{
  "schema": "goodscroll-public-deployment-verification-v1",
  "subject": {
    "application": "GoodScroll",
    "release": "1.10.24",
    "requested_origin": "https://goodscroll.it",
    "observed_asset_origin": "https://www.goodscroll.it",
    "public_asset_baseline": "goodscroll-public-assets-1.10.24.json",
    "public_asset_baseline_sha256": "cf114c435e04163335286c36428372b9065b7392e23a65eb1b93ba6ff8f84e89"
  },
  "run": {
    "id": "20260730T032217Z",
    "started_at_utc": "2026-07-30T03:22:17.675Z",
    "completed_at_utc": "2026-07-30T03:22:20.805Z",
    "mode": "unauthenticated_http",
    "verifier_name": "GoodScroll Public Deployment Verifier",
    "verifier_version": "1.0.0",
    "verifier_source_sha256": "448069b8e0fa1d7c3989f771c5a1ad654901fb8590f94f68d64912b559a5d54b"
  },
  "scope": {
    "observed": [
      "redirect HTTP/HTTPS predeterminati",
      "version.json all’inizio e alla fine",
      "35 asset statici pubblici autorizzati",
      "risposta senza corpo di percorsi protetti predeterminati",
      "risposta senza corpo di tre endpoint pubblici",
      "header HTTP di sicurezza in allowlist"
    ],
    "not_observed": [
      "sorgenti o configurazione PHP",
      "database, RLS, ACL o RPC",
      "comportamento autenticato",
      "valori di cookie, storage, header o body API",
      "installazione reale del Service Worker nel browser",
      "conformità GDPR o sicurezza complessiva"
    ]
  },
  "completion": {
    "classification": "supported_with_findings",
    "technically_complete": true,
    "legal_conclusion": false,
    "current_state_guarantee": false
  },
  "version_boundary": {
    "expected": "1.10.24",
    "beginning": {
      "outcome": "pass",
      "status": 200,
      "value": "1.10.24"
    },
    "end": {
      "outcome": "pass",
      "status": 200,
      "value": "1.10.24"
    },
    "unchanged_expected_true": true
  },
  "runtime_markers": {
    "version_json": "1.10.24",
    "service_worker_cache_version": "1.10.24",
    "version_manager_app_version": "1.10.24"
  },
  "redirects": [
    {
      "start": {
        "scheme": "http",
        "host": "goodscroll.it",
        "port": null,
        "path": "/"
      },
      "chain": [
        {
          "url": {
            "scheme": "http",
            "host": "goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 301
        },
        {
          "url": {
            "scheme": "http",
            "host": "www.goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 301
        },
        {
          "url": {
            "scheme": "https",
            "host": "www.goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 200
        }
      ],
      "outcome": "pass"
    },
    {
      "start": {
        "scheme": "http",
        "host": "www.goodscroll.it",
        "port": null,
        "path": "/"
      },
      "chain": [
        {
          "url": {
            "scheme": "http",
            "host": "www.goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 301
        },
        {
          "url": {
            "scheme": "https",
            "host": "www.goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 200
        }
      ],
      "outcome": "pass"
    },
    {
      "start": {
        "scheme": "https",
        "host": "goodscroll.it",
        "port": null,
        "path": "/"
      },
      "chain": [
        {
          "url": {
            "scheme": "https",
            "host": "goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 301
        },
        {
          "url": {
            "scheme": "https",
            "host": "www.goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 200
        }
      ],
      "outcome": "pass"
    },
    {
      "start": {
        "scheme": "https",
