HAAM · Website quality
Quality,
in the open.
How well does HAAM’s own website work? Measured performance, accessibility, security and privacy, with the evidence and the unfinished work in view.
These results describe the public website at the time of the audit. This is a dated snapshot, not live monitoring.
Download audit data ↓Quality contract
100 is the target. Evidence is the test.
Performance, accessibility, Best Practices and SEO each have a 100/100 Lighthouse target on mobile and desktop. Three runs per page keep a lucky result from becoming the headline. The dated report shows the actual results, warnings and work still to do.
Target not yet verified across the sampled pages
Google PageSpeed Insights ·
Default English homepage /: one Google-run audit per device. The three-run site sample is reported separately.
- Mobile · /: 100 / 100 / 100 / 100
- Desktop · /: 100 / 100 / 100 / 100
Performance / 100 · Accessibility / 100 · Best practices / 100 · SEO / 100
Download audit data ↗Security is checked separately: browser policies, dependency advisories and application review. Automated scores do not certify security or accessibility conformance.
See the HAAM design system ↗Performance
A score needs context.
Three fresh browser runs per page and device preset. The table uses the run with the middle performance score; every other metric comes from that same run. All runs remain available below.
| Page / preset | Performance / 100 | Accessibility / 100 | Best practices / 100 | SEO / 100 | Main content (LCP) | Blocking time (TBT) | Layout shift (CLS) | Data transferred |
|---|---|---|---|---|---|---|---|---|
| /enMobile | 100 | 100 | 100 | 100 | 1.28 s | 0 ms | 0.000 | 0.34 MB |
| /enDesktop | 100 | 100 | 100 | 100 | 0.40 s | 0 ms | 0.000 | 0.36 MB |
| /en/aboutMobile | 100 | 100 | 100 | 100 | 1.21 s | 5 ms | 0.000 | 0.27 MB |
| /en/aboutDesktop | 100 | 100 | 100 | 100 | 0.39 s | 0 ms | 0.000 | 0.27 MB |
| /en/case-studies/viirusMobile | 98 | 100 | 100 | 100 | 2.30 s | 7 ms | 0.000 | 0.32 MB |
| /en/case-studies/viirusDesktop | 100 | 100 | 100 | 100 | 0.36 s | 0 ms | 0.000 | 0.32 MB |
| /en/startMobile | 100 | 100 | 100 | 100 | 1.19 s | 1 ms | 0.000 | 0.38 MB |
| /en/startDesktop | 100 | 100 | 100 | 100 | 0.37 s | 0 ms | 0.000 | 0.38 MB |
| /en/web-qualityMobile | 100 | 100 | 100 | 100 | 1.24 s | 5 ms | 0.000 | 0.25 MB |
| /en/web-qualityDesktop | 100 | 100 | 100 | 100 | 0.35 s | 0 ms | 0.000 | 0.25 MB |
| /en/design-systemsMobile | 100 | 100 | 100 | 100 | 1.25 s | 0 ms | 0.000 | 0.34 MB |
| /en/design-systemsDesktop | 100 | 100 | 100 | 100 | 0.37 s | 0 ms | 0.000 | 0.34 MB |
All measurements
Accessibility
Find the barriers. Keep looking.
axe scans cover representative public pages at 390 and 1440 CSS pixels, in light and dark modes, with reduced motion. They include WCAG 2.2 AA rules supported by axe. Automated results do not establish WCAG conformance. Technical findings below are retained in the tool’s original English.
- Browser states tested
- 36
- States without automated violations
- 36
- Distinct rules with violations
- 0
- Checks needing human review
- 82
Open automated findings
No automated violations found in the tested states.
- States with horizontal overflow
- 0
- States with motion despite reduced motion
- 0
- States where the skip-link check failed
- 0
- States with JavaScript errors
- 0
Security
Inspect protections, not a badge.
Passive checks of the public HTTPS response, certificate and browser policies. A missing header is a hardening gap; a present header alone does not establish a safe application. Best-practice scores are not security scores.
