{
  "exported_at": "2026-09-30T10:04:57.837164Z",
  "kind": "page",
  "target": "https://qa-bugs.lab980.com",
  "run_id": "c4f8198035e745b889c181f51660979c",
  "status": "done",
  "stats": {
    "pages": 1,
    "templates": 1,
    "findings_by_severity": {
      "serious": 5,
      "moderate": 2,
      "minor": 3,
      "info": 3,
      "critical": 1
    },
    "duration_secs": 30.29,
    "tokens": {
      "input": 2548,
      "output": 1027,
      "cache_read": 0,
      "cache_write": 0
    },
    "tokens_by_model": {
      "claude-haiku-4-5": {
        "input": 1389,
        "output": 670,
        "cache_read": 0,
        "cache_write": 0
      },
      "claude-sonnet-5": {
        "input": 1159,
        "output": 357,
        "cache_read": 0,
        "cache_write": 0
      }
    },
    "estimated_cost_usd": 0.0136
  },
  "findings": [
    {
      "type": "finding",
      "id": 2802,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-csp",
      "severity": "serious",
      "title": "Missing Content-Security-Policy header",
      "detail": "No Content-Security-Policy header was present, leaving the page without a script-injection safety net.",
      "evidence": {
        "header": "content-security-policy",
        "present": false
      }
    },
    {
      "type": "finding",
      "id": 2803,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-hsts",
      "severity": "serious",
      "title": "Missing Strict-Transport-Security header",
      "detail": "This HTTPS page does not send Strict-Transport-Security, so browsers won't enforce HTTPS on subsequent visits.",
      "evidence": {
        "header": "strict-transport-security",
        "present": false
      }
    },
    {
      "type": "finding",
      "id": 2804,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-frame-protection",
      "severity": "moderate",
      "title": "Missing clickjacking protection",
      "detail": "Neither X-Frame-Options nor a CSP frame-ancestors directive is present, so the page can be framed by another site.",
      "evidence": {
        "x-frame-options": null,
        "csp_frame_ancestors": false
      }
    },
    {
      "type": "finding",
      "id": 2805,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-xcto",
      "severity": "minor",
      "title": "Missing X-Content-Type-Options: nosniff",
      "detail": "Without 'nosniff', browsers may MIME-sniff responses in ways that enable content-type confusion attacks.",
      "evidence": {
        "header": "x-content-type-options",
        "value": null
      }
    },
    {
      "type": "finding",
      "id": 2806,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-referrer-policy",
      "severity": "minor",
      "title": "Missing Referrer-Policy header",
      "detail": "No Referrer-Policy header was present, so the browser's default (often permissive) referrer behavior applies.",
      "evidence": {
        "header": "referrer-policy",
        "present": false
      }
    },
    {
      "type": "finding",
      "id": 2807,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "missing-permissions-policy",
      "severity": "info",
      "title": "Missing Permissions-Policy header",
      "detail": "No Permissions-Policy header was present to restrict access to powerful browser features.",
      "evidence": {
        "header": "permissions-policy",
        "present": false
      }
    },
    {
      "type": "finding",
      "id": 2808,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "security",
      "tier": 0,
      "rule": "server-version-disclosure",
      "severity": "minor",
      "title": "Server header discloses version information",
      "detail": "The server header ('nginx/1.24.0 (Ubuntu)') discloses software/version details useful for targeting known vulnerabilities.",
      "evidence": {
        "header": "server",
        "value": "nginx/1.24.0 (Ubuntu)"
      }
    },
    {
      "type": "finding",
      "id": 2809,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "wcag",
      "tier": 0,
      "rule": "button-name",
      "severity": "critical",
      "title": "Buttons must have discernible text",
      "detail": "Ensure buttons have discernible text https://dequeuniversity.com/rules/axe/4.10/button-name?application=axeAPI",
      "evidence": {
        "impact": "critical",
        "nodes": [
          {
            "selector": "button[data-testid=\"nav-dashboard\"]",
            "snippet": "<button data-testid=\"nav-dashboard\"></button>"
          },
          {
            "selector": "button[data-testid=\"nav-login\"]",
            "snippet": "<button data-testid=\"nav-login\"></button>"
          },
          {
            "selector": "button[data-testid=\"nav-forms\"]",
            "snippet": "<button data-testid=\"nav-forms\"></button>"