        "host": "www.goodscroll.it",
        "port": null,
        "path": "/"
      },
      "chain": [
        {
          "url": {
            "scheme": "https",
            "host": "www.goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 200
        }
      ],
      "outcome": "pass"
    }
  ],
  "public_assets": [
    {
      "path": "/app.html",
      "expected": {
        "bytes": 81490,
        "sha256": "499f01862efc2784dd3dd81b8c40fe1713b3a85aabffc5f6106049584996d0bc"
      },
      "observed": {
        "status": 200,
        "bytes": 81490,
        "sha256": "499f01862efc2784dd3dd81b8c40fe1713b3a85aabffc5f6106049584996d0bc",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/auth-handler.html",
      "expected": {
        "bytes": 7605,
        "sha256": "57dd619188dbd98f50e8e64298e4491f0da9f4a671103ccc6aafbad982f355bc"
      },
      "observed": {
        "status": 200,
        "bytes": 7605,
        "sha256": "57dd619188dbd98f50e8e64298e4491f0da9f4a671103ccc6aafbad982f355bc",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/come-funziona.html",
      "expected": {
        "bytes": 18054,
        "sha256": "54398342a935f2ecc419a878108367939d7644c9618c63cbeecb9a320a3d494e"
      },
      "observed": {
        "status": 200,
        "bytes": 18054,
        "sha256": "54398342a935f2ecc419a878108367939d7644c9618c63cbeecb9a320a3d494e",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/contatti.html",
      "expected": {
        "bytes": 10413,
        "sha256": "1f9bd5048d92c02e8351d6976434717f10e01256130d72269408c2087fb17597"
      },
      "observed": {
        "status": 200,
        "bytes": 10413,
        "sha256": "1f9bd5048d92c02e8351d6976434717f10e01256130d72269408c2087fb17597",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/css/style.css",
      "expected": {
        "bytes": 62786,
        "sha256": "ddf20bbff2b2ad348ecbf04c9c9aede055aba9a4ed1e8e4fb388103fbc7d49a3"
      },
      "observed": {
        "status": 200,
        "bytes": 62786,
        "sha256": "ddf20bbff2b2ad348ecbf04c9c9aede055aba9a4ed1e8e4fb388103fbc7d49a3",
        "content_type": "text/css"
      },
      "outcome": "pass"
    },
    {
      "path": "/favicon.ico",
      "expected": {
        "bytes": 3115,
        "sha256": "7b368eb1302e955d666022e655a1606d38d87a931baee60b0c8b2dd38f3220dc"
      },
      "observed": {
        "status": 200,
        "bytes": 3115,
        "sha256": "7b368eb1302e955d666022e655a1606d38d87a931baee60b0c8b2dd38f3220dc",
        "content_type": "image/x-icon"
      },
      "outcome": "pass"
    },
    {
      "path": "/goodscroll-privacy-observer-v4.0.1.zip",
      "expected": {
        "bytes": 123361,
        "sha256": "c7a91a1556efdd3fc61e253e2e467492589810f781e6fe6095628bce77116d08"
      },
      "observed": {
        "status": 200,
        "bytes": 123361,
        "sha256": "c7a91a1556efdd3fc61e253e2e467492589810f781e6fe6095628bce77116d08",
        "content_type": "application/x-zip-compressed"
      },
      "outcome": "pass"
    },
    {
      "path": "/goodscroll-rapporto-tecnico-prerilascio-v4.0.1.pdf",
      "expected": {
        "bytes": 6305,
        "sha256": "c6b473380c21a7d07c88696bba8ab99221575e67714a59bb76710c324ee71c4c"
      },
      "observed": {
        "status": 200,
        "bytes": 6305,
        "sha256": "c6b473380c21a7d07c88696bba8ab99221575e67714a59bb76710c324ee71c4c",
        "content_type": "application/pdf"
      },
      "outcome": "pass"
    },
    {
      "path": "/icon-16.png",
      "expected": {
        "bytes": 820,
        "sha256": "5f80a7d3282e588822f472f91c80f71fa133cf2c370eb52c1a76494480ac7914"
      },
      "observed": {
        "status": 200,
        "bytes": 820,
