Engineering transparency

Portfolio audit dashboard

Every number here is produced by a script in the repository or by a written assessment against a published rubric, and every result links to its evidence. Nothing is a rating by an AI system. Read the methodology before reading the score.

Audit status: Failed
Last automated run: 2026-11-05 20:20 UTC · d449f63 · ci
Last assessment: 3 November 2026 · 4af6a7c
This build: d449f63 · tested
Confidence: low
Source: github.com/raqueeeb/raqueeb-portfolio · latest.json

Overall quality

9.32 / 10

Historical score from the assessment of 3 November 2026 at commit 4af6a7c — this build is d449f63, which has not been re-assessed; the automated checks below are current, the category scores are not re-judged per commit.

Weighted mean of twelve category scores (weights below). Precise value 9.3200; rounded for display only. Full report: reports/AUDIT-2026-11-03.md .

Lighthouse is shown separately and does not feed the score: 12 page/preset runs, medians of 1 mobile run(s): lowest performance 86, accessibility 100, best practices 100, SEO 100; slowest mobile LCP 1.6 s ( evidence ) .

Quality categories

Category scores from the assessment of 3 November 2026
Category	Weight	Score	Confidence	Method and evidence	Tested
Design and visual quality	10%	9.2	medium	Manual review of screenshots at 390 and 1440 px in both themes Consistent token-driven system (emerald accent, Geist, both themes) on every page; no designer review. Limits: Judged by inspection, not by an independent designer AUDIT-2026-11-03.md	3 November 2026
UX and navigation	10%	9.2	medium	Manual walkthrough plus the keyboard suite Skip link, breadcrumbs, previous/next, archive filter as a radio group, lightbox with focus trap, branded 404 and empty states all verified in three engines. Limits: No usability testing with visitors AUDIT-2026-11-03.md	3 November 2026
SEO	10%	9.5	high	Crawl of all 49 indexable pages, structured-data validation, live redirect and sitemap checks Unique title, description, canonical, Open Graph and Twitter card on every page; 48 valid JSON-LD blocks; sitemap, robots, www and trailing-slash redirects correct. Limits: Indexing and rich-result status not verifiable without Search Console AUDIT-2026-11-03.md	3 November 2026
Performance	10%	9.7	high	Lighthouse on the live site, median of three mobile runs and one desktop run, six pages Mobile 100 on five pages and 99 on contact; desktop 100; LCP 1.1 to 1.5 s; CLS 0; pages 69 to 75 KB (gallery 580 KB). Limits: No real-user field data yet AUDIT-2026-11-03.md	3 November 2026
Accessibility	10%	9.3	medium	axe on 49 pages in both themes, keyboard suite in three engines, target-size sweep Zero automated violations; 63/63 keyboard checks; targets raised to 24 px minimum. Limits: No screen-reader session; SVG diagram labels are 11 px at native scale AUDIT-2026-11-03.md	3 November 2026
Mobile responsiveness	10%	9.6	high	Viewport sweep at six widths in both themes on seven pages All 84 width and theme combinations pass: no overflow, no target under 24 px, no text under 12 px outside SVG. Limits: Diagram labels small on phones AUDIT-2026-11-03.md	3 November 2026
Content and credibility	10%	8.8	high	Every claim traced to repositories, documents or live client sites Stacks and numbers verified; gallery photographs visibly credited; the Al Safsaaf case study lacks the owner's role and lessons. Limits: Al Safsaaf 'What I learned' missing; Gallery is credited stock photography, not original work AUDIT-2026-11-03.md	3 November 2026
Branding	5%	9.3	medium	Manual review of identity across pages and social images Consistent mark, accent, typography and tone across pages and generated Open Graph images. Limits: Self-reviewed AUDIT-2026-11-03.md	3 November 2026
Technical implementation	10%	9.3	high	Type check, ESLint, Prettier, dependency audit, build gates, bundle inspection Strict TypeScript, clean lint and formatting, pre- and post-build gates, 2.5 KB of client JavaScript; six npm audit findings confined to development tooling. Limits: Vulnerable development dependencies await upstream fixes AUDIT-2026-11-03.md	3 November 2026
Conversion and contact	5%	9.0	medium	Manual review of calls to action and contact paths; link check Email call to action in the hero, contact page with timezone and response time, social links in the footer; LinkedIn answers 999 to scripts. Limits: LinkedIn profile URL unverified by automation AUDIT-2026-11-03.md	3 November 2026
Security	5%	9.4	medium	Live header and redirect checks, CSP inspection, npm audit, CMS gate and OAuth Worker test suites, exposure probes HSTS, framing, referrer, permissions and cross-origin headers; hash-based CSP; vendored CMS; secret only in the Worker; security.txt added. Limits: Static and configuration checks only; no penetration test; The /admin page carries no CSP of its own AUDIT-2026-11-03.md	3 November 2026
Reliability and testing	5%	9.5	high	Inventory of suites and their results, CI status, deployment gates Thirteen suites executed and passing; GitHub Actions green; deploy branch moves only after a successful build. Limits: No screen-reader or field testing AUDIT-2026-11-03.md	3 November 2026

