commit 6c7a360 · ran as web · 61s · ~6k tokens · evidence sealed & signed (manifest.json)
19/30▲ was 18/30
The site is a simple static HTML/CSS page (an MDN beginner tutorial fork) that served correctly and matched the README's content claims when driven live. However, the live probe caught a genuine bug — an insecure http:// font stylesheet causing mixed-content blocking — indicating the CSS/HTML wasn't fully hardened for HTTPS delivery. With no source excerpts, tests, or manifest supplied, code quality must be judged mostly on the visible defect and the minimal nature of the deliverable.
Strengths
- Static site served cleanly with python http.server, no errors on load
- Rendered content matches README claims exactly (heading text, Mozilla Manifesto mention)
- 404 and malformed-request handling did not leak stack traces
Concerns
- Live console shows Mixed Content errors: page loads over HTTPS but references an insecure http:// Google Fonts stylesheet — this is a real, verifiable defect in the shipped markup/CSS, not just an artifact of the proxy
- No source excerpts were actually provided for review (index.html, style.css contents not shown), so code quality can't be verified beyond behavior — scored conservatively
- No test suite, no manifest, no build tooling — acceptable for a beginner HTML/CSS tutorial repo but means there's no automated verification of markup/CSS correctness
- This repo is a copy of an MDN beginner tutorial; almost all substantive content (HTML structure, CSS approach) is templated/prescribed by the tutorial rather than original engineering by the candidate
The submission's own tests
No test command found.
Security sweep
audit: n/a · secrets: no matches
Failure-mode probe
| Check | Status | Trace leaked |
|---|
| GET a route that does not exist | 404 | no |
| POST malformed JSON to / | 501 | no |
README claims, checked by driving the app
- ✅ verified — The landing page displays the heading text 'Mozilla is cool' (all assertions held when the app was driven)
- ✅ verified — The page mentions the Mozilla Manifesto (all assertions held when the app was driven)
Ask the candidate
- The Google Fonts stylesheet link uses http:// instead of https://, causing mixed-content blocking under HTTPS — how would you fix this and why did it happen?
- This repo is largely a copy of an MDN starter tutorial — what specific parts of the HTML/CSS did you personally write or modify versus scaffold from the tutorial?
- If you were to extend this into a real multi-page site, how would you structure the CSS to avoid duplication and handle responsive layout?
What the cloud browser saw (125ms to DOM)
Mobile viewport
Generated by Gauntlet — sandboxes & cloud browsers by Solari, judgment by Claude. Verify this evidence: npm run verify -- <this directory>