Rules Hub

Code Ruleset

On-demand project review

Project Readiness

Find what your product still needs, from its first impression to account closure and recovery from an outage. Browse 90 checks across 25 areas.

Open the complete JSON catalog Setup and usageVersion 2026-09-30.1

Ask your agent: $project-overview Review this project before launch.

Loaded only on request. Your everyday coding rules stay separate. These cards are review criteria; browsing them does not assess a project.

SearchAreaFeature focusRequirement type

Feature focus includes shared checks. Review all applicable areas for a complete assessment; a filtered view is not a complete project profile.

90 of 90 checks shown

Help users locate the next useful action.

Clear navigation and locationGood practice

When it applies: The product has several destinations.
How to verify: Follow each primary link; check active location, logo destination and browser Back behavior.
Evidence to record: Routes exercised and desktop/mobile observations.
Why it matters: Users should be able to recover their location.
Exceptions and limits: A single-purpose screen may need only a return path.
Scope: Project-specific; verify the actual product and deployment

navigation.orientation · Reviewed 2026-09-30

Hero and product story

Make public entry pages understandable.

Explain the product and audienceGood practice

When it applies: A public page introduces the offering.
How to verify: Read the first screen without prior context; identify audience, outcome and next step.
Evidence to record: Exact headline, supporting copy and action.
Why it matters: Visitors need enough context to decide whether to continue.
Exceptions and limits: Internal dashboards do not need a marketing hero.
Scope: Project-specific; verify the actual product and deployment

hero.value · Reviewed 2026-09-30

Show an honest product exampleGood practice

When it applies: The offering is difficult to understand from text.
How to verify: Inspect a real screenshot, demo or example and distinguish concepts from available features.
Evidence to record: Example URL and availability comparison.
Why it matters: Concrete examples reduce mistaken expectations.
Exceptions and limits: Text may fully explain a simple service.
Scope: Project-specific; verify the actual product and deployment

hero.demonstration · Reviewed 2026-09-30

Explain trial commitmentsGood practice

When it applies: An entry page advertises a trial or free tier.
How to verify: Follow signup and compare card requirements, limits and later billing with the claim.
Evidence to record: Entry copy and signup/billing observations.
Why it matters: Users should understand what they are accepting.
Exceptions and limits: Not applicable without a trial or free-tier claim.
Scope: Project-specific; verify the actual product and deployment

hero.trial · Reviewed 2026-09-30

Footer and persistent help

Keep useful destinations available across public pages.

Make the operator and contact discoverableGood practice

When it applies: Visitors need to identify or contact the operator.
How to verify: Verify displayed contact details and operator information against the business owner; check any legally required details separately.
Evidence to record: Contact route and owner-confirmed identity.
Why it matters: People need a reliable point of contact.
Exceptions and limits: Required particulars vary by business and jurisdiction.
Scope: Project-specific; verify the actual product and deployment

footer.identity · Reviewed 2026-09-30

Keep privacy controls reachableGood practice

When it applies: The site offers optional tracking choices.
How to verify: Reopen preferences after dismissing the banner; change and withdraw choices.
Evidence to record: Browser steps and resulting storage/network behavior.
Why it matters: Consent choices should remain changeable.
Exceptions and limits: A site without consent-dependent tracking may need no preference dialog.
Scope: Project-specific; verify the actual product and deployment

footer.privacy-controls · Reviewed 2026-09-30

Put critical information near the decisionGood practice

When it applies: Users submit data, pay or accept terms.
How to verify: Check relevant disclosure at the form or checkout as well as persistent footer links.
Evidence to record: Form/checkout screenshot and policy destination.
Why it matters: A remote footer link alone can leave a decision unclear.
Exceptions and limits: The precise disclosure depends on the transaction.
Scope: Project-specific; verify the actual product and deployment

footer.context · Reviewed 2026-09-30

Content and trust

Support claims and respect ownership.

Use authentic reviewsConditional legal requirement

When it applies: Testimonials, ratings or customer counts are displayed.
How to verify: Trace a sample to permission and provenance; label incentives and explain review verification where relevant.
Evidence to record: Private provenance reference and public presentation.
Why it matters: Fabricated endorsements mislead customers.
Exceptions and limits: A project with no testimonials needs none.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Online consumer protection Checked 2026-09-30

trust.reviews · Reviewed 2026-09-30

Substantiate public claimsConditional legal requirement

When it applies: Copy makes performance, outcome or certification claims.
How to verify: Compare claims with dated evidence and scope; remove invented badges and guarantees.
Evidence to record: Claim-to-evidence references.
Why it matters: Users make decisions based on these statements.
Exceptions and limits: Clearly identified opinion differs from a factual guarantee.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Online consumer protection Checked 2026-09-30

trust.claims · Reviewed 2026-09-30

Avoid coercive choices and fake urgencyConditional legal requirement

When it applies: Flows influence consent, signup, purchase or cancellation.
How to verify: Compare accept/reject paths; inspect preselected extras, countdown resets and obstructive cancellation.
Evidence to record: Side-by-side flow observations.
Why it matters: Users should be able to make an informed choice.
Exceptions and limits: A real deadline or necessary confirmation may be appropriate.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Online consumer protection Checked 2026-09-30

trust.dark-patterns · Reviewed 2026-09-30

Licences and assets

Track rights to material shipped with the product.