Test results

Automated run of 2026-11-05 20:20 UTC at commit d449f63 on GitHub Actions (linux 7.0.0-1017-azure, Node v22.23.4), against the freshly built site and the production host. 11 passed, 1 failed, 2 warnings, 0 not tested or stale.

Automated check results
Check	Status	Result	Tool	Evidence
Lighthouse (lab)	Failed	12 page/preset runs, medians of 1 mobile run(s): lowest performance 86, accessibility 100, best practices 100, SEO 100; slowest mobile LCP 1.6 s Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP	lighthouse (scripts/qa/lh-batch.mjs) 13.5.0 node scripts/qa/lh-batch.mjs [local] <out> 1	JSON
Accessibility (axe, dark and light)	Passed	0 violations across 51 pages in both themes; 0 console messages; 0 failed requests Automated rules only; no screen-reader session	@axe-core/playwright, WCAG 2.0/2.1/2.2 A+AA and best-practice node scripts/qa/full.mjs [local] <out>	JSON
Keyboard and cross-browser	Passed	66/66 passed, 0 skipped by design	playwright: Chromium, Firefox, WebKit (scripts/qa/kbd.mjs) 1.64.1 node scripts/qa/kbd.mjs [local]	JSON
Responsive viewports	Passed	84/84 width and theme combinations pass (320, 375, 390, 768, 1024, 1440 px; dark and light)	playwright (scripts/qa/viewports.mjs) 1.64.1 node scripts/qa/viewports.mjs [local]	JSON
SEO crawl	Passed	51 pages; unique titles and descriptions, canonical, Open Graph, Twitter card, one h1 and valid JSON-LD on every page	playwright crawl (scripts/qa/full.mjs) 1.64.1 node scripts/qa/full.mjs [local] <out>	JSON
Structured data	Passed	52 pages, 50 JSON-LD blocks, types {"BreadcrumbList":49,"Person":2,"ProfilePage":1,"WebSite":1,"SoftwareSourceCode":38,"CreativeWork":6}	scripts/qa/jsonld.mjs node scripts/qa/jsonld.mjs	JSON
Broken links	Warning	124 internal and 76 external links; 0 broken; 14 unverifiable (bot-walled hosts) Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand	fetch (scripts/qa/full.mjs) node scripts/qa/full.mjs [local] <out>	JSON
Security headers, redirects and exposure (production)	Passed	all 8 headers present; www, http and trailing-slash redirects 301; security.txt served; admin no-store and noindex; no source files exposed; production is 3470b08 Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test	fetch HTTPS requests to https://raqueeb.dev	JSON
Dependency audit	Warning	0 findings in shipped dependencies (0 high or critical); 14 including development tooling Findings are confined to development tooling that never reaches visitors	npm audit 10.9.9 npm audit --json (production and all)	JSON
TypeScript and Astro check	Passed	0 errors	astro check 7.3.8 npx astro check	JSON
ESLint	Passed	0 problems	eslint 10.14.0 npx eslint .	JSON
Prettier	Passed	all files formatted	prettier 3.9.10 npx prettier --check .	JSON
Unit tests (scoring)	Passed	11 passed, 0 failed	node --test npm test	JSON
Production build	Passed	52 pages, all required files present	astro build + scripts/verify-build.mjs 7.3.8 npm run build	JSON

