htm", "scope": "Original proximity and similarity demonstrations in translation." }, { "label": "W3C: Use of Color", "url": "https://www.w3.org/WAI/WCAG22/Understanding/use-of-color.html", "scope": "Alternative visible cues for meaningful color distinctions." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The example represented pending, failure and saved states with explicit text. It did not rely on their shared visual treatment to communicate the outcome.", "reportUrl": "/design-evaluations/principle-similarity.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Honest failure", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Failure was stated in text and did not erase the input or claim a successful save." }, { "name": "Honest completion", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Completion offered review/edit wording after the simulated success state." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Similar controls need accurate effects", "detail": "A repeated button style must not make a high-consequence action look equivalent to navigation. Explain the effect and apply appropriate confirmation." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Pair consistent appearance with consistent behavior, accessible names and non-color state information." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Wertheimer: Laws of Organization in Perceptual Forms", "url": "https://psychclassics.yorku.ca/Wertheimer/Forms/forms.htm", "scope": "Original proximity and similarity demonstrations in translation." }, { "label": "W3C: Use of Color", "url": "https://www.w3.org/WAI/WCAG22/Understanding/use-of-color.html", "scope": "Alternative visible cues for meaningful color distinctions." } ] } }, { "id": "uniform-connectedness", "title": "Uniform connectedness", "kind": "perceptual", "category": "Visual organization", "summary": "A continuous visual unit and a set of items inside a box are different grouping cues.", "explanation": "Palmer and Rock describe connected regions with relatively uniform properties as perceptual units. The related element-connectedness principle concerns parts sharing a boundary. A connector can therefore communicate a relationship, but a box surrounding separate objects belongs under common region. The distinction helps explain what a diagram is actually showing.", "evidence": "Perceptual demonstrations and a theoretical account of unit formation. The source itself includes depth-related qualifications; it does not establish an unconditional ranking above every other grouping cue.", "useCases": [ { "title": "Draw a dependency map", "example": "Join a service to the database it reads with a labelled connector and an explicit direction.", "expected": "The relationship is represented directly instead of being inferred from proximity.", "caveat": "A line alone does not explain ownership, data direction or permission. Label its meaning and offer a text representation." }, { "title": "Show a process path", "example": "Connect numbered stages with a continuous line and label completed, current and future states.", "expected": "The stages read as one sequence.", "caveat": "Branching or optional steps need explicit treatment; do not draw a linear path that misrepresents the process." } ], "practices": [ "Distinguish a connected unit from separate objects sharing a container.", "Give connectors explicit meanings and avoid accidental crossings.", "Provide equivalent relationships in text or semantic structure." ], "cautions": [ "Common region is a separate principle and has its own entry.", "A visual connection does not create an accessible programmatic relationship.", "Busy connector networks can obscure the very relationships they are meant to explain." ], "sources": [ { "label": "Palmer and Rock: Rethinking Perceptual Organization (1994)", "url": "https://pubmed.ncbi.nlm.nih.gov/24203413/", "scope": "Author abstract defining uniform connectedness and its qualifications." }, { "label": "Palmer: Perceptual Organization in Vision (2002)", "url": "https://palmerlab.berkeley.edu/pdf/Palmer.pdf", "scope": "Author's discussion distinguishing common region and element connectedness." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The example provided an ordered text process beneath its visual connector treatment. No experiment compared connectedness with other grouping cues.", "reportUrl": "/design-evaluations/principle-uniform-connectedness.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "No style order", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "With authored CSS disabled, the named input and ordered process remained present." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "A drawn connection does not grant permission", "detail": "A dependency line cannot establish a trusted data route, ownership or authorization. Document endpoints and permission scope separately." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Label connector meaning and offer a meaningful text representation when diagrams cannot be perceived." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Palmer and Rock: Rethinking Perceptual Organization (1994)", "url": "https://pubmed.ncbi.nlm.nih.gov/24203413/", "scope": "Author abstract defining uniform connectedness and its qualifications." }, { "label": "Palmer: Perceptual Organization in Vision (2002)", "url": "https://palmerlab.berkeley.edu/pdf/Palmer.pdf", "scope": "Author's discussion distinguishing common region and element connectedness." } ] } }, { "id": "common-region", "title": "Common region", "kind": "perceptual", "category": "Visual organization", "summary": "A shared boundary can show which items belong to the same group.", "explanation": "Common region groups separate elements that appear inside the same bounded area. A card, panel or fieldset can express that relationship. The boundary is useful when it clarifies membership, but adding boxes to everything can create unnecessary visual competition.", "evidence": "Palmer's perceptual demonstrations identify common region as distinct from proximity and other