Verify font, image and media licencesConditional legal requirement

When it applies: The product distributes or displays third-party assets.
How to verify: Record source, licence, permitted use, attribution and redistribution limits for each asset family.
Evidence to record: Asset inventory and licence references.
Why it matters: Ownership and usage permission are separate questions.
Exceptions and limits: An original asset still needs a clear ownership record.
Scope: Applicable copyright law and individual licence terms; verify territories and distribution model

licensing.assets · Reviewed 2026-09-30

Check third-party software obligationsConditional legal requirement

When it applies: Dependencies or copied snippets are distributed.
How to verify: Review relevant licence terms, notices and distribution obligations for the delivery model.
Evidence to record: Dependency licence report and required notices.
Why it matters: The deployment model can change obligations.
Exceptions and limits: Do not infer legal incompatibility from a licence name alone.
Scope: Applicable copyright law and individual licence terms; verify territories and distribution model

licensing.software · Reviewed 2026-09-30

First use and onboarding

Guide new users to the first useful result.

Reach the first useful resultGood practice

When it applies: The product has setup or onboarding.
How to verify: Use a fresh account, complete one core task and identify unnecessary steps.
Evidence to record: New-account journey and first successful outcome.
Why it matters: Signup alone does not prove usable onboarding.
Exceptions and limits: A simple tool may work without a guided tour.
Scope: Project-specific; verify the actual product and deployment

onboarding.first-success · Reviewed 2026-09-30

Make empty states actionableGood practice

When it applies: Lists, dashboards or workspaces start empty.
How to verify: Test a fresh account and cleared filters; distinguish no data, no results and errors.
Evidence to record: Screenshots and next actions for each state.
Why it matters: Users need to know how to proceed.
Exceptions and limits: Read-only reports can explain why no action is possible.
Scope: Project-specific; verify the actual product and deployment

onboarding.empty-states · Reviewed 2026-09-30

Preserve setup progressGood practice

When it applies: Onboarding spans multiple steps.
How to verify: Leave and resume midway; inspect optional steps and changed answers.
Evidence to record: Resume test and persisted fields.
Why it matters: Interruptions should not force unnecessary repetition.
Exceptions and limits: Sensitive short-lived data may intentionally expire.
Scope: Project-specific; verify the actual product and deployment

onboarding.progress · Reviewed 2026-09-30

Forms and search

Keep input understandable and recoverable.

Explain and preserve invalid inputGood practice

When it applies: A form accepts user input.
How to verify: Submit missing, malformed and boundary values; check field-level messages and retained safe input.
Evidence to record: Inputs tested and resulting errors.
Why it matters: People should be able to correct an error without starting over.
Exceptions and limits: Never repopulate secrets unnecessarily.
Scope: Project-specific; verify the actual product and deployment

forms.validation · Reviewed 2026-09-30

Show a reliable submission outcomeGood practice

When it applies: A form triggers a server action.
How to verify: Test slow response, retry and double click; confirm success only after acceptance.
Evidence to record: Request outcomes and UI states.
Why it matters: Ambiguous submission can lose data or duplicate actions.
Exceptions and limits: Some operations deliberately queue work; say so.
Scope: Project-specific; verify the actual product and deployment

forms.submission · Reviewed 2026-09-30

Handle no matches and filter changesGood practice

When it applies: The product has search or filters.
How to verify: Test zero matches, clear filters, changed query and direct-link navigation.
Evidence to record: Queries, URLs and displayed controls.
Why it matters: Visible controls and results should describe the same state.
Exceptions and limits: URL persistence is optional for transient local filters.
Scope: Project-specific; verify the actual product and deployment

forms.search · Reviewed 2026-09-30

Use explicit labels and suitable input aidsGood practice

When it applies: People enter structured information.
How to verify: Inspect labels, required indicators, autocomplete and input types on mobile.
Evidence to record: Form markup plus browser observation.
Why it matters: Clear input expectations reduce avoidable mistakes.
Exceptions and limits: Special formats may need custom controls with equivalent accessibility.
Scope: Project-specific; verify the actual product and deployment

forms.labels · Reviewed 2026-09-30

Account lifecycle

Cover both joining and leaving the product.

Complete signup and sign-in recoveryGood practice

When it applies: The product requires a user identity.
How to verify: Exercise supported login methods, expired links and recovery; verify identity before account changes.
Evidence to record: Test-account results and recovery paths.
Why it matters: A working happy-path login is not enough.
Exceptions and limits: SSO-only products may delegate recovery to the identity provider.
Scope: Project-specific; verify the actual product and deployment

accounts.authentication · Reviewed 2026-09-30

Provide session controlGood practice

When it applies: Users authenticate across devices.
How to verify: Check logout, expiry, revoked access and available session management.
Evidence to record: Session tests across two clients.
Why it matters: Lost or stale sessions can retain access.
Exceptions and limits: Per-device controls depend on threat model and provider capabilities.
Scope: Project-specific; verify the actual product and deployment

accounts.sessions · Reviewed 2026-09-30

Protect email and identity changesGood practice

When it applies: Users can edit credentials or identity fields.
How to verify: Test verification, notification, conflict and interrupted update paths.
Evidence to record: Old/new identity behavior and alerts.
Why it matters: Account ownership must survive profile changes safely.
Exceptions and limits: Provider-managed identity may have an external update flow.
Scope: Project-specific; verify the actual product and deployment

accounts.account-changes · Reviewed 2026-09-30

Offer understandable account closureGood practice

When it applies: Users create persistent accounts.
How to verify: Trace closure through login revocation, subscriptions, owned workspaces and retained records.
Evidence to record: UI path, backend effects and retention explanation.
Why it matters: Users need to understand the consequences of leaving.
Exceptions and limits: Closure and statutory erasure are separate; some records must be retained.
Scope: Project-specific; verify the actual product and deployment

accounts.closure · Reviewed 2026-09-30

Accessibility

Combine automated checks with assistive-technology journeys.