History

5 November 2026 · d449f63 automated run 11 passed · 1 failed · 2 warnings · 0 not tested

Regressions: lighthouse: performanceScore 98 → 86

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test; Findings are confined to development tooling that never reaches visitors

Automated run (ci); the quality score comes from the assessment of 2026-11-03
5 November 2026 · 3470b08 automated run 12 passed · 0 failed · 2 warnings · 0 not tested

No regressions recorded.

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test; Findings are confined to development tooling that never reaches visitors

Automated run (ci); the quality score comes from the assessment of 2026-11-03
5 November 2026 · 708ebd6 automated run 12 passed · 0 failed · 2 warnings · 0 not tested

No regressions recorded.

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test; Findings are confined to development tooling that never reaches visitors

Automated run (ci); the quality score comes from the assessment of 2026-11-03
5 November 2026 · a565a17 automated run 12 passed · 1 failed · 1 warnings · 0 not tested

Regressions: links: broken 0 → 9

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test; Findings are confined to development tooling that never reaches visitors

Automated run (ci); the quality score comes from the assessment of 2026-11-03
3 November 2026 · 84d8e53 automated run 12 passed · 0 failed · 2 warnings · 0 not tested

No regressions recorded.

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test; Findings are confined to development tooling that never reaches visitors

Automated run (ci); the quality score comes from the assessment of 2026-11-03
3 November 2026 · 4eede53 automated run 12 passed · 1 failed · 1 warnings · 0 not tested

Regressions: links: broken 0 → 4

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test; Findings are confined to development tooling that never reaches visitors

Automated run (ci); the quality score comes from the assessment of 2026-11-03
3 November 2026 · f769c89 automated run 11 passed · 0 failed · 2 warnings · 1 not tested

No regressions recorded.

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; The gating step did not record a result; nothing is assumed; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test; Findings are confined to development tooling that never reaches visitors

Automated run (ci); the quality score comes from the assessment of 2026-11-03
3 November 2026 · 0a9ad4b automated run 9 passed · 0 failed · 2 warnings · 0 not tested

No regressions recorded.

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test

Automated run (ci); the quality score comes from the assessment of 2026-11-03
3 November 2026 · c058d1e automated run 12 passed · 0 failed · 2 warnings · 0 not tested

No regressions recorded.

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test; Automated rules only; no screen-reader session; Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand; Lab measurement under simulated throttling; not real-user data; TBT is a lab diagnostic, not INP; Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test

Automated run (local); the quality score comes from the assessment of 2026-11-03
3 November 2026 · 4af6a7c assessment, methodology v1 9.32 / 10

Design and visual quality 9.2 · UX and navigation 9.2 · SEO 9.5 · Performance 9.7 · Accessibility 9.3 · Mobile responsiveness 9.6 · Content and credibility 8.8 · Branding 9.3 · Technical implementation 9.3 · Conversion and contact 9.0 · Security 9.4 · Reliability and testing 9.5

Changes: CreativeWork structured data for case studies without a public repository; 24 px minimum targets for section meta links and rail links; 11 px badges raised to 12 px; About copy updated to the four client projects; Al Safsaaf description trimmed; security.txt added; structured-data, viewport and Lighthouse-median QA scripts added

No regressions recorded.

Limitations: Gallery uses credited Unsplash photographs rather than original photography; Al Safsaaf case study needs the owner's actual role and lessons learned; LinkedIn profile URL requires manual verification; Search Console verification and sitemap submission pending; No real-user Core Web Vitals field data yet; No screen-reader session or penetration test

Report: reports/AUDIT-2026-11-03.md

Entries are append-only : history.json . Older methodologies are labelled with their version and are not comparable with the current one.

