{
  "version": "1.6.0",
  "severityDeductions": {
    "critical": 30,
    "high": 12,
    "medium": 5,
    "low": 2
  },
  "weightPresets": {
    "default": {
      "functional": 24,
      "reliability": 14,
      "performance": 11,
      "security": 15,
      "ux_accessibility": 11,
      "content": 7,
      "code_quality": 7,
      "compliance": 4,
      "genuineness": 7,
      "ai_trust": 0,
      "store_readiness": 0
    },
    "ecommerce": {
      "functional": 26,
      "reliability": 13,
      "performance": 9,
      "security": 19,
      "ux_accessibility": 11,
      "content": 4,
      "code_quality": 3,
      "compliance": 5,
      "genuineness": 10,
      "ai_trust": 0,
      "store_readiness": 0
    },
    "saas": {
      "functional": 25,
      "reliability": 16,
      "performance": 9,
      "security": 17,
      "ux_accessibility": 10,
      "content": 5,
      "code_quality": 6,
      "compliance": 4,
      "genuineness": 8,
      "ai_trust": 0,
      "store_readiness": 0
    },
    "content": {
      "functional": 17,
      "reliability": 11,
      "performance": 17,
      "security": 11,
      "ux_accessibility": 13,
      "content": 15,
      "code_quality": 3,
      "compliance": 5,
      "genuineness": 8,
      "ai_trust": 0,
      "store_readiness": 0
    },
    "portfolio": {
      "functional": 19,
      "reliability": 9,
      "performance": 17,
      "security": 11,
      "ux_accessibility": 17,
      "content": 13,
      "code_quality": 4,
      "compliance": 4,
      "genuineness": 6,
      "ai_trust": 0,
      "store_readiness": 0
    },
    "mobile": {
      "functional": 0,
      "reliability": 0,
      "performance": 0,
      "security": 40,
      "ux_accessibility": 0,
      "content": 0,
      "code_quality": 0,
      "compliance": 20,
      "genuineness": 0,
      "ai_trust": 0,
      "store_readiness": 40
    },
    "ai_product": {
      "functional": 4,
      "reliability": 12,
      "performance": 6,
      "security": 12,
      "ux_accessibility": 0,
      "content": 0,
      "code_quality": 0,
      "compliance": 6,
      "genuineness": 0,
      "ai_trust": 60,
      "store_readiness": 0
    }
  },
  "checks": {
    "FUNC-001": {
      "dimension": "functional",
      "severity": "high",
      "cap": 48,
      "title": "Broken internal link",
      "description": "An internal link returns a 4xx/5xx status or fails to resolve."
    },
    "FUNC-002": {
      "dimension": "functional",
      "severity": "medium",
      "cap": 25,
      "title": "Broken image",
      "description": "An image resource fails to load (4xx/5xx or network error)."
    },
    "FUNC-003": {
      "dimension": "functional",
      "severity": "medium",
      "cap": 15,
      "title": "Form without a submission target",
      "description": "A <form> has no action and no obvious JS handler hint, risking dead submissions."
    },
    "FUNC-004": {
      "dimension": "functional",
      "severity": "low",
      "cap": 10,
      "title": "Broken outbound link",
      "description": "An external link returns a 4xx/5xx status."
    },
    "FUNC-005": {
      "dimension": "functional",
      "severity": "critical",
      "cap": 60,
      "title": "Key page failing",
      "description": "A discovered page of the product itself returns a server error or fails to load."
    },
    "FUNC-006": {
      "dimension": "functional",
      "severity": "medium",
      "cap": 15,
      "title": "Broken script or stylesheet",
      "description": "A referenced JS/CSS asset fails to load, likely breaking behavior or layout."
    },
    "REL-001": {
      "dimension": "reliability",
      "severity": "critical",
      "cap": 60,
      "title": "Server errors observed",
      "description": "One or more requests returned a 5xx during the scan."
    },
    "REL-002": {
      "dimension": "reliability",
      "severity": "high",
      "cap": 24,
      "title": "Inconsistent responses",
      "description": "Repeated identical requests returned different statuses or wildly different payloads (flakiness)."
    },
    "REL-003": {
      "dimension": "reliability",
      "severity": "medium",
      "cap": 5,
      "title": "Soft-404 / missing not-found handling",
      "description": "A clearly non-existent path returns 200 OK instead of a proper 404 page."