Complete core journeys by keyboardTechnical standard

When it applies: The product has interactive UI.
How to verify: Use Tab, Shift+Tab, arrows and Escape where appropriate; inspect visible focus, order and traps.
Evidence to record: Journey, browser and observed focus behavior.
Why it matters: Pointer-only controls exclude users.
Exceptions and limits: Spatial input may need a suitable alternative rather than identical interaction.
Scope: WCAG technical guidance; determine applicable accessibility law per market

WCAG 2.2 Checked 2026-09-30
Accessibility requirements for services and products Checked 2026-09-30

accessibility.keyboard · Reviewed 2026-09-30

Expose names, roles and stateTechnical standard

When it applies: The interface contains controls, headings or dialogs.
How to verify: Inspect the accessibility tree and test a core journey with a screen reader.
Evidence to record: Control names, hierarchy and announced state changes.
Why it matters: Visual appearance alone does not communicate function.
Exceptions and limits: Use native semantics before adding custom ARIA.
Scope: WCAG technical guidance; determine applicable accessibility law per market

WCAG 2.2 Checked 2026-09-30
Accessibility requirements for services and products Checked 2026-09-30

accessibility.semantics · Reviewed 2026-09-30

Keep content perceptibleTechnical standard

When it applies: Text and controls convey information visually.
How to verify: Measure relevant contrast and ensure errors/status are not communicated by color alone.
Evidence to record: Measured samples and non-color cues.
Why it matters: Users perceive color and contrast differently.
Exceptions and limits: Apply the standard's actual criteria and exceptions.
Scope: WCAG technical guidance; determine applicable accessibility law per market

WCAG 2.2 Checked 2026-09-30
Accessibility requirements for services and products Checked 2026-09-30

accessibility.contrast · Reviewed 2026-09-30

Give meaningful media alternativesTechnical standard

When it applies: Images or media convey information.
How to verify: Match text alternatives to purpose; hide decorative images appropriately; check captions/transcripts where needed.
Evidence to record: Representative media and alternatives.
Why it matters: Equivalent information must remain available.
Exceptions and limits: Decorative images generally need empty alt text, not invented descriptions.
Scope: WCAG technical guidance; determine applicable accessibility law per market

WCAG 2.2 Checked 2026-09-30
Accessibility requirements for services and products Checked 2026-09-30

accessibility.images · Reviewed 2026-09-30

Support zoom and reduced motionTechnical standard

When it applies: Pages contain responsive layouts or animation.
How to verify: Test zoom, narrow reflow, text enlargement and reduced-motion settings.
Evidence to record: Viewport/zoom values and motion observations.
Why it matters: Content should remain operable with user preferences.
Exceptions and limits: Some inherently two-dimensional content needs contextual handling.
Scope: WCAG technical guidance; determine applicable accessibility law per market

WCAG 2.2 Checked 2026-09-30
Accessibility requirements for services and products Checked 2026-09-30

accessibility.reflow · Reviewed 2026-09-30

Determine applicable accessibility dutiesConditional legal requirement

When it applies: The product serves markets with accessibility legislation.
How to verify: Identify service type, operator size, public-sector status, exemptions and national law; confirm applicable standard/version.
Evidence to record: Market-specific scope assessment and authoritative references.
Why it matters: A WCAG result is not a legal applicability decision.
Exceptions and limits: EU EAA coverage and exemptions do not apply identically to every website.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Accessibility requirements for services and products Checked 2026-09-30

accessibility.legal-scope · Reviewed 2026-09-30

Privacy and personal data

Review the actual data lifecycle.

Publish an accurate privacy noticeConditional legal requirement

When it applies: Personal data is processed within applicable privacy law.
How to verify: Compare collected data, purposes, recipients, retention and contact information with the notice.
Evidence to record: Notice URL and data-flow comparison.
Why it matters: Documentation should describe actual processing.
Exceptions and limits: Required information depends on processing and jurisdiction.
Scope: GDPR where territorially applicable; verify national and sector-specific requirements

GDPR: processing, transparency and individual rights Checked 2026-09-30

privacy.notice · Reviewed 2026-09-30

Identify the legal basis for each purposeConditional legal requirement

When it applies: Personal data is processed.
How to verify: Map each purpose to its lawful basis; review optional form consents independently of service acceptance.
Evidence to record: Purpose/basis register and relevant form behavior.
Why it matters: Consent is not the only possible legal basis.
Exceptions and limits: Confirm the chosen basis with the responsible owner or qualified adviser.
Scope: GDPR where territorially applicable; verify national and sector-specific requirements

GDPR: processing, transparency and individual rights Checked 2026-09-30

privacy.basis · Reviewed 2026-09-30

Collect only necessary dataConditional legal requirement

When it applies: A field, log or integration receives personal data.
How to verify: Challenge why each field is needed and remove or shorten unnecessary collection.
Evidence to record: Data inventory with purpose and retention.
Why it matters: Unneeded collection increases exposure.
Exceptions and limits: A documented legal obligation may justify retention.
Scope: GDPR where territorially applicable; verify national and sector-specific requirements

