Tag
68 posts tagged.
The call returns 200 and the body may still be a truncated fragment, a safety refusal, or a value invented to fill the schema. Both providers document all three as normal successful responses, and the one field that tells them apart is the field a generated application is least likely to read.
A builder and its tester only ever occupy the first-party context, where cookies and client storage behave one way. The identical code embedded in someone else's page may be handed a different, empty store, and the governing draft permits a user agent to return an empty cookie-string with no error at all.
The person testing a freshly generated app has an empty credential store on a brand new origin, so nothing is offered and every form looks the same. This proposal scores whether field purposes are declared, whether a credential pair is distinguishable, whether a save is ever offered, and whether identifiers survive a redeploy.
The person who renames a record is the one holding the new address, so the only copy of the old one is in somebody else's bookmark. This proposal scores whether a retired address still resolves, whether the redirect is resolved from data at request time, and whether a deliberate removal is distinguishable from a typo.
The only file an importer is ever given during development is one the exporter wrote, so it cannot fail. This proposal scores what is actually in the table when a real file stops at row 7,412, who is told which row it was, and what happens when the corrected file is uploaded again.
Nobody prints their own application. The person who could notice a missing column already has it on screen, and the person holding the paper never knew the column was there. This proposal scores what survives the page box, the ink default and the break that nobody declared.
Everyone who tests a camera or location feature presses Allow, and the browser then stops asking. This proposal scores the path nobody sees: what the app does after somebody taps Block, and whether it can tell that refusal from the header, the scheme or the missing gesture that share its name.
Deploying and then looking is one motion, so every client you observe loaded after your newest build. This proposal scores what happens to the tab that did not. Rubric and protocol published before any measurement.
A script element without integrity metadata does not request a specific script. It requests whatever the host at that address is serving when a visitor arrives. A pre-registration for a third-party script integrity axis, with the two specifications that make the half-fix fail harder than the no-fix.
Every measurement a developer makes of their own generated app is taken in a browser profile that has already agreed once. A pre-registration for a consent-gating axis, with the platform documents that make the defect reachable by accident.
An AI app builder is validated in one browser tab, and every defect in this class needs two. A pre-registration for a multi-tab state coherence axis, with the platform documents that state both the hazard and the remedy.
A proposed benchmark axis for what a generated app does with a string a person typed when it puts that string back on a page. MDN documents that injected script elements do not execute, so the folk test returns a clean pass on a build that is not safe. Both failure directions are scored: markup that runs, and a surname that renders as punctuation it never contained.