Known limitations

Gallery uses credited Unsplash photographs rather than original photography
Al Safsaaf case study needs the owner's actual role and lessons learned
LinkedIn profile URL requires manual verification
Search Console verification and sitemap submission pending
No real-user Core Web Vitals field data yet
No screen-reader session or penetration test
Automated rules only; no screen-reader session
Unsplash and LinkedIn answer scripts with 401/999 and the source repository is private; those links are verified by hand
Lab measurement under simulated throttling; not real-user data
TBT is a lab diagnostic, not INP
Configuration checks against the production host as it is at run time, which may be the previous commit; not a penetration test
Findings are confined to development tooling that never reaches visitors

Methodology

Overall = Σ (category score × weight) / 100. Category scores are judged against the rubric below with cited evidence; automated pass rates are evidence, never scores. Any missing category yields "not enough evidence" rather than a lower number. Full text: METHODOLOGY.md , machine-readable: methodology.json , evidence index: index.json .

Category scores are assessed against the rubric and must cite evidence; automated pass rates are evidence, never scores.
Lighthouse scores are shown separately from the quality score and never substitute for it.
Accessibility violations are reported independently of the accessibility rating.
Security checks are static and configuration checks; nothing here is a penetration test.
Missing evidence lowers confidence or yields 'not enough evidence to score'; it is never treated as a pass.
Historical scores are never rewritten; a new assessment adds an entry.
Every score is reproducible from methodology.json, assessments.json and the linked evidence.
Rounding is for presentation only; the precise weighted value is stored.
A check older than staleAfterDays is shown as stale regardless of its result.