GDPR: processing, transparency and individual rights Checked 2026-09-30

privacy.minimization · Reviewed 2026-09-30

Implement retention and deletion schedulesConditional legal requirement

When it applies: Personal data persists in databases, logs or backups.
How to verify: Compare promised retention with jobs, backup expiry and vendor settings.
Evidence to record: Configured schedules and a sample deletion/expiry trace.
Why it matters: A policy alone does not remove stored data.
Exceptions and limits: Legal holds and required records need explicit bounded exceptions.
Scope: GDPR where territorially applicable; verify national and sector-specific requirements

GDPR: processing, transparency and individual rights Checked 2026-09-30

privacy.retention · Reviewed 2026-09-30

Handle access, correction, export and erasure requestsConditional legal requirement

When it applies: Applicable privacy law grants individual rights.
How to verify: Trace receipt, identity verification, response and downstream providers; distinguish rights and exceptions.
Evidence to record: Request workflow, owner and test results.
Why it matters: Users need a workable process beyond a policy paragraph.
Exceptions and limits: Not every right applies to every processing basis or record.
Scope: GDPR where territorially applicable; verify national and sector-specific requirements

GDPR: processing, transparency and individual rights Checked 2026-09-30

privacy.rights · Reviewed 2026-09-30

Audit third-party SDKs and processorsConditional legal requirement

When it applies: Vendors, embeds or SDKs receive personal data.
How to verify: Inspect runtime traffic, vendor purposes, agreements and international transfers.
Evidence to record: Vendor inventory, observed requests and private agreement references.
Why it matters: A dependency can change who receives user data.
Exceptions and limits: Do not publish contracts or sensitive configuration in review artifacts.
Scope: GDPR where territorially applicable; verify national and sector-specific requirements

GDPR: processing, transparency and individual rights Checked 2026-09-30

privacy.vendors · Reviewed 2026-09-30

Prepare a personal-data incident processConditional legal requirement

When it applies: The service handles personal data.
How to verify: Confirm triage owner, escalation, applicable notification duties and a tabletop scenario.
Evidence to record: Incident procedure and exercise date.
Why it matters: Response decisions need clear ownership.
Exceptions and limits: Notification requirements depend on the incident and jurisdiction.
Scope: GDPR where territorially applicable; verify national and sector-specific requirements

GDPR: processing, transparency and individual rights Checked 2026-09-30

privacy.incident · Reviewed 2026-09-30

Cookies and tracking

Check actual behavior before and after choice.

Classify cookies, storage and third-party trackingConditional legal requirement

When it applies: The site uses browser storage, analytics or embeds.
How to verify: Observe a fresh session; list purposes, recipients and necessity without trusting vendor labels.
Evidence to record: Storage/network inventory.
Why it matters: The implementation determines consent requirements.
Exceptions and limits: Strictly necessary storage can have a different legal basis.
Scope: EU/EEA ePrivacy implementation and GDPR where applicable; research other markets separately

Cookies and consent Checked 2026-09-30

cookies.inventory · Reviewed 2026-09-30

Obtain consent before consent-dependent trackingConditional legal requirement

When it applies: Tracking requires prior consent in the applicable market.
How to verify: Test fresh load, reject, partial acceptance and expired choice; confirm blocked requests stay blocked.
Evidence to record: Network traces for each choice.
Why it matters: A visible banner alone does not control processing.
Exceptions and limits: Do not require a banner solely for strictly necessary cookies.
Scope: EU/EEA ePrivacy implementation and GDPR where applicable; research other markets separately

Cookies and consent Checked 2026-09-30

cookies.prior-choice · Reviewed 2026-09-30

Make choice and withdrawal usableConditional legal requirement

When it applies: Optional tracking consent is requested.
How to verify: Compare accept/reject effort, reopen preferences and withdraw; verify future tracking changes.
Evidence to record: Interaction steps and post-withdrawal trace.
Why it matters: A saved preference must affect the actual integrations.
Exceptions and limits: Explain technical limits on already transferred data accurately.
Scope: EU/EEA ePrivacy implementation and GDPR where applicable; research other markets separately

Cookies and consent Checked 2026-09-30

cookies.withdrawal · Reviewed 2026-09-30

Keep cookie information accurateConditional legal requirement

When it applies: Storage/tracking information must be disclosed.
How to verify: Compare purposes, lifetimes and providers against the live inventory.
Evidence to record: Policy URL and inventory diff.
Why it matters: Copied policies can misdescribe a site.
Exceptions and limits: Information may be integrated into a suitable privacy notice.
Scope: EU/EEA ePrivacy implementation and GDPR where applicable; research other markets separately

Cookies and consent Checked 2026-09-30

cookies.policy · Reviewed 2026-09-30

Prices, payments and subscriptions

Verify the complete financial journey.

Provide applicable service and sales termsConditional legal requirement

When it applies: Users enter a commercial relationship.
How to verify: Compare published terms with the product, operator and acceptance/version records.
Evidence to record: Terms URL and transaction flow.
Why it matters: Terms should describe the transaction users actually enter.
Exceptions and limits: The required form and content depend on market and contract type.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Distance selling to consumers Checked 2026-09-30

commerce.terms · Reviewed 2026-09-30

Show the payable price and commitmentsConditional legal requirement

When it applies: A user can buy, subscribe or start a paid trial.
How to verify: Compare advertised price with taxes, fees, shipping, billing period and renewal disclosures before confirmation.
Evidence to record: Entry offer and final checkout totals.
Why it matters: Hidden charges undermine informed decisions.
Exceptions and limits: Some costs depend on address or usage; explain how they are determined.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Distance selling to consumers Checked 2026-09-30