          },
          {
            "selector": "button[data-testid=\"nav-grid\"]",
            "snippet": "<button data-testid=\"nav-grid\"></button>"
          },
          {
            "selector": "button[data-testid=\"nav-async\"]",
            "snippet": "<button data-testid=\"nav-async\"></button>"
          }
        ],
        "node_count": 5,
        "tags": [
          "cat.name-role-value",
          "wcag2a",
          "wcag412",
          "section508",
          "section508.22.a",
          "TTv5",
          "TT6.a",
          "EN-301-549",
          "EN-9.4.1.2",
          "ACT"
        ]
      }
    },
    {
      "type": "finding",
      "id": 2810,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "wcag",
      "tier": 0,
      "rule": "color-contrast",
      "severity": "serious",
      "title": "Elements must meet minimum color contrast ratio thresholds",
      "detail": "Ensure the contrast between foreground and background colors meets WCAG 2 AA minimum contrast ratio thresholds https://dequeuniversity.com/rules/axe/4.10/color-contrast?application=axeAPI",
      "evidence": {
        "impact": "serious",
        "nodes": [
          {
            "selector": "h1",
            "snippet": "<h1 data-testid=\"app-title\">QA KSink Site</h1>"
          }
        ],
        "node_count": 1,
        "tags": [
          "cat.color",
          "wcag2aa",
          "wcag143",
          "TTv5",
          "TT13.c",
          "EN-301-549",
          "EN-9.1.4.3",
          "ACT"
        ]
      }
    },
    {
      "type": "finding",
      "id": 2811,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "wcag",
      "tier": 0,
      "rule": "html-has-lang",
      "severity": "serious",
      "title": "<html> element must have a lang attribute",
      "detail": "Ensure every HTML document has a lang attribute https://dequeuniversity.com/rules/axe/4.10/html-has-lang?application=axeAPI",
      "evidence": {
        "impact": "serious",
        "nodes": [
          {
            "selector": "html",
            "snippet": "<html>"
          }
        ],
        "node_count": 1,
        "tags": [
          "cat.language",
          "wcag2a",
          "wcag311",
          "TTv5",
          "TT11.a",
          "EN-301-549",
          "EN-9.3.1.1",
          "ACT"
        ]
      }
    },
    {
      "type": "finding",
      "id": 2812,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "ux",
      "tier": 0,
      "rule": "ux/lighthouse/performance",
      "severity": "info",
      "title": "Lighthouse Performance score: 1",
      "detail": "Lighthouse category 'Performance' scored 1 (0-1 scale).",
      "evidence": {
        "category": "performance",
        "score": 1
      }
    },
    {
      "type": "finding",
      "id": 2813,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "ux",
      "tier": 0,
      "rule": "ux/lighthouse/accessibility",
      "severity": "moderate",
      "title": "Lighthouse Accessibility score: 0.56",
      "detail": "Lighthouse category 'Accessibility' scored 0.56 (0-1 scale).",
      "evidence": {
        "category": "accessibility",
        "score": 0.56
      }
    },
    {
      "type": "finding",
      "id": 2814,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "ux",
      "tier": 0,
      "rule": "ux/lighthouse/best-practices",
      "severity": "info",
      "title": "Lighthouse Best Practices score: 1",
      "detail": "Lighthouse category 'Best Practices' scored 1 (0-1 scale).",
      "evidence": {
        "category": "best-practices",
        "score": 1
      }
    },
    {
      "type": "finding",
      "id": 2815,
      "url": "https://qa-bugs.lab980.com",
      "pipeline": "wcag",
      "tier": 2,
      "rule": "wcag/1.4.3",
      "severity": "serious",
      "title": "Insufficient color contrast on page text/UI elements",
      "detail": "Low-vision users and users in bright-light conditions may be unable to read text or distinguish UI components (e.g., nav buttons, headings, article text) if contrast ratio falls below 4.5:1 for normal text or 3:1 for large text/UI components. Without direct rendering access, this cannot be fully confirmed, but the flag indicates measured contrast failures. Fix: verify actual foreground/background color pairs for header nav buttons, h1/h2 headings, and article text against WCAG contrast thresholds, and adjust colors (e.g., darken text or lighten background) to meet minimum ratios.",
      "evidence": {
        "selector": "header nav button, h1, h2, article",
        "note": "Cannot visually confirm exact colors from skeleton alone; recommend automated contrast checker (e.g., axe, Lighthouse) run against rendered page to pinpoint exact failing elements."
      }
    }
  ],
  "errors": []
}