Rubric per category: what each score means and how it is measured

Scoring rubric per category
Category	Weight	How it is measured	Rubric
Design and visual quality	10%	Manual review of screenshots at 390 and 1440 px in both themes against the rubric; no automated score exists for this category. Sources: Screenshots from scripts/qa/shots.mjs; Theme and token inspection	10 Consistent system across every page and theme, reviewed by an independent designer 9 Consistent tokens, typography and spacing on every page in both themes; self-reviewed 7 Minor inconsistencies between pages or themes 5 Visible inconsistencies or broken layouts on some pages 3 No coherent system
UX and navigation	10%	Manual review of navigation, hierarchy, empty and error states and interactive feedback, supported by the keyboard suite. Sources: scripts/qa/kbd.mjs; Manual walkthrough	10 Every task completes without friction; validated with real users 9 Clear hierarchy, breadcrumbs, previous/next, filters, lightbox, 404 and empty states all working; self-reviewed 7 Some pages hard to reach or interactive states unclear 5 Navigation gaps or confusing structure 3 Key content unreachable
SEO	10%	Automated crawl of every indexable page (titles, descriptions, canonicals, Open Graph, Twitter card, heading count, alt text, links), structured-data validation, sitemap and robots checks, live redirect checks. Indexing and rich-result status are not measurable without Search Console. Sources: scripts/qa/full.mjs; scripts/qa/jsonld.mjs; Live redirect and sitemap checks	10 All automated checks pass and Search Console confirms indexing and rich results 9 All automated checks pass on every page; indexing not yet confirmed 7 Isolated metadata defects or missing structured data 5 Duplicate or missing metadata on several pages 3 Pages blocked or uncrawlable
Performance	10%	Lighthouse lab runs (median of several mobile runs plus desktop) on six representative pages, plus page weight. Real-user Core Web Vitals are reported only when field data exists; TBT is a lab proxy, not INP. Sources: scripts/qa/lh-batch.mjs; Lighthouse	10 Lab 100 on every page and field vitals pass 9.5 Lab 99 to 100 on every page, CLS 0, pages under 100 KB except media galleries; no field data yet 8 Lab 90 to 98 on some pages 6 Lab under 90 on important pages 3 Poor Core Web Vitals
Accessibility	10%	axe-core (WCAG 2.0/2.1/2.2 A and AA plus best practice) on every page in both themes, keyboard suite in three engines, target-size sweep, manual focus review. Zero automated violations is evidence, not proof of compliance; no screen-reader session has been run. Sources: scripts/qa/full.mjs; scripts/qa/kbd.mjs; scripts/qa/viewports.mjs	10 Zero violations, keyboard and screen-reader sessions passed, reviewed by an accessibility specialist 9 Zero automated violations on every page and theme, keyboard suite passing, targets at least 24 px; no screen-reader session 7 Minor violations or focus issues 5 Serious violations on some pages 3 Content unusable without a mouse
Mobile responsiveness	10%	Viewport sweep at 320, 375, 390, 768, 1024 and 1440 px in both themes: horizontal overflow, targets under 24 px, text under 12 px; cross-browser render pass at three widths. Sources: scripts/qa/viewports.mjs; scripts/qa/kbd.mjs	10 All widths and themes pass and diagrams remain legible on phones 9.5 All widths and themes pass; some diagram labels small on phones 8 Minor overflow or small targets on some pages 6 Broken layouts at common widths 3 Not usable on phones
Content and credibility	10%	Manual verification that every claim, number, stack and link traces to a repository, document or live site; gallery credits; completeness of case studies. Sources: Project repositories and READMEs; Live client sites; docs/AUDIT-2026-11-03.md	10 Every claim verified, every case study complete, all imagery original or clearly credited 9 Every claim verified; one case study incomplete or imagery credited rather than original 7 Some claims unverifiable or placeholders visible 5 Inaccurate stacks or unsupported numbers 3 Invented content
Branding	5%	Manual review of identity consistency: mark, accent, typography, tone and social images across pages. Sources: Screenshots; OG images	10 Distinct, consistent identity validated with an audience 9 Consistent identity on every page and social image; self-reviewed 7 Minor inconsistencies 5 Generic or inconsistent 3 No identity
Technical implementation	10%	TypeScript strict check, ESLint, Prettier, dependency audit, build gates, client JavaScript size, architecture review. Sources: astro check; eslint; prettier; npm audit; scripts/verify-build.mjs	10 Clean checks, no vulnerable dependencies, unit tests for logic, reviewed architecture 9 Clean checks and build gates; vulnerable dependencies confined to development tooling 7 Lint or type issues, or shipped vulnerable dependencies 5 Failing checks 3 No checks
Conversion and contact	5%	Manual review of calls to action, contact paths, email and social link correctness; link checks. Sources: scripts/qa/full.mjs link check; Manual review	10 Clear offer, every contact path verified including by hand 9 Clear calls to action and contact page, links verified; one profile unverifiable by script 7 Contact path exists but is hard to find 5 Broken or missing contact details 3 No way to get in touch
Security	5%	Static and configuration checks only: live security headers, CSP, HTTPS, redirects, security.txt, dependency audit, CMS authentication tests, OAuth Worker tests, exposure probes. No penetration test has been performed. Sources: Live header checks; npm audit; scripts/qa/admin-sec.mjs; workers/decap-oauth/test.mjs; scripts/qa/admin-online.mjs	10 All controls present and an independent penetration test passed 9.5 All headers, CSP, HTTPS, secret handling and CMS controls verified; development-only vulnerable dependencies; no penetration test 7 Missing headers or weak CSP 5 Exposed configuration or shipped vulnerable dependencies 3 Exposed secrets
Reliability and testing	5%	Count and health of the automated suites, CI status, deployment gates, reproducibility of every check. Sources: GitHub Actions; scripts/qa/*; scripts/audit/score.test.mjs	10 Every check automated in CI with history and alerting 9.5 All suites automated and passing; CI gates deployment; history recorded 8 Suites exist but run manually 6 Partial coverage 3 No tests

Confidence: high — Assessment made for the same commit as the latest automated run, and every check passed. Medium — Same commit with warnings, or an older assessment with all current checks passing. Low — Failed, stale or untested checks, or no assessment. Checks older than 30 days are shown as stale.