commerce.total-price · Reviewed 2026-09-30

Explain returns, refunds and withdrawalConditional legal requirement

When it applies: Sales are subject to return or withdrawal rights or promises.
How to verify: Check eligible transactions, exceptions, request path and refund handling; separate statutory rights from goodwill policy.
Evidence to record: Policy, request test and processing ownership.
Why it matters: A refund policy must not silently remove applicable rights.
Exceptions and limits: Digital services, customized goods and other cases have specific conditions.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Distance selling to consumers Checked 2026-09-30

commerce.refunds · Reviewed 2026-09-30

Check the online withdrawal mechanismConditional legal requirement

When it applies: Applicable EU distance contracts are concluded through an online interface.
How to verify: Verify current national implementation of Directive 2023/2673 and whether an accessible online withdrawal function is required; test acknowledgment and timing.
Evidence to record: Dated legal source plus applicable UI and confirmation test.
Why it matters: Recent legal changes can make a static policy insufficient.
Exceptions and limits: Scope, commencement and statutory exceptions require jurisdiction-specific confirmation.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Online withdrawal function Checked 2026-09-30

commerce.withdrawal-function · Reviewed 2026-09-30

Make subscription changes and cancellation clearGood practice

When it applies: Recurring billing or a trial exists.
How to verify: Test cancel, downgrade, trial expiry and reactivation; explain access end date and final charges.
Evidence to record: Billing-provider state and user-visible confirmation.
Why it matters: A hidden or ineffective cancellation path continues unwanted billing.
Exceptions and limits: Immediate and period-end cancellation have different consequences.
Scope: Project-specific; verify the actual product and deployment

Distance selling to consumers Checked 2026-09-30
Online withdrawal function Checked 2026-09-30

commerce.cancel · Reviewed 2026-09-30

Reconcile payments safelyGood practice

When it applies: An external provider processes money.
How to verify: Use a sandbox to test duplicate/delayed events, declined payment, refund and missing confirmation.
Evidence to record: Provider event IDs and resulting order state, without card data.
Why it matters: UI success and provider settlement can diverge.
Exceptions and limits: Never run a real charge merely to complete an audit without authorization.
Scope: Project-specific; verify the actual product and deployment

Distance selling to consumers Checked 2026-09-30
Online withdrawal function Checked 2026-09-30

commerce.reconciliation · Reviewed 2026-09-30

Errors and recovery

Keep users oriented when dependencies fail.

Distinguish loading, empty and failureGood practice

When it applies: A screen depends on asynchronous data.
How to verify: Simulate loading, no data, partial failure and timeout; confirm truthful messaging and recovery.
Evidence to record: States exercised and available actions.
Why it matters: An error should not masquerade as an empty success.
Exceptions and limits: Static content may have no asynchronous state.
Scope: Project-specific; verify the actual product and deployment

resilience.states · Reviewed 2026-09-30

Retry without duplicating effectsGood practice

When it applies: Operations can time out or be retried.
How to verify: Interrupt a request and retry; inspect deduplication and user feedback.
Evidence to record: Controlled failure trace and resulting records.
Why it matters: Uncertain outcomes can lead to duplicate work or charges.
Exceptions and limits: Read-only and mutating operations need different retry policies.
Scope: Project-specific; verify the actual product and deployment

resilience.retry · Reviewed 2026-09-30

Protect work across interruptionsGood practice

When it applies: Users compose or edit valuable content.
How to verify: Test navigation, refresh, session expiry and conflict with another edit.
Evidence to record: Recovery/conflict results and saved data.
Why it matters: Silent loss breaks trust.
Exceptions and limits: Do not persist sensitive drafts without a deliberate policy.
Scope: Project-specific; verify the actual product and deployment

resilience.unsaved · Reviewed 2026-09-30

Provide useful error and permission pagesGood practice

When it applies: Routes can be missing or unavailable.
How to verify: Test 404, server error and insufficient permission; inspect return/help paths and information leakage.
Evidence to record: Representative routes and displayed messages.
Why it matters: Users need a safe next step after failure.
Exceptions and limits: Do not expose private resource existence to unauthorized users.
Scope: Project-specific; verify the actual product and deployment

resilience.error-pages · Reviewed 2026-09-30

Mobile experience and performance

Exercise the product under realistic constraints.

Complete core tasks on a small screenGood practice

When it applies: The product supports browser users.
How to verify: Test touch targets, scrolling, virtual keyboard, dialogs and sticky elements on narrow viewports.
Evidence to record: Device/viewport and completed task.
Why it matters: A desktop layout can conceal unusable mobile interactions.
Exceptions and limits: Specialized desktop-only tools should state their supported context.
Scope: Project-specific; verify the actual product and deployment

mobile.small-screen · Reviewed 2026-09-30

Measure realistic loading and interactionGood practice

When it applies: Users load substantial content or interactive screens.
How to verify: Measure key journeys with constrained CPU/network and representative content; inspect layout shifts and main-thread work.
Evidence to record: Environment, measurements and identified bottlenecks.
Why it matters: Local fast-network impressions hide user delays.
Exceptions and limits: Targets depend on the journey; avoid invented universal budgets.
Scope: Project-specific; verify the actual product and deployment

mobile.performance · Reviewed 2026-09-30

Deliver appropriate assetsGood practice

When it applies: Pages include images, fonts or video.
How to verify: Inspect transfer size, dimensions, loading priority and behavior when assets fail.
Evidence to record: Network sample and layout observation.
Why it matters: Oversized or unstable assets delay useful content.
Exceptions and limits: Above-the-fold essential content may need eager loading.
Scope: Project-specific; verify the actual product and deployment

mobile.assets · Reviewed 2026-09-30

SEO and sharing

Control public discovery without confusing it with security.