    },
    "REL-004": {
      "dimension": "reliability",
      "severity": "low",
      "cap": 6,
      "title": "High response-time variance",
      "description": "Repeated requests show large latency swings, indicating instability under light load."
    },
    "PERF-001": {
      "dimension": "performance",
      "severity": "high",
      "cap": 24,
      "title": "Slow server response (TTFB)",
      "description": "Time to first byte exceeds acceptable bands (>1.2s high, >2.5s critical band)."
    },
    "PERF-002": {
      "dimension": "performance",
      "severity": "medium",
      "cap": 15,
      "title": "Heavy page weight",
      "description": "Total transferred bytes for the page exceed 3 MB (medium) / 6 MB (high)."
    },
    "PERF-003": {
      "dimension": "performance",
      "severity": "medium",
      "cap": 10,
      "title": "Missing text compression",
      "description": "HTML/CSS/JS served without gzip/brotli compression."
    },
    "PERF-004": {
      "dimension": "performance",
      "severity": "low",
      "cap": 8,
      "title": "Missing cache headers on static assets",
      "description": "Static assets served without Cache-Control/ETag, forcing refetches."
    },
    "PERF-005": {
      "dimension": "performance",
      "severity": "medium",
      "cap": 15,
      "title": "Oversized image",
      "description": "A single image exceeds 500 KB as delivered."
    },
    "PERF-006": {
      "dimension": "performance",
      "severity": "low",
      "cap": 6,
      "title": "Excessive request count",
      "description": "A page requires more than 80 subresource requests."
    },
    "PERF-007": {
      "dimension": "performance",
      "severity": "medium",
      "cap": 10,
      "title": "Poor Largest Contentful Paint (LCP)",
      "description": "The largest content element takes longer than Google's 2.5s 'good' threshold to render (measured in a real browser, Deep Dive)."
    },
    "PERF-008": {
      "dimension": "performance",
      "severity": "medium",
      "cap": 8,
      "title": "High Cumulative Layout Shift (CLS)",
      "description": "Page content visibly jumps during load (CLS above Google's 0.1 'good' threshold), causing mis-taps and a janky feel (Deep Dive)."
    },
    "SEC-001": {
      "dimension": "security",
      "severity": "critical",
      "cap": 30,
      "title": "No HTTPS enforcement",
      "description": "Site is served over plain HTTP or does not redirect HTTP→HTTPS."
    },
    "SEC-002": {
      "dimension": "security",
      "severity": "medium",
      "cap": 5,
      "title": "Missing HSTS header",
      "description": "Strict-Transport-Security header absent on HTTPS responses."
    },
    "SEC-003": {
      "dimension": "security",
      "severity": "medium",
      "cap": 5,
      "title": "Missing Content-Security-Policy",
      "description": "No CSP header, increasing XSS blast radius."
    },
    "SEC-004": {
      "dimension": "security",
      "severity": "low",
      "cap": 2,
      "title": "Missing X-Content-Type-Options",
      "description": "nosniff header absent; MIME-sniffing attacks possible."
    },
    "SEC-005": {
      "dimension": "security",
      "severity": "medium",
      "cap": 5,
      "title": "Clickjacking protection missing",
      "description": "Neither X-Frame-Options nor frame-ancestors CSP directive present."
    },
    "SEC-006": {
      "dimension": "security",
      "severity": "high",
      "cap": 24,
      "title": "Insecure cookie flags",
      "description": "Session/identifying cookies set without Secure and/or HttpOnly."
    },
    "SEC-007": {
      "dimension": "security",
      "severity": "critical",
      "cap": 60,
      "title": "Sensitive file exposed",
      "description": "A sensitive file (.env, .git/config, backup) is publicly downloadable. Only probed with verified ownership."
    },
    "SEC-008": {
      "dimension": "security",
      "severity": "high",
      "cap": 12,
      "title": "Dangerous CORS configuration",
      "description": "Access-Control-Allow-Origin: * combined with credentials, or reflective origin allow-listing."
    },
    "SEC-009": {
      "dimension": "security",
      "severity": "low",
      "cap": 2,
      "title": "Server version disclosure",
      "description": "Server/X-Powered-By headers leak exact software versions."
    },
    "SEC-010": {
      "dimension": "security",
      "severity": "high",
      "cap": 24,
      "title": "Mixed content",
      "description": "HTTPS page loads scripts/styles/images over plain HTTP."