        "sha256": "5f80a7d3282e588822f472f91c80f71fa133cf2c370eb52c1a76494480ac7914",
        "content_type": "image/png"
      },
      "outcome": "pass"
    },
    {
      "path": "/icon-192.png",
      "expected": {
        "bytes": 28054,
        "sha256": "da0100887c8ce21b1784da62409781f9bfc759718c5b69310fc7bc7b37f82c0d"
      },
      "observed": {
        "status": 200,
        "bytes": 28054,
        "sha256": "da0100887c8ce21b1784da62409781f9bfc759718c5b69310fc7bc7b37f82c0d",
        "content_type": "image/png"
      },
      "outcome": "pass"
    },
    {
      "path": "/icon-32.png",
      "expected": {
        "bytes": 2226,
        "sha256": "31448b1be8c30e39179601227e8097543b7209c0ac533b22ebaa9810be6fd517"
      },
      "observed": {
        "status": 200,
        "bytes": 2226,
        "sha256": "31448b1be8c30e39179601227e8097543b7209c0ac533b22ebaa9810be6fd517",
        "content_type": "image/png"
      },
      "outcome": "pass"
    },
    {
      "path": "/icon-512-maskable.png",
      "expected": {
        "bytes": 56776,
        "sha256": "21e3a055bb5096b71b85e95764bf796e8ee562c21dd2943d6882a07962c43d18"
      },
      "observed": {
        "status": 200,
        "bytes": 56776,
        "sha256": "21e3a055bb5096b71b85e95764bf796e8ee562c21dd2943d6882a07962c43d18",
        "content_type": "image/png"
      },
      "outcome": "pass"
    },
    {
      "path": "/icon-512.png",
      "expected": {
        "bytes": 117613,
        "sha256": "818aec0685afee40e01ac58d2601c8294d616291280d205eebf3dfef41ea3990"
      },
      "observed": {
        "status": 200,
        "bytes": 117613,
        "sha256": "818aec0685afee40e01ac58d2601c8294d616291280d205eebf3dfef41ea3990",
        "content_type": "image/png"
      },
      "outcome": "pass"
    },
    {
      "path": "/index.html",
      "expected": {
        "bytes": 33002,
        "sha256": "d41f86bd2370e671a52bcd19b3a548a802294d309afb9e76e2e3779110747524"
      },
      "observed": {
        "status": 200,
        "bytes": 33002,
        "sha256": "d41f86bd2370e671a52bcd19b3a548a802294d309afb9e76e2e3779110747524",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/app.js",
      "expected": {
        "bytes": 203602,
        "sha256": "3841f6afac2601c4df22222cee9c8a86c1f0b4197c97763f40b74ef649aaa289"
      },
      "observed": {
        "status": 200,
        "bytes": 203602,
        "sha256": "3841f6afac2601c4df22222cee9c8a86c1f0b4197c97763f40b74ef649aaa289",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/crypto-utils.js",
      "expected": {
        "bytes": 11967,
        "sha256": "084e36e42fee1b367bf42c6b981203c9e5dfeb4ccea0a160458e710554c1d46a"
      },
      "observed": {
        "status": 200,
        "bytes": 11967,
        "sha256": "084e36e42fee1b367bf42c6b981203c9e5dfeb4ccea0a160458e710554c1d46a",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/lumi-prompts.js",
      "expected": {
        "bytes": 7461,
        "sha256": "552510ac66cae084ca1d1a855b104b66e08b09a417dde3367842249f51e21d04"
      },
      "observed": {
        "status": 200,
        "bytes": 7461,
        "sha256": "552510ac66cae084ca1d1a855b104b66e08b09a417dde3367842249f51e21d04",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/lumi.js",
      "expected": {
        "bytes": 34908,
        "sha256": "2b8266ad4f11fb17e27f4e0402432936ef7c0c22fc5d1571685f51a27df8f2a7"
      },
      "observed": {
        "status": 200,
        "bytes": 34908,
        "sha256": "2b8266ad4f11fb17e27f4e0402432936ef7c0c22fc5d1571685f51a27df8f2a7",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/performance-diagnostics.js",
      "expected": {
        "bytes": 40134,
        "sha256": "55c2d4156ac8993581974b3e09582d3d87b457e5cda016901445ceba17ede789"
      },
      "observed": {