Describe public pages accuratelyGood practice

When it applies: Pages should appear in search or shared links.
How to verify: Inspect titles, descriptions, canonical choices and social previews on representative routes.
Evidence to record: Rendered metadata and preview result.
Why it matters: Search and sharing should reflect the actual page.
Exceptions and limits: Private or transactional pages may intentionally avoid indexing.
Scope: Project-specific; verify the actual product and deployment

Google SEO Starter Guide Checked 2026-09-30

discovery.metadata · Reviewed 2026-09-30

Manage public indexing and redirectsGood practice

When it applies: The site has indexable content.
How to verify: Inspect robots directives, sitemap, canonical URLs, moved routes and broken links.
Evidence to record: Crawler configuration and tested response codes.
Why it matters: Accidental exclusions or duplicate routes impair discovery.
Exceptions and limits: Robots and noindex are not access controls.
Scope: Project-specific; verify the actual product and deployment

Google SEO Starter Guide Checked 2026-09-30

discovery.indexing · Reviewed 2026-09-30

Use truthful structured dataGood practice

When it applies: A supported rich-result type matches real page content.
How to verify: Validate markup and compare every claim with visible content.
Evidence to record: Validator output and source content.
Why it matters: Misleading metadata creates false expectations.
Exceptions and limits: Do not add schema merely because a template includes it.
Scope: Project-specific; verify the actual product and deployment

Google SEO Starter Guide Checked 2026-09-30

discovery.structured-data · Reviewed 2026-09-30

Security and abuse resistance

Verify controls at the actual trust boundaries.

Enforce permissions on the serverGood practice

When it applies: Private data or privileged operations exist.
How to verify: Use permitted test identities to exercise direct requests across roles and object owners.
Evidence to record: Allowed/denied request results.
Why it matters: Hiding a control does not restrict the operation.
Exceptions and limits: A public read-only resource can intentionally allow anonymous access.
Scope: Project-specific; verify the actual product and deployment

OWASP Application Security Verification Standard Checked 2026-09-30

security.authorization · Reviewed 2026-09-30

Protect credentials and sensitive logsGood practice

When it applies: The app uses credentials or handles sensitive values.
How to verify: Inspect delivery bundles and logging paths without printing secrets; verify runtime secret handling.
Evidence to record: Redacted locations and handling controls.
Why it matters: Client bundles and logs can expose privileged values.
Exceptions and limits: Public client identifiers are not automatically secrets.
Scope: Project-specific; verify the actual product and deployment

OWASP Application Security Verification Standard Checked 2026-09-30

security.secrets · Reviewed 2026-09-30

Limit automated abuseGood practice

When it applies: Public actions incur cost or send messages.
How to verify: Check rate/cost limits, abuse handling and behavior when limits are reached.
Evidence to record: Configuration plus authorized boundary tests.
Why it matters: A small team needs bounded exposure to automated use.
Exceptions and limits: Avoid disruptive load tests against production.
Scope: Project-specific; verify the actual product and deployment

OWASP Application Security Verification Standard Checked 2026-09-30

security.abuse · Reviewed 2026-09-30

Control uploaded filesGood practice

When it applies: Users upload content.
How to verify: Test allowed type/size, access, storage isolation and any scanning/rendering boundary using benign fixtures.
Evidence to record: Upload results and storage access checks.
Why it matters: Uploaded content crosses multiple trust boundaries.
Exceptions and limits: Not applicable without uploads; controls depend on file use.
Scope: Project-specific; verify the actual product and deployment

OWASP Application Security Verification Standard Checked 2026-09-30

security.uploads · Reviewed 2026-09-30

Support and email

Keep communication actionable and deliverable.

Provide a working support routeGood practice

When it applies: Users need help or incident contact.
How to verify: Send an authorized test request or inspect routing and ownership; verify a response path exists.
Evidence to record: Contact destination and owner-confirmed handling.
Why it matters: An unattended form provides false reassurance.
Exceptions and limits: Internal tools may use an existing company support channel.
Scope: Project-specific; verify the actual product and deployment

communication.support · Reviewed 2026-09-30

Test essential transactional messagesGood practice

When it applies: The product sends login, purchase or service emails.
How to verify: Inspect rendered messages, mobile layout, destination links and expired tokens in a test environment.
Evidence to record: Message samples with secrets removed and delivery results.
Why it matters: Core journeys may depend on email arriving and working.
Exceptions and limits: Separate test fixtures from production recipients.
Scope: Project-specific; verify the actual product and deployment

communication.transactional · Reviewed 2026-09-30

Honor marketing preferencesConditional legal requirement

When it applies: Marketing email is sent.
How to verify: Check applicable consent/opt-out rules, unsubscribe usability and suppression across providers.
Evidence to record: Unsubscribe test and subsequent suppression state.
Why it matters: Preference changes must reach the sending system.
Exceptions and limits: Necessary service messages need separate classification and must not disguise marketing.
Scope: EU/EEA starting point; confirm market, business model, current national law and exceptions

Online privacy and marketing preferences Checked 2026-09-30

communication.unsubscribe · Reviewed 2026-09-30

Production and maintenance

Prove that the service can be operated and recovered.