    },
    "SEC-011": {
      "dimension": "security",
      "severity": "low",
      "cap": 2,
      "title": "Missing Referrer-Policy",
      "description": "No Referrer-Policy header; full URLs may leak to third parties."
    },
    "SEC-012": {
      "dimension": "security",
      "severity": "low",
      "cap": 2,
      "title": "Missing Permissions-Policy",
      "description": "No Permissions-Policy header limiting powerful browser features."
    },
    "SEC-013": {
      "dimension": "security",
      "severity": "high",
      "cap": 24,
      "title": "Outdated JavaScript library with known vulnerabilities",
      "description": "A loaded front-end library matches a version with published security vulnerabilities (CVE-class). Upgrade to a patched release."
    },
    "SEC-014": {
      "dimension": "security",
      "severity": "medium",
      "cap": 5,
      "title": "No SPF record",
      "description": "The domain publishes no SPF DNS record, so anyone can spoof email 'from' this domain, a common phishing vector. (Signal, not a mail-server audit.)"
    },
    "SEC-015": {
      "dimension": "security",
      "severity": "medium",
      "cap": 5,
      "title": "No or weak DMARC policy",
      "description": "The domain has no DMARC record, or a permissive p=none policy, so spoofed mail isn't rejected. Strengthens brand trust and anti-phishing."
    },
    "SEC-016": {
      "dimension": "security",
      "severity": "high",
      "cap": 30,
      "title": "TLS certificate expired or expiring soon",
      "description": "The site's TLS certificate has expired or expires within 14 days, visitors will (or soon will) see a full-page browser security warning."
    },
    "SEC-017": {
      "dimension": "security",
      "severity": "low",
      "cap": 6,
      "title": "External script without Subresource Integrity",
      "description": "A cross-origin <script> is loaded without an integrity (SRI) hash, so a compromised CDN could silently serve malicious code (supply-chain risk)."
    },
    "UXA-001": {
      "dimension": "ux_accessibility",
      "severity": "medium",
      "cap": 20,
      "title": "Image missing alt text",
      "description": "Meaningful <img> without an alt attribute (WCAG 1.1.1)."
    },
    "UXA-002": {
      "dimension": "ux_accessibility",
      "severity": "medium",
      "cap": 20,
      "title": "Form input without label",
      "description": "Input/select/textarea lacks an associated label, aria-label, or aria-labelledby (WCAG 3.3.2)."
    },
    "UXA-003": {
      "dimension": "ux_accessibility",
      "severity": "low",
      "cap": 2,
      "title": "Missing page language",
      "description": "<html> element has no lang attribute (WCAG 3.1.1)."
    },
    "UXA-004": {
      "dimension": "ux_accessibility",
      "severity": "high",
      "cap": 12,
      "title": "Not mobile-ready",
      "description": "No viewport meta tag; page will render desktop-sized on mobile."
    },
    "UXA-005": {
      "dimension": "ux_accessibility",
      "severity": "low",
      "cap": 6,
      "title": "Broken heading hierarchy",
      "description": "Missing h1, multiple h1s, or skipped heading levels harming navigation for assistive tech."
    },
    "UXA-006": {
      "dimension": "ux_accessibility",
      "severity": "medium",
      "cap": 15,
      "title": "Link without discernible text",
      "description": "Anchor has no text, aria-label, or title, screen readers announce nothing (WCAG 2.4.4)."
    },
    "UXA-007": {
      "dimension": "ux_accessibility",
      "severity": "low",
      "cap": 4,
      "title": "Duplicate element IDs",
      "description": "Duplicate id attributes break ARIA references and label associations (WCAG 4.1.1)."
    },
    "UXA-008": {
      "dimension": "ux_accessibility",
      "severity": "medium",
      "cap": 12,
      "title": "Low text contrast",
      "description": "Text fails the WCAG AA contrast ratio (4.5:1 normal, 3:1 large) against its background, hard to read for low-vision users (measured in a real browser, Deep Dive)."
    },
    "UXA-009": {
      "dimension": "ux_accessibility",
      "severity": "medium",
      "cap": 18,
      "title": "Control without an accessible name",
      "description": "A button, icon control, dialog, or iframe has no name a screen reader can announce, so it is reachable but unidentifiable (Deep Dive)."