grouping factors. UI containers are an application of that finding, not a guarantee of comprehension.", "useCases": [ { "title": "Group shipping choices", "example": "Put delivery options and their prices in a labelled fieldset, separate from billing details.", "expected": "People can see which choices belong to the delivery decision.", "caveat": "Use a semantic group label as well as the visible boundary." }, { "title": "Present a tool review", "example": "Keep one tool's requirements, source links and caveats within the same clearly headed panel.", "expected": "The facts are less likely to be attributed to an adjacent tool.", "caveat": "Check that headings and relationships remain clear when panels stack or their visual borders disappear." } ], "practices": [ "Use enclosure to communicate real membership.", "Keep nested regions shallow enough to follow.", "Check headings and semantic grouping independently of borders and backgrounds." ], "cautions": [ "Enclosure and connectedness are not interchangeable terms.", "A container does not make unrelated content meaningfully related.", "The evidence does not require a card layout or state that enclosure always overrides other cues." ], "sources": [ { "label": "Palmer: Common Region, a New Principle of Perceptual Grouping (1992)", "url": "https://www.sciencedirect.com/science/article/pii/001002859290014S", "scope": "Original publisher abstract; full article access may require a subscription." }, { "label": "W3C: Info and Relationships", "url": "https://www.w3.org/WAI/WCAG22/Understanding/info-and-relationships.html", "scope": "Semantic preservation of groups and relationships." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The delivery example used a fieldset and legend as well as a boundary, retaining its input label without styling. Group comprehension was not measured.", "reportUrl": "/design-evaluations/principle-common-region.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Semantic group", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "A fieldset/legend, explicit label and described-by link identify the input independently of spacing." }, { "name": "No style order", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "With authored CSS disabled, the named input and ordered process remained present." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "A shared container is not shared authorization", "detail": "Keep each field or record subject to its own data and permission rules. A card boundary cannot enforce tenant or access isolation." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Check semantic grouping when panels stack or their borders are removed." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Palmer: Common Region, a New Principle of Perceptual Grouping (1992)", "url": "https://www.sciencedirect.com/science/article/pii/001002859290014S", "scope": "Original publisher abstract; full article access may require a subscription." }, { "label": "W3C: Info and Relationships", "url": "https://www.w3.org/WAI/WCAG22/Understanding/info-and-relationships.html", "scope": "Semantic preservation of groups and relationships." } ] } }, { "id": "teslers-law", "title": "Tesler's Law", "kind": "heuristic", "category": "Workflow and scope", "summary": "When a task is complicated, decide who should handle each part and how mistakes can be corrected.", "explanation": "Tesler's formulation asks whether the user, application developer or platform developer will handle a task's inherent complexity. It is a useful design question rather than a measurable conservation law. Automation can take work off the screen while moving decisions into defaults, integrations and maintenance.", "evidence": "A design heuristic documented by Larry Tesler. It does not prove that every existing step is necessary or that complexity is a fixed quantity across different product scopes.", "useCases": [ { "title": "Import a spreadsheet", "example": "Suggest column mappings, show sample rows and require review before writing records.", "expected": "The system handles repetitive matching while the user can inspect consequential choices.", "caveat": "A confident guess can still be wrong; preserve the source and make corrections possible." }, { "title": "Set a time zone", "example": "Suggest the device time zone, display it beside scheduled times and let the person override it.", "expected": "Most users avoid repetitive setup while travelers can choose the right interpretation.", "caveat": "Do not silently treat a device setting as proof of the person's intended location." } ], "practices": [ "Identify the actual requirement behind each difficult step.", "Document defaults and the decisions automation makes.", "Design inspection, correction and failure recovery alongside the happy path." ], "cautions": [ "Scope reduction can remove work; this is not a physical conservation equation.", "Hidden complexity can produce maintenance, privacy and security costs.", "Expert users may need direct controls that a simplified workflow conceals." ], "sources": [ { "label": "Larry Tesler: The Law of Conservation of Complexity", "url": "https://www.nomodes.com/larry-tesler-consulting/complexity-law", "scope": "Author's formulation and historical context." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The import example disclosed a suggested mapping before changing its synthetic counter. It demonstrated an inspection step, not a real import or a conservation law.", "reportUrl": "/design-evaluations/principle-teslers-law.