Route actionable failures to an ownerGood practice

When it applies: The service runs in production.
How to verify: Confirm error/uptime monitoring, redaction and alert delivery with a safe test.
Evidence to record: Alert receipt, owner and runbook.
Why it matters: A dashboard nobody watches does not provide incident response.
Exceptions and limits: Static sites may rely on hosting-provider capabilities.
Scope: Project-specific; verify the actual product and deployment

operations.monitoring · Reviewed 2026-09-30

Test recovery from backupsGood practice

When it applies: The product stores data that cannot be trivially recreated.
How to verify: Restore a representative backup into an isolated environment; measure recovery time and retained history.
Evidence to record: Restore date, result and recovery objectives.
Why it matters: Successful backup creation does not prove recoverability.
Exceptions and limits: Never overwrite production to test restoration.
Scope: Project-specific; verify the actual product and deployment

operations.restore · Reviewed 2026-09-30

Prepare deployment recoveryGood practice

When it applies: Updates can break service or data compatibility.
How to verify: Inspect deployment rollback and migration recovery; rehearse in a safe environment.
Evidence to record: Runbook and rehearsal result.
Why it matters: Application rollback may fail after an incompatible migration.
Exceptions and limits: A forward fix may be safer for irreversible data changes.
Scope: Project-specific; verify the actual product and deployment

operations.rollback · Reviewed 2026-09-30

Separate test and production integrationsGood practice

When it applies: The app has external services or deployment environments.
How to verify: Verify environment-specific endpoints, credentials, sender identities and payment modes without exposing values.
Evidence to record: Redacted configuration mapping.
Why it matters: Test actions should not affect real users or billing.
Exceptions and limits: Small deployments still need explicit environment boundaries.
Scope: Project-specific; verify the actual product and deployment

operations.environments · Reviewed 2026-09-30

Bound service cost and expiry risksGood practice

When it applies: Vendors, domains, certificates or quotas are required.
How to verify: Confirm billing alerts, usage limits, renewals and an accountable owner.
Evidence to record: Settings and owner-confirmed renewal process.
Why it matters: A forgotten renewal or unbounded API can stop a solo project.
Exceptions and limits: Automatic renewal still needs a valid payment method and alerts.
Scope: Project-specific; verify the actual product and deployment

operations.costs · Reviewed 2026-09-30

Online-store module

Follow an order through fulfillment and return.

Keep stock and orders consistentGood practice

When it applies: Products have limited availability.
How to verify: Test concurrent purchases, inventory changes and failed payments using sandbox orders.
Evidence to record: Stock/order transitions.
Why it matters: A cart should not promise unavailable goods.
Exceptions and limits: Unlimited digital goods have different constraints.
Scope: Project-specific; verify the actual product and deployment

store.stock · Reviewed 2026-09-30

Explain and track deliveryGood practice

When it applies: Orders require shipping or delivery.
How to verify: Verify destinations, costs, estimates, confirmation and failed fulfillment handling.
Evidence to record: Checkout and fulfillment test.
Why it matters: Purchase completion is only part of the customer journey.
Exceptions and limits: Instant digital delivery uses a different fulfillment path.
Scope: Project-specific; verify the actual product and deployment

store.fulfillment · Reviewed 2026-09-30

Assess guest purchase and order recoveryGood practice

When it applies: A storefront sells to occasional customers.
How to verify: Review whether an account is necessary; test order lookup and contact without forced enrollment.
Evidence to record: Guest or justified account-only journey.
Why it matters: Unnecessary registration adds friction.
Exceptions and limits: Regulated or contract-specific services may require verified accounts.
Scope: Project-specific; verify the actual product and deployment

store.guest · Reviewed 2026-09-30

Teams and organizations module

Protect membership and ownership boundaries.

Isolate organizations end to endGood practice

When it applies: Users belong to multiple organizations.
How to verify: Test direct URLs, APIs, search, exports and cached results with distinct test tenants.
Evidence to record: Cross-tenant denial and switching results.
Why it matters: A correct UI filter alone does not isolate data.
Exceptions and limits: Run only with authorized test data.
Scope: Project-specific; verify the actual product and deployment

teams.isolation · Reviewed 2026-09-30

Handle invitations and role changesGood practice

When it applies: Users invite or manage teammates.
How to verify: Test expired invites, removed members, role downgrades and stale sessions.
Evidence to record: Membership and permission transitions.
Why it matters: Access changes must propagate beyond the settings screen.
Exceptions and limits: External identity management may own parts of the flow.
Scope: Project-specific; verify the actual product and deployment

teams.membership · Reviewed 2026-09-30

Resolve last-owner departureGood practice

When it applies: An organization owns shared data or billing.
How to verify: Test transfer of ownership, last-admin removal and account closure effects.
Evidence to record: Ownership and billing continuity outcome.
Why it matters: Personal account deletion must not orphan a shared workspace.
Exceptions and limits: Single-user projects need no ownership transfer.
Scope: Project-specific; verify the actual product and deployment

teams.owner-exit · Reviewed 2026-09-30

Bookings module

Respect time, availability and cancellation.

Display unambiguous appointment timesGood practice

When it applies: Appointments cross dates or time zones.
How to verify: Test user/business time zones and daylight-saving transitions; inspect confirmations.
Evidence to record: Stored instant, displayed zone and message comparison.
Why it matters: Ambiguous local times cause missed appointments.
Exceptions and limits: Date-only reservations require date rather than instant semantics.
Scope: Project-specific; verify the actual product and deployment

bookings.time · Reviewed 2026-09-30

Prevent conflicting reservationsGood practice

When it applies: Availability is limited.
How to verify: Attempt concurrent sandbox bookings and abandoned holds.
Evidence to record: Reservation and hold-expiry outcomes.
Why it matters: A visible free slot can become unavailable before confirmation.
Exceptions and limits: Overbooking must be an explicit business policy.
Scope: Project-specific; verify the actual product and deployment

bookings.concurrency · Reviewed 2026-09-30

Handle rescheduling and cancellationGood practice

When it applies: Users reserve appointments or resources.
How to verify: Test cutoff rules, reminders, refunds and slot release after changes.
Evidence to record: Reschedule/cancel journey and downstream effects.
Why it matters: Changing a booking affects several systems.
Exceptions and limits: Policies depend on the service and applicable consumer rules.
Scope: Project-specific; verify the actual product and deployment

bookings.changes · Reviewed 2026-09-30

User-content module

Provide controls for publication and harm reports.