        "status": 200,
        "bytes": 40134,
        "sha256": "55c2d4156ac8993581974b3e09582d3d87b457e5cda016901445ceba17ede789",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/stories.js",
      "expected": {
        "bytes": 69927,
        "sha256": "8261858c466d0db6f74a64d19efdfa8f6701dcea71ee4f811c9f81f728725a72"
      },
      "observed": {
        "status": 200,
        "bytes": 69927,
        "sha256": "8261858c466d0db6f74a64d19efdfa8f6701dcea71ee4f811c9f81f728725a72",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/supabase-client.js",
      "expected": {
        "bytes": 86546,
        "sha256": "387aa6d84b1139587ddbb7793b2c9b55dfc7b3fec14f8ec842dd613fe294bfb4"
      },
      "observed": {
        "status": 200,
        "bytes": 86546,
        "sha256": "387aa6d84b1139587ddbb7793b2c9b55dfc7b3fec14f8ec842dd613fe294bfb4",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/tts.js",
      "expected": {
        "bytes": 21225,
        "sha256": "e0c460cbfa423c15e77966593d0703affb8301256c1a13ffb2707827a22f9687"
      },
      "observed": {
        "status": 200,
        "bytes": 21225,
        "sha256": "e0c460cbfa423c15e77966593d0703affb8301256c1a13ffb2707827a22f9687",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/version-manager.js",
      "expected": {
        "bytes": 10780,
        "sha256": "a08c241a1562cec84cdd15e02791283a21bf44e9429bbe349744b2ff42b45cfc"
      },
      "observed": {
        "status": 200,
        "bytes": 10780,
        "sha256": "a08c241a1562cec84cdd15e02791283a21bf44e9429bbe349744b2ff42b45cfc",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/js/wakelock.js",
      "expected": {
        "bytes": 3548,
        "sha256": "07e9a8f6ea029c2ce49c4c0418f2f7c93521279b0b938f6e06219ea9d0250bb2"
      },
      "observed": {
        "status": 200,
        "bytes": 3548,
        "sha256": "07e9a8f6ea029c2ce49c4c0418f2f7c93521279b0b938f6e06219ea9d0250bb2",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/manifest.json",
      "expected": {
        "bytes": 1309,
        "sha256": "2c70c508b61de4765adc45b70049b8222fada7d1522f206e5a25b0fedc6031b4"
      },
      "observed": {
        "status": 200,
        "bytes": 1309,
        "sha256": "2c70c508b61de4765adc45b70049b8222fada7d1522f206e5a25b0fedc6031b4",
        "content_type": "application/json"
      },
      "outcome": "pass"
    },
    {
      "path": "/manifesto.html",
      "expected": {
        "bytes": 13715,
        "sha256": "b338d8997a1fa26aa22f937ecb5cf3d5ca18b91ae7ec031f006e3b69a8a7e583"
      },
      "observed": {
        "status": 200,
        "bytes": 13715,
        "sha256": "b338d8997a1fa26aa22f937ecb5cf3d5ca18b91ae7ec031f006e3b69a8a7e583",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/og-image.png",
      "expected": {
        "bytes": 668300,
        "sha256": "a8753d0f3c245e93ec987a96f4f3ad90c6582564c3672cbd4e6ca1f98fe09793"
      },
      "observed": {
        "status": 200,
        "bytes": 668300,
        "sha256": "a8753d0f3c245e93ec987a96f4f3ad90c6582564c3672cbd4e6ca1f98fe09793",
        "content_type": "image/png"
      },
      "outcome": "pass"
    },
    {
      "path": "/privacy.html",
      "expected": {
        "bytes": 74079,
        "sha256": "c9fe5ee86c941f6e9b149836a495f332e54b0a5167ef6d3e0d58e3f3e6930112"
      },
      "observed": {
        "status": 200,
        "bytes": 74079,
        "sha256": "c9fe5ee86c941f6e9b149836a495f332e54b0a5167ef6d3e0d58e3f3e6930112",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/prove.html",
      "expected": {
        "bytes": 41080,
        "sha256": "e715cb23f230b469d19a29cfcfcf0901d5278f33be2840a02cf53a85dbf87911"
      },
      "observed": {
        "status": 200,
        "bytes": 41080,