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Import before review", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Import was disabled until its mapping preview was requested." }, { "name": "Mapping disclosed", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Preview revealed the suggested mapping and two-row count without committing." }, { "name": "Import confirmed", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Explicit confirmation changed the synthetic counter only." } ], "security": { "scope": "Review of the local example’s stated interaction boundaries; no backend, authentication, production permissions or external service was exercised.", "findings": [ { "level": "caution", "basis": "advice", "title": "Automation must expose consequential assumptions", "detail": "Real imports need server-side validation, scoped credentials, authorization and rollback. A visible preview alone cannot enforce those controls." } ], "limits": [ "The example has no real authorization or persistence layer; its UI behavior cannot establish the security of a deployed workflow." ] }, "practicalCaveats": [ "Let users inspect defaults and correct mappings; preserve source data until the result has been verified." ], "limits": [ "This checks an authored application example, not the truth, effect size or generality of the named principle.", "No users, assistive-technology participants, physical devices or production task outcomes were evaluated." ], "sources": [ { "label": "Larry Tesler: The Law of Conservation of Complexity", "url": "https://www.nomodes.com/larry-tesler-consulting/complexity-law", "scope": "Author's formulation and historical context." } ] } }, { "id": "postels-law", "title": "Postel's Law and input boundaries", "kind": "engineering", "category": "Action and feedback", "summary": "Help people enter valid information while keeping the system's accepted meanings explicit.", "explanation": "The robustness principle comes from network protocol engineering. Applied carelessly, accepting unexpected input can conceal bugs or create incompatible interpretations. In forms, tolerate harmless presentation differences only when normalization is unambiguous. Validate the resulting value against an explicit contract and communicate failures clearly.", "evidence": "Historical protocol guidance in RFC 1122, qualified by the IAB's RFC 9413 discussion of robust protocol maintenance. Friendly forms and consistent UI states are design applications, not permission to relax trust boundaries.", "useCases": [ { "title": "Accept a formatted reference number", "example": "Allow spaces in a reference number where the documented format treats spaces as insignificant, then validate its length and permitted characters on the server.", "expected": "People can paste a readable value without changing its defined meaning.", "caveat": "Do not apply this normalization to passwords, signatures or identifiers whose exact bytes matter." }, { "title": "Resolve an ambiguous date", "example": "When 03/04/2027 could mean two dates, show the expected format or ask the person to choose the intended date, then echo the resolved date in words.", "expected": "The person and the system agree on the stored meaning.", "caveat": "Never silently guess a consequential date. API unknown-field handling must follow the versioned schema and extension policy." } ], "practices": [ "Separate parsing, documented normalization and validation.", "Validate untrusted input on the server and use the appropriate output encoding and parameterized data access.", "Define success, pending and failure states consistently, and preserve safe input for correction." ], "cautions": [ "Permissive parsing is not a security strategy.", "Input validation alone does not prevent every injection or authorization flaw.", "RFC 9413 warns that lax interpretation and hidden variation can undermine interoperability and security; strictness should follow explicit specifications." ], "sources": [ { "label": "RFC 1122, section 1.2.2: Robustness Principle", "url": "https://www.rfc-editor.org/rfc/rfc1122.html#section-1.2.2", "scope": "Historical protocol context." }, { "label": "RFC 9413: Maintaining Robust Protocols", "url": "https://www.rfc-editor.org/rfc/rfc9413.html", "scope": "IAB qualifications, active maintenance and security concerns." }, { "label": "OWASP: Input Validation Cheat Sheet", "url": "https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html", "scope": "Validation boundaries and related controls; guidance, not a security evaluation of a product." } ], "reviewedOn": "2026-10-18", "evaluation": { "reviewedOn": "2026-10-19", "status": "limited", "modes": [ "application-fixture" ], "summary": "The local example accepted only documented ASCII-space normalization for a six-digit reference, rejected invalid or ambiguous dates, preserved exact-value spaces and rendered markup-like input as text.", "reportUrl": "/design-evaluations/principle-postels-law.json", "identity": { "target": "Original IonBin synthetic interface example; no external product or human-participant study.", "version": "2026-10-19 local fixture", "integrity": "SHA-256 f85d1056afd667225a1e0364edfb8f25b4693ffa7b2b8c7d7af5b92338b85ee4 identifies the exact HTML fixture only." }, "environment": [ "155.0.8059.82 Chromium; fresh context with all network requests blocked.", "Synthetic inputs, memory-only state, reduced-motion preference, 1280px and 320px viewports." ], "tests": [ { "name": "Inert text", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "Markup-like synthetic input stayed literal text; no image element or handler was created." }, { "name": "Accept ASCII spaces in a reference", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "\"12 34 56\" was accepted after ASCII-space normalization by the six-ASCII-digit contract." }, { "name": "Reject a short reference", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "\"12345\" was rejected by the six-ASCII-digit contract." }, { "name": "Reject a long reference", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "\"1234567\" was rejected by the six-ASCII-digit contract." }, { "name": "Reject full-width digits", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "\"１２３４５６\" was rejected by the six-ASCII-digit contract." }, { "name": "Reject a tab in the reference", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "\"12\\t3456\" was rejected by the six-ASCII-digit contract." }, { "name": "Reject markup as a reference", "mode": "application-fixture", "method": "Exercise the original local application fixture and inspect the resulting controls or DOM state.", "result": "pass", "observation": "\"