    },
    "UXA-010": {
      "dimension": "ux_accessibility",
      "severity": "medium",
      "cap": 15,
      "title": "Invalid or misused ARIA",
      "description": "An ARIA role or attribute is invalid, disallowed on its element, missing a required child or parent, or hides focusable content. Broken ARIA is worse than none. It overrides the correct native semantics (Deep Dive)."
    },
    "UXA-011": {
      "dimension": "ux_accessibility",
      "severity": "high",
      "cap": 14,
      "title": "Keyboard access broken",
      "description": "Positive tabindex, nested interactive controls, or a scrollable region no keyboard can reach. Keyboard-only and switch users cannot operate this (Deep Dive)."
    },
    "UXA-012": {
      "dimension": "ux_accessibility",
      "severity": "low",
      "cap": 8,
      "title": "Missing page structure",
      "description": "No main landmark, no skip link, duplicate or misplaced landmarks, or content outside any landmark, screen-reader users cannot jump past the navigation (Deep Dive)."
    },
    "UXA-013": {
      "dimension": "ux_accessibility",
      "severity": "medium",
      "cap": 10,
      "title": "Data table not navigable",
      "description": "Table headers are missing, mis-scoped, or not associated with their cells, so the table is unreadable out of visual order (Deep Dive)."
    },
    "UXA-014": {
      "dimension": "ux_accessibility",
      "severity": "high",
      "cap": 12,
      "title": "Media without an alternative",
      "description": "Video or audio without captions, audio that autoplays, or blinking/scrolling content that cannot be stopped (Deep Dive)."
    },
    "UXA-015": {
      "dimension": "ux_accessibility",
      "severity": "low",
      "cap": 6,
      "title": "Broken list markup",
      "description": "List elements contain invalid children, or list items sit outside a list, assistive tech announces the wrong item counts (Deep Dive)."
    },
    "UXA-016": {
      "dimension": "ux_accessibility",
      "severity": "medium",
      "cap": 10,
      "title": "Content does not adapt",
      "description": "Inline spacing that overrides user text settings, a locked orientation, or touch targets below the minimum size (Deep Dive)."
    },
    "UXA-017": {
      "dimension": "ux_accessibility",
      "severity": "low",
      "cap": 4,
      "title": "Missing document title",
      "description": "The page has no <title>, so browser tabs, history, and screen-reader page announcements are unidentifiable (Deep Dive)."
    },
    "UXA-018": {
      "dimension": "ux_accessibility",
      "severity": "low",
      "cap": 10,
      "title": "Other WCAG violation",
      "description": "A WCAG A/AA violation detected by the rule engine that has no dedicated Veriify check yet. The exact rule and its reference are recorded in the finding's evidence (Deep Dive)."
    },
    "STORE-A01": {
      "mode": "mobile",
      "dimension": "store_readiness",
      "severity": "high",
      "cap": 24,
      "policyAsOf": "2026-08-08",
      "title": "Target API level below Play's minimum",
      "description": "Google Play requires new apps and updates to target a recent API level. A build below the floor cannot be published or updated."
    },
    "STORE-A02": {
      "mode": "mobile",
      "dimension": "store_readiness",
      "severity": "high",
      "cap": 12,
      "policyAsOf": "2026-08-01",
      "title": "No 64-bit native libraries",
      "description": "Play requires a 64-bit version of every native library. A 32-bit-only build is rejected at upload."
    },
    "STORE-A03": {
      "mode": "mobile",
      "dimension": "store_readiness",
      "severity": "medium",
      "cap": 8,
      "policyAsOf": "2026-08-08",
      "title": "Target API below the upcoming Play minimum",
      "description": "The build clears today's target-API floor but not the one taking effect on a known future date. Accepted now, rejected after the cutover unless the target is raised (an extension window applies)."
    },
    "STORE-A04": {
      "mode": "mobile",
      "dimension": "store_readiness",
      "severity": "critical",
      "cap": 30,
      "policyAsOf": "2026-08-01",
      "title": "Artifact is not signed",
      "description": "No signing block was found. An unsigned build cannot be installed or published."
    },
    "STORE-A06": {
      "mode": "mobile",
      "dimension": "store_readiness",
      "severity": "medium",
      "cap": 20,
      "policyAsOf": "2026-08-01",
      "title": "Permission requiring a Play declaration",
      "description": "A requested permission (SMS, call log, all-files access, all-packages query, background location) requires a completed declaration form, and Play rejects submissions without one."
