Under the Hood: The Architecture of WCAG 2.2 checklist
Audit notes can include unreleased UI. Keep the ticks on-device.
A checklist is a local progress file, not a certified audit. There is no origin fetch and no upload route. Inputs are strings, JSON, or File objects decoded with the platform APIs in this tab.
Memory Allocation & Browser Threading Mechanics
Work stays on the main thread because typical pastes are kilobytes, not gigabytes. useMemo or an explicit button recomputes a derived string. Image tools downsample onto a canvas so pixel loops stay bounded. Crypto uses SubtleCrypto, which returns ArrayBuffers the engine can recycle after you copy the result.
Algorithmic Deep-Dive: Code Snippet & Logical Analysis
// wcag-22-checklist — parse input in the tab, emit a string, never fetch().
Treat the snippet as the contract: deterministic in, deterministic out. Invalid input should surface a string error, not a thrown render.
The Local Storage Sandbox & Volatile Data Pipelines
Default is React state only. Object URLs from canvases or downloads are revoked after click when the island uses URL.createObjectURL. There is no “recent jobs” IndexedDB. Close the tab to drop secrets (JWT HMAC keys, TOTP seeds, VAPID private JWK).
Verifying True Privacy: How to Audit Your Browser's Network Tab
F12 → Network → clear. Run the tool with a canary string such as TWA_CANARY_TOKEN. Filter Fetch/XHR. The canary must not appear in any request payload. Ads and analytics on the shell are unrelated to the island; they must not receive File bytes.