No mixed content

Verifies

Neither the templates of the checkout nor the deployed root HTML and its same-origin stylesheets load a resource over plain http://.

Inputs

HTML, template, stylesheet and component files of the checkout; with a deployed origin, one https request to its root (redirects followed) and up to five same-origin stylesheets, through the engine's outbound helper. Paths listed in excludes (test, spec and tmp files, __tests__, __mocks__, fixtures, test, tests and audit-scripts folders) are never analysed.

Decision rule

A plaintext reference from script, stylesheet link, iframe, object, embed or form action is HIGH; from img, source, video, audio, track, poster or url() is MEDIUM (blocks in Extended suites). Local hosts, XML namespaces and schema URLs never count. FAIL on a HIGH finding in the checkout even without a deployed origin. Without a deployed origin and without a HIGH finding the check is not applicable. With a deployed origin: FAIL on a HIGH finding in the root HTML or its stylesheets; PASS when nothing blocking was found in the deployed page and the checkout.

Type

deterministic

1.0.2: never analyses temporary files (*.tmp.*; spec.excludes follows AUDITOR_ANALYSIS_EXCLUDES). (1.0.1: never analyses test, spec, fixture and mock paths nor the auditor's own scripts (spec.excludes = AUDITOR_ANALYSIS_EXCLUDES); a fixture-looking secret (sk_test_, example, dummy) in real code is LOW, informative; every model call stays under the engine prompt cap (spec.promptMaxChars = AUDITOR_AI_PROMPT_MAX_CHARS): assess mode sends the candidate set in parts and aggregates the verdicts (a HIGH in any part is a FAIL, an unsatisfied part is a FAIL).)

The full script is disclosed on request in a read-only viewer (never published on GitHub); the attestation binds to this exact hash.