Let users report problematic contentGood practice

When it applies: Users publish content visible to others.
How to verify: Locate reporting and moderation routes; verify owner, acknowledgment and appeal requirements where applicable.
Evidence to record: Report lifecycle and policy reference.
Why it matters: Publishing tools also need a handling process.
Exceptions and limits: Applicable platform duties require separate market-specific legal review.
Scope: Project-specific; verify the actual product and deployment

community.reporting · Reviewed 2026-09-30

Explain visibility and removalGood practice

When it applies: People publish posts, profiles or attachments.
How to verify: Test draft/private/public states, removal, blocked users and cached/search copies.
Evidence to record: Visibility matrix and removal trace.
Why it matters: Users need control over who can access their material.
Exceptions and limits: Required retention or moderation evidence needs a documented exception.
Scope: Project-specific; verify the actual product and deployment

community.controls · Reviewed 2026-09-30

Explain content permissionsGood practice

When it applies: The service hosts material created by users.
How to verify: Compare upload terms, licences, takedown process and actual reuse of content.
Evidence to record: Terms and content-use mapping.
Why it matters: Uploading does not automatically grant unlimited reuse.
Exceptions and limits: Special creator contracts may define separate permissions.
Scope: Project-specific; verify the actual product and deployment

community.rights · Reviewed 2026-09-30

AI module

Bound data use, failures and consequential actions.

Explain AI provider data handlingGood practice

When it applies: User content is sent to an AI service.
How to verify: Identify transmitted fields, retention/training settings, providers and user disclosures.
Evidence to record: Provider settings and redacted data flow.
Why it matters: A model call can disclose information outside the product.
Exceptions and limits: Local inference has different transfer risks, but still needs data handling review.
Scope: Project-specific; verify the actual product and deployment

ai.data · Reviewed 2026-09-30

Communicate uncertainty and failureGood practice

When it applies: Users rely on generated output.
How to verify: Test unsupported questions, unavailable providers and misleading outputs; explain important limits and human review routes.
Evidence to record: Scenario outcomes and user-facing language.
Why it matters: Fluent output can be mistaken for verified information.
Exceptions and limits: Required disclosures depend on use and market; assess applicable AI law separately.
Scope: Project-specific; verify the actual product and deployment

ai.limits · Reviewed 2026-09-30

Constrain AI-triggered actionsGood practice

When it applies: AI can call tools or alter external state.
How to verify: Test permissions, confirmation for consequential actions, untrusted-input handling and spending limits in a sandbox.
Evidence to record: Allowed/denied action traces and limits.
Why it matters: Generated instructions must not acquire extra authority.
Exceptions and limits: Read-only assistance has a smaller action surface.
Scope: Project-specific; verify the actual product and deployment

ai.actions · Reviewed 2026-09-30

Children module

Determine child-specific duties before collecting data.

Verify applicable child consent rulesConditional legal requirement

When it applies: An online service offered directly to children relies on consent within GDPR Article 8.
How to verify: Determine national age threshold and a proportionate parental-authorization process; avoid unnecessary identity collection.
Evidence to record: Dated jurisdiction assessment and tested authorization flow.
Why it matters: A universal age checkbox cannot establish valid consent.
Exceptions and limits: Article 8 is conditional; national thresholds and other legal bases require separate analysis.
Scope: Child-specific laws in actual markets; GDPR Article 8 only where its conditions apply

Children and consent Checked 2026-09-30

children.age · Reviewed 2026-09-30

Use age-appropriate explanations and defaultsConditional legal requirement

When it applies: Children are intended or realistically foreseeable users.
How to verify: Review privacy language, visibility defaults, reporting and persuasive features with the intended age group in mind.
Evidence to record: Age-specific review and settings.
Why it matters: Children may not understand adult-oriented disclosures.
Exceptions and limits: A stated age limit alone does not resolve foreseeable use.
Scope: Child-specific laws in actual markets; GDPR Article 8 only where its conditions apply

Children and consent Checked 2026-09-30

children.experience · Reviewed 2026-09-30

Languages and regions module

Preserve meaning across supported markets.

Use correct locale and time conventionsGood practice

When it applies: Users see multiple languages, regions or currencies.
How to verify: Test dates, numbers, currency, plural forms and address formats in each supported locale.
Evidence to record: Representative localized journeys.
Why it matters: Translation alone does not localize behavior.
Exceptions and limits: Store stable machine values separately from formatted display.
Scope: Project-specific; verify the actual product and deployment

localization.formats · Reviewed 2026-09-30

Localize complete journeysGood practice

When it applies: The product promises a supported language.
How to verify: Follow entry, forms, errors, emails, policies and support in that language.
Evidence to record: Missing-string inventory and reviewed translations.
Why it matters: A partially translated critical flow can become unusable.
Exceptions and limits: Clearly declared fallback language may be acceptable for optional content.
Scope: Project-specific; verify the actual product and deployment

localization.completeness · Reviewed 2026-09-30