        "sha256": "e715cb23f230b469d19a29cfcfcf0901d5278f33be2840a02cf53a85dbf87911",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/robots.txt",
      "expected": {
        "bytes": 565,
        "sha256": "34c31ae76c659a773829cf2a237cf8a705863b66f80e92a60969d7a92189c7e5"
      },
      "observed": {
        "status": 200,
        "bytes": 565,
        "sha256": "34c31ae76c659a773829cf2a237cf8a705863b66f80e92a60969d7a92189c7e5",
        "content_type": "text/plain"
      },
      "outcome": "pass"
    },
    {
      "path": "/saggio.html",
      "expected": {
        "bytes": 131674,
        "sha256": "5291736748f7aa1b953f2e7ca4c29302a5c6dd5b3222aa7aeca2972b43a4d933"
      },
      "observed": {
        "status": 200,
        "bytes": 131674,
        "sha256": "5291736748f7aa1b953f2e7ca4c29302a5c6dd5b3222aa7aeca2972b43a4d933",
        "content_type": "text/html"
      },
      "outcome": "pass"
    },
    {
      "path": "/sitemap.xml",
      "expected": {
        "bytes": 1731,
        "sha256": "893f6e556576b1d2822d9bf45a1e06a65dc14565a3f10b4eee15997a6dd43045"
      },
      "observed": {
        "status": 200,
        "bytes": 1731,
        "sha256": "893f6e556576b1d2822d9bf45a1e06a65dc14565a3f10b4eee15997a6dd43045",
        "content_type": "text/xml"
      },
      "outcome": "pass"
    },
    {
      "path": "/supabase-dpa-generic-2025-08-05.pdf",
      "expected": {
        "bytes": 405285,
        "sha256": "0b2df33aaaf407a72bcd53d2eb8509fcd44f18af9ff9657481822335dc1ff763"
      },
      "observed": {
        "status": 200,
        "bytes": 405285,
        "sha256": "0b2df33aaaf407a72bcd53d2eb8509fcd44f18af9ff9657481822335dc1ff763",
        "content_type": "application/pdf"
      },
      "outcome": "pass"
    },
    {
      "path": "/sw.js",
      "expected": {
        "bytes": 6641,
        "sha256": "e4714f6b579d41de5dfd5c6cc6a13f8681bce131fc30b5d5e4c0f3626ee3ad66"
      },
      "observed": {
        "status": 200,
        "bytes": 6641,
        "sha256": "e4714f6b579d41de5dfd5c6cc6a13f8681bce131fc30b5d5e4c0f3626ee3ad66",
        "content_type": "application/javascript"
      },
      "outcome": "pass"
    },
    {
      "path": "/version.json",
      "expected": {
        "bytes": 185,
        "sha256": "a233dbb9c04ba389e7163b9be72bf5698328bacd327a0785cc700d2e3a28ca83"
      },
      "observed": {
        "status": 200,
        "bytes": 185,
        "sha256": "a233dbb9c04ba389e7163b9be72bf5698328bacd327a0785cc700d2e3a28ca83",
        "content_type": "application/json"
      },
      "outcome": "pass"
    }
  ],
  "protected_paths": [
    {
      "path": "/api/config.php",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/api/cacert.pem",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/api/web.config",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/api/.htaccess",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/App_Data/",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/App_Data/goodscroll/index.html",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/App_Data/web.config",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/.env",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/.env.example",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/.gitignore",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/tests/",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/supabase/",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/gdpr_privacy_test/",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/authenticated_device_observer/",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/release/",
      "expected_statuses": [
        403,
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    }
  ],
  "public_endpoints": [
    {