- TLS certificate trusted
- Present TLSv1.3
- HTTP redirects to HTTPS
- Present
strict-transport-security- Presentmax-age=63072000
content-security-policy- Presentdefault-src 'self'; script-src 'self' 'unsafe-inline' https://www.googletagmanager.com https://www.clarity.ms https://*.clarity.ms https://challenges.cloudflare.com https://*.clerk.accounts.dev https://clerk.haam.co https://vercel.live; style-src 'self' 'unsafe-inline'; img-src 'self' data: blob: https:; font-src 'self' data:; connect-src 'self' https://*.google-analytics.com https://*.analytics.google.com https://www.googletagmanager.com https://*.clarity.ms https://*.clerk.accounts.dev https://clerk.haam.co https://challenges.cloudflare.com https://vercel.live wss://ws-us3.pusher.com; media-src 'self' blob:; frame-src 'self' https://challenges.cloudflare.com https://*.clerk.accounts.dev https://clerk.haam.co https://vercel.live; object-src 'none'; base-uri 'self'; form-action 'self'; frame-ancestors 'none'; upgrade-insecure-requests
x-content-type-options- Presentnosniff
x-frame-options- PresentDENY
referrer-policy- Presentstrict-origin-when-cross-origin
permissions-policy- Presentcamera=(), microphone=(), geolocation=(), payment=(), usb=()
cross-origin-opener-policy- Presentsame-origin-allow-popups
Production dependency advisories
The advisory check covers production dependencies in the repository’s workspace lockfile, including the iOS app. It is not an inventory of the deployed server. Package names and advisory links are in the downloadable evidence.
Web production dependency paths: critical: 0 · high: 0 · moderate: 0 · low: 0 · info: 0. Advisory entries affecting the web app; workspace totals below also include iOS.
critical: 1 · high: 33 · moderate: 8 · low: 0 · info: 0
Privacy
What reaches outside the page?
Fresh browser sessions, before any analytics consent. These are observed hosts and cookie names, not a legal compliance assessment. First-party proxying and requests after other interactions need separate review.
- Third-party request hosts
- None observed
- Observed cookie names
- lang
- Mixed-content requests
- 0
Search & reliability
Can people and search engines get there?
HTTP and metadata checks cover the English sitemap routes, six language homepages and the canonical identity page. Other translations and complete internal/external link journeys are outside this crawl.
- Public URLs checked
- 81
- Failed public URLs
- 0
- Missing page titles
- 0
- Missing descriptions
- 0
- Missing canonicals
- 0
- Pages without exactly one main heading
- 0
- Sitemap pages marked noindex
- 0
Method & limits
Repeatable, with limits.
Lighthouse uses its default simulated mobile or desktop conditions, a fresh Chrome profile for each run, and the public production server. Server caches may be warm. These are lab observations from this audit machine; real devices and networks will differ. The tool versions and exact settings are retained in the audit files.
Lighthouse 13.5.0 · axe-core 4.11.0 · Chrome 155.0.8059.85
Performance runs collected sequentially, separately from builds and browser accessibility checks. Machine load, public network variability and server cache state were not controlled.
Audit date timezone: Asia/Taipei.
Lighthouse deployed revision: 86dbca6dc2f5bd4d87aba7652d41574b6548b6fe
Browser-check deployed revision: ecee521a90209d5c571da09625a00be290139aa5.
Browser audit before accessibility corrections ↗
Website tested: https://haam.co
Still needs review
- Real-user Core Web Vitals, including interaction latency (INP), are not measured here.
- Full screen-reader journeys, keyboard workflows, 200% text zoom, content quality and all translated pages need human review.
- Authentication, authorization, APIs, provider secrets, backup restoration and penetration testing are outside this public-page audit.
- Transferred bytes are measured; energy use and carbon emissions are not. No carbon rating is inferred.
How to interpret the checks
- Chrome: interpreting Lighthouse scores
- W3C: what automated accessibility tools can check
- OWASP: browser security headers
Technical evidence is published in English.