Transparency

At a glance

• 110 then 109Apps measured
• 0 and 0XSS executed under CSP
• 0 and 0Prototype pollution
• 109 of 110Apps with a service worker
• 398 app-level findings, see belowOpen findings of any kind

What was checked

• Audit 1 (2026-10-21): 110 apps. Audit 2 (2026-10-22): 109 apps measured again, with a different and stricter method. The multi-file repository Pendulul is a book, not a web app, and is excluded from audit 2.
• Chromium headless (Playwright), desktop 1366×850 and mobile 360×740 with touch, ro-RO locale.
• Security: hostile text in every field (580 injections in 301 fields in audit 1), hostile file uploads (JSON with __proto__, CSV with formulas, random binary, 5 MB text), payloads in URL and hash, about 2001 random clicks, a run with the CSP removed to detect latent execution.
• Accessibility: axe-core (WCAG 2.0/2.1/2.2 A and AA), keyboard traversal and focus visibility, accessible names, exactly one H1, zoom not blocked, touch targets of at least 24 px, text of at least 12 px, horizontal overflow at 360 px.
• Offline: every app reopened after a first visit with the network cut; presence and behaviour of the service worker.
• Honesty of the technical label (fff-info): service worker, hosts, languages, size; catalog versions compared with the apps.
• Storage: localStorage keys without the app prefix, collisions on a shared origin, secrets kept in clear text.

Not evaluated: correctness of content (game rules, astronomical data, quality of translations), Safari and iOS, real devices. 3D apps ran with software rendering, so their timings are pessimistic. The per-app sheets of audit 1 contained simulated user reviews; they are not reproduced here.

Results of the two audits

The two scoring formulas differ (audit 1: base 8.0 with penalties and a manual adjustment; audit 2: 10 minus automatic deductions), so the two means must not be compared with each other.

Score distribution

What has been fixed

What remains open

• 100 apps are already served from their own subdomain (<slug>.chiuta.ro). 12 apps in the hub, some of which keep personal data, still share the chiuta.ro origin until they move to their own repositories (see docs/DOMENII.md). Apps on one origin can read each other's local data. Needs third parties or infrastructure
• Licence and rights questions: a GPL-derived data table, a non-commercial model, missing NOTICE files, rights over a drawing, an errata page. Author's decision
• Native-speaker review of Hungarian and German; specialist review (medical, legal, emergency) of sensitive content. Author's decision
• Overlapping apps that could be merged (the two numerology apps, the four relaxation apps) and an own source for the VNTV index. Author's decision
• HTTP security headers (X-Frame-Options, frame-ancestors) cannot be set on GitHub Pages; the frame-buster in the shared kit is the mitigation. Platform limit
• Safari, iOS and real devices were not tested; content correctness was not audited. Platform limit
• Malformed-looking host names in the technical label: audit 2 counted 1, the stricter live check flags 21. Different detectors, so the numbers are not comparable; the entries still need inspection. Technical, feasible
• Details and exact steps: docs/DOMENII.md and docs/DECIZII-AUTOR.md.

Health of external sources

Some apps depend on data from outside (catalogues, statistics, documentation, public APIs). A scheduled job re-checks them without touching the apps: a change that looks wrong is not applied and opens an issue instead.

30 sources in the inventory: 15 checked automatically, 15 listed only (not probed or still to be confirmed).

A source is marked outdated when its last success is older than twice its cadence. Frozen sources never expire. “Inventory only” sources are never downloaded.

Portfolio health

Six indicators computed from the hub files alone (cards, catalog, flows, source health, measured audit); recomputed and compared in CI, so the table cannot drift from the facts.

Measured audit

Every number below comes from a command that was run on the files in this repository on 2026-11-08: build check, axe-core, the app’s own tests, and static facts read from the page. Nothing is estimated; a component that could not be run is marked and the score is flagged incomplete.

Score 0–10 = build check 2 + axe-core 2 (0 violations in 8 scenarios: page and dialog, 360 and 1366 px, light and dark) + own tests 2 (share of test files that pass; no tests = 0) + CSP 1.5 (connect-src none and hash-only scripts = 1.5; declared allow-list = 1; policy present = 0.5) + offline 1 (service worker, manifest and no declared egress = 1; with egress = 0.5) + languages 1 (n/8) + size 0.5 (≤1 MB = 0.5, ≤2 MB = 0.35, ≤4 MB = 0.2, larger = 0.1).

Mean 9.42, median 9.5 over 117 apps · 117 builds pass · 117 pass axe · 113 apps pass all their tests · 0 have no tests

A dash means not measured. “!” marks an incomplete measurement (for example axe timed out on a very heavy page). Rerun: node tools/audit-run.mjs, then node tools/transparenta.mjs audit.

Measured audit — native programs

The four programs written in Rust are not web pages, so the web formula (axe, CSP, service worker) does not apply. Their score 0–10 uses the same total weight with a native grid, every item run on 2026-11-07 with Rust 1.97 on the repository files: build cargo build --release --locked 2 + clippy 2 (no warnings = 2, warnings only = 1, errors = 0) + tests cargo test --workspace 2 + cargo fmt --check 1.5 + dependencies 1 (up to 150 = 1, up to 400 = 0.5) + interface languages 1 (languages/8) + binary size 0.5 (up to 10 MB = 0.5, up to 30 MB = 0.35).

Apps, state at the snapshot

Offline: “fully” = service worker and no external host; “partly” = service worker, but some features need the internet. Findings: C critical, H high, M medium, L low (audit 2, 22 Oct).

OSATURA, VERIGA, TEZAUR and LegatorOCR are not HTML apps of this collection: they were not part of the audits and are not counted in the figures above; their rows show only what the catalog cards state.

Reproduce

node tools/transparenta.mjs collect   (reads the audit files and the repositories)
node tools/transparenta.mjs build     (writes transparenta.html)
node tools/transparenta.mjs --check   (fails if the page is out of date)