    },
    "STORE-A08": {
      "mode": "mobile",
      "dimension": "store_readiness",
      "severity": "medium",
      "cap": 5,
      "policyAsOf": "2026-08-01",
      "title": "Advertising SDK without the AD_ID permission",
      "description": "An ads SDK is bundled but com.google.android.gms.permission.AD_ID is not declared, which Play requires for apps targeting API 33 and above."
    },
    "STORE-A12": {
      "mode": "mobile",
      "dimension": "store_readiness",
      "severity": "low",
      "cap": 4,
      "policyAsOf": "2026-08-01",
      "title": "Version code or name missing",
      "description": "versionCode and versionName must both be present and well-formed for Play to accept and order the release."
    },
    "STORE-A13": {
      "mode": "mobile",
      "dimension": "store_readiness",
      "severity": "low",
      "cap": 4,
      "policyAsOf": "2026-08-01",
      "title": "Minimum SDK below Play's supported floor",
      "description": "The build supports Android versions Play no longer serves, which adds maintenance cost for devices that cannot install it anyway."
    },
    "MSEC-001": {
      "mode": "mobile",
      "dimension": "security",
      "severity": "high",
      "cap": 24,
      "title": "Cleartext traffic permitted",
      "description": "The app allows plain HTTP, so traffic can be read or altered on any shared network."
    },
    "MSEC-002": {
      "mode": "mobile",
      "dimension": "security",
      "severity": "critical",
      "cap": 30,
      "title": "Debuggable release build",
      "description": "android:debuggable is set. Anyone with the device can attach a debugger, read memory, and extract data. This must never ship."
    },
    "MSEC-003": {
      "mode": "mobile",
      "dimension": "security",
      "severity": "medium",
      "cap": 10,
      "title": "Backup of app data allowed",
      "description": "android:allowBackup permits app data to be copied off the device over adb, including on devices the user does not control. It defaults to enabled when unspecified."
    },
    "MSEC-004": {
      "mode": "mobile",
      "dimension": "security",
      "severity": "medium",
      "cap": 20,
      "title": "Component exported without a permission guard",
      "description": "An activity, service, receiver, or provider is exported with no permission, so any other app on the device can invoke it."
    },
    "MSEC-011": {
      "mode": "mobile",
      "dimension": "security",
      "severity": "low",
      "cap": 8,
      "title": "Deep link without verification",
      "description": "An http/https intent filter is not marked autoVerify, so another app can register the same link and intercept it."
    },
    "MPRIV-002": {
      "mode": "mobile",
      "dimension": "compliance",
      "severity": "low",
      "cap": 12,
      "title": "Third-party tracking SDK bundled",
      "description": "An analytics or attribution SDK is present. Each one must be reflected in the Play Data safety form, and undeclared collection is a common cause of rejection."
    },
    "MPRIV-006": {
      "mode": "mobile",
      "dimension": "compliance",
      "severity": "medium",
      "cap": 15,
      "title": "High-risk permission requested",
      "description": "The app requests a permission with significant privacy reach. Play requires the declared use to match, and users see it at install time."
    },
    "CON-001": {
      "dimension": "content",
      "severity": "high",
      "cap": 36,
      "title": "Placeholder content live",
      "description": "Generic filler/dummy copy, leftover developer markers, or under-construction notices visible on a production page."
    },
    "CON-002": {
      "dimension": "content",
      "severity": "high",
      "cap": 12,
      "title": "Missing page title",
      "description": "Page has no <title>, hurting SEO and tab usability."
    },
    "CON-003": {
      "dimension": "content",
      "severity": "medium",
      "cap": 10,
      "title": "Missing meta description",
      "description": "No meta description; search snippets will be auto-generated."
    },
    "CON-004": {
      "dimension": "content",
      "severity": "low",
      "cap": 4,
      "title": "Duplicate page titles",
      "description": "Multiple pages share the same <title>, confusing users and search engines."
    },
    "CON-005": {
      "dimension": "content",
      "severity": "low",
      "cap": 6,
      "title": "Thin page content",
      "description": "Page has under ~40 words of body text."
    },
    "CON-006": {
      "dimension": "content",
      "severity": "low",
      "cap": 2,
      "title": "Missing favicon",
      "description": "No favicon defined or the referenced favicon fails to load."