      "path": "/api/proxy.php",
      "expected_statuses": [
        404
      ],
      "observed_status": 404,
      "outcome": "pass"
    },
    {
      "path": "/api/speak.php",
      "expected_statuses": [
        405
      ],
      "observed_status": 405,
      "outcome": "pass"
    },
    {
      "path": "/api/tts.php",
      "expected_statuses": [
        410
      ],
      "observed_status": 410,
      "outcome": "pass"
    }
  ],
  "selected_root_headers": {
    "content-type": "text/html",
    "etag": "\"22ca39509e1fdd1:0\"",
    "last-modified": "Wed, 29 Jul 2026 21:07:50 GMT"
  },
  "document_canonical": {
    "scheme": "https",
    "host": "goodscroll.it",
    "port": null,
    "path": "/"
  },
  "findings": [
    {
      "id": "anti_clickjacking_http_header_absent",
      "severity": "high",
      "observed": "Nessun header HTTP applicabile blocca l’incorporamento.",
      "expectation": "CSP frame-ancestors none e/o X-Frame-Options DENY."
    },
    {
      "id": "hsts_absent",
      "severity": "medium",
      "observed": "Strict-Transport-Security non osservato.",
      "expectation": "HSTS su ogni risposta HTTPS rilevante."
    },
    {
      "id": "nosniff_absent",
      "severity": "low",
      "observed": "X-Content-Type-Options nosniff non osservato.",
      "expectation": "X-Content-Type-Options: nosniff."
    },
    {
      "id": "referrer_policy_absent",
      "severity": "low",
      "observed": "Referrer-Policy non osservato.",
      "expectation": "Una policy esplicita e coerente con la minimizzazione."
    },
    {
      "id": "permissions_policy_absent",
      "severity": "low",
      "observed": "Permissions-Policy non osservato.",
      "expectation": "Una allowlist esplicita delle capacità browser."
    },
    {
      "id": "document_canonical_disagrees_with_served_origin",
      "severity": "medium",
      "observed": {
        "scheme": "https",
        "host": "goodscroll.it",
        "port": null,
        "path": "/"
      },
      "expectation": {
        "scheme": "https",
        "host": "www.goodscroll.it",
        "port": null,
        "path": "/"
      }
    },
    {
      "id": "http_apex_redirect_not_direct",
      "severity": "low",
      "observed": [
        {
          "url": {
            "scheme": "http",
            "host": "goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 301
        },
        {
          "url": {
            "scheme": "http",
            "host": "www.goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 301
        },
        {
          "url": {
            "scheme": "https",
            "host": "www.goodscroll.it",
            "port": null,
            "path": "/"
          },
          "status": 200
        }
      ],
      "expectation": "Un solo redirect permanente verso l’origin HTTPS canonica."
    },
    {
      "id": "cache_control_absent_sw_js",
      "severity": "low",
      "observed": "Cache-Control non osservato.",
      "expectation": "Una policy esplicita coerente con l’aggiornamento PWA."
    },
    {
      "id": "cache_control_absent_js_version_manager_js",
      "severity": "low",
      "observed": "Cache-Control non osservato.",
      "expectation": "Una policy esplicita coerente con l’aggiornamento PWA."
    }
  ],
  "limitations": [
    "Gli hash attesi sono una baseline prodotta dall’operatore; l’archivio privato di release non è pubblicato.",
    "La corrispondenza HTTP è puntuale e riguarda soltanto i percorsi elencati, nel momento e dall’ambiente del run.",
    "Un esito supportato non dimostra il codice server-side, lo stato del database, i flussi autenticati o il futuro.",
    "Il verificatore non conserva body API, cookie, Set-Cookie, token, query, IP o intestazioni fuori allowlist."
  ]
}