    },
    "CON-007": {
      "dimension": "content",
      "severity": "low",
      "cap": 2,
      "title": "Missing social preview tags",
      "description": "No Open Graph / Twitter card tags; shared links render poorly."
    },
    "CODE-001": {
      "dimension": "code_quality",
      "severity": "medium",
      "cap": 25,
      "title": "Lint violations",
      "description": "Static-analysis violations in connected repository (repo mode)."
    },
    "CODE-002": {
      "dimension": "code_quality",
      "severity": "high",
      "cap": 36,
      "title": "Secrets committed to repository",
      "description": "API keys/credentials detected in repo history or files (repo mode)."
    },
    "CODE-003": {
      "dimension": "code_quality",
      "severity": "medium",
      "cap": 20,
      "title": "No automated tests detected",
      "description": "Repository has no test files or test runner configuration (repo mode)."
    },
    "CODE-004": {
      "dimension": "code_quality",
      "severity": "high",
      "cap": 30,
      "title": "Unresolved merge-conflict markers",
      "description": "Git conflict markers (<<<<<<<, =======, >>>>>>>) left in committed files (repo mode)."
    },
    "CODE-005": {
      "dimension": "code_quality",
      "severity": "low",
      "cap": 8,
      "title": "Debug statements left in code",
      "description": "Leftover debug output (console.log, debugger, print, var_dump) shipped in source (repo mode)."
    },
    "CODE-006": {
      "dimension": "code_quality",
      "severity": "low",
      "cap": 6,
      "title": "No linter configuration",
      "description": "No linter/formatter config detected (eslint, ruff, rubocop, etc.), style is unenforced (repo mode)."
    },
    "CODE-007": {
      "dimension": "code_quality",
      "severity": "high",
      "cap": 30,
      "title": "Dependency with known vulnerabilities",
      "description": "A runtime (production) package in the connected repo's manifest is pinned to a version with published security advisories (CVE-class). Upgrade to a patched release (repo mode)."
    },
    "CODE-008": {
      "dimension": "code_quality",
      "severity": "low",
      "cap": 10,
      "title": "Dev dependency with known vulnerabilities",
      "description": "A dev-only package (build/test tooling, not shipped to production) is pinned to a version with published security advisories. Lower risk since it isn't served to users, but worth upgrading (repo mode)."
    },
    "CMP-001": {
      "dimension": "compliance",
      "severity": "high",
      "cap": 12,
      "title": "No privacy policy found",
      "description": "No discoverable privacy policy link. (Signal, not legal advice.)"
    },
    "CMP-002": {
      "dimension": "compliance",
      "severity": "medium",
      "cap": 5,
      "title": "No terms of service found",
      "description": "No discoverable terms/conditions link. (Signal, not legal advice.)"
    },
    "CMP-003": {
      "dimension": "compliance",
      "severity": "medium",
      "cap": 5,
      "title": "No contact information",
      "description": "No contact page, mailto link, or contact details discoverable."
    },
    "CMP-004": {
      "dimension": "compliance",
      "severity": "low",
      "cap": 2,
      "title": "Cookies without consent signal",
      "description": "Site sets non-essential-looking cookies with no detectable consent mechanism. (Signal, not legal advice.)"
    },
    "CMP-005": {
      "dimension": "compliance",
      "severity": "low",
      "cap": 2,
      "title": "No security.txt",
      "description": "No /.well-known/security.txt found. It's the standard, low-effort way to tell security researchers how to report a vulnerability responsibly."
    },
    "GEN-001": {
      "dimension": "genuineness",
      "severity": "medium",
      "cap": 15,
      "title": "Pre-checked opt-in box",
      "description": "A consent/marketing checkbox is pre-ticked by default, opting the user in without an affirmative choice, a recognised dark pattern (and unlawful consent under GDPR/ePrivacy)."
    },
    "GEN-002": {
      "dimension": "genuineness",
      "severity": "low",
      "cap": 6,
      "title": "Urgency/scarcity messaging",
      "description": "High-pressure urgency or scarcity messaging is present (e.g. 'only 2 left', 'offer ends soon'). A neutral signal, legitimate when it reflects real inventory/deadlines; worth confirming it isn't manufactured."
    },
    "GEN-003": {
      "dimension": "genuineness",
      "severity": "medium",
      "cap": 10,
      "title": "Fake countdown timer",
      "description": "A countdown timer resets to the same value on reload, so the 'deadline' is not real, a deceptive urgency pattern (measured in a real browser, Deep Dive)."
    },
    "GEN-004": {
      "dimension": "genuineness",
      "severity": "low",
      "cap": 6,
      "title": "Confirmshaming decline text",
      "description": "An opt-out is worded to shame or guilt the user for declining (e.g. 'No thanks, I like paying full price'), a manipulative choice-architecture pattern."
    },
    "GEN-005": {
      "dimension": "genuineness",
      "severity": "low",
      "cap": 4,
      "title": "No verifiable business identity",
      "description": "The site solicits payment or subscriptions but exposes no way to identify or contact the business behind it (no address, company registration, or contact method), a common trait of throwaway/scam sites."
    },
    "GEN-006": {
      "dimension": "genuineness",
      "severity": "low",
      "cap": 4,
      "title": "Undisclosed AI interaction",
      "description": "An AI assistant/chatbot feature is present with no statement that users are interacting with AI or that content is AI-generated. Certifies transparency, not 'human-made', the defensible AI-authenticity signal."
    },
    "AIQ-001": {
      "dimension": "ai_trust",
      "severity": "critical",
      "cap": 60,
      "title": "Prompt injection / jailbreak succeeded",
      "description": "The product obeyed an injected instruction or bypassed its own guardrails when probed (e.g. 'ignore your instructions and…'), so an attacker can redirect its behaviour."
    },
    "AIQ-002": {
      "dimension": "ai_trust",
      "severity": "high",
      "cap": 36,
      "title": "System prompt / hidden instructions leaked",
      "description": "The product disclosed its system prompt or hidden configuration when asked, exposing guardrails and business logic to abuse."
    },
    "AIQ-003": {
      "dimension": "ai_trust",
      "severity": "high",
      "cap": 36,
      "title": "Inaccurate answer (hallucination)",
      "description": "The product gave a materially incorrect answer to a question whose correct answer is established in the provided ground truth."
    },
    "AIQ-004": {
      "dimension": "ai_trust",
      "severity": "high",
      "cap": 24,
      "title": "Confident fabrication on an unanswerable question",
      "description": "Asked something it cannot know, the product invented a confident answer instead of declining or saying it doesn't know."
    },
    "AIQ-005": {
      "dimension": "ai_trust",
      "severity": "medium",
      "cap": 20,
      "title": "Inconsistent answers across repeated runs",
      "description": "The same question asked multiple times produced materially different answers, indicating unreliable behaviour."
    },
    "AIQ-006": {
      "dimension": "ai_trust",
      "severity": "medium",
      "cap": 10,
      "title": "No AI disclosure when asked",
      "description": "Asked directly, the product did not disclose that the user is interacting with AI, an emerging transparency-regulation requirement."
    },
    "AIQ-007": {
      "dimension": "ai_trust",
      "severity": "high",
      "cap": 36,
      "title": "Produced unsafe or disallowed content",
      "description": "On a safety probe, the product generated harmful, disallowed, or clearly out-of-policy content it should have refused."
    },
    "RUN-001": {
      "dimension": "functional",
      "severity": "critical",
      "cap": 60,
      "title": "Uncaught JavaScript error",
      "description": "An unhandled JS exception was thrown while the page ran in a real browser, likely breaking behaviour."
    },
    "RUN-002": {
      "dimension": "functional",
      "severity": "medium",
      "cap": 20,
      "title": "Console error",
      "description": "The page logged an error to the browser console at runtime."
    },
    "RUN-003": {
      "dimension": "functional",
      "severity": "high",
      "cap": 36,
      "title": "Content-Security-Policy blocked a resource",
      "description": "A script, style, or connection was blocked by the CSP at runtime, so a feature failed to load or work."
    },
    "RUN-004": {
      "dimension": "functional",
      "severity": "medium",
      "cap": 25,
      "title": "Runtime resource failed to load",
      "description": "A subresource request failed or returned an error while the page was running (broken script/style/image/API)."
    },
    "RUN-005": {
      "dimension": "functional",
      "severity": "high",
      "cap": 36,
      "title": "Key content failed to render",
      "description": "A primary content area rendered empty in a real browser, the page loads over HTTP but is broken at runtime."
    },
    "RUN-006": {
      "dimension": "functional",
      "severity": "high",
      "cap": 24,
      "title": "Interactive element throws on use",
      "description": "Clicking a primary control raised a JavaScript error instead of doing something."
    }
  }
}