nito reviews AI-written UI against existing components and approved Figma designs. We used Norma to review nito itself, then fixed, tested, merged, and rescanned.
The September 19, 22:57 baseline reported 46/100, Not Ready, with 1,660 issues and 43 security findings, including 19 high-severity findings.
The final September 20, 00:31 scan reported 72/100, CERTIFIED on main,
after merge 095a231421a99bfd17f3d73c8c798cf6efcd88a8. Its tree matches the tested
revision exactly. Security reached 78%, with zero high-severity findings and
24 medium findings remaining. Maintainability reached 98%, with five findings.
Architecture scored 100%, manageability 93%, and performance 94%.
Scalability remains at 5% and is explicitly deferred. The scan still reports 1,756 issues overall, including 1,698 scalability findings. Certification is the tool's overall rating, not a claim that every finding is resolved.
The repository changed throughout the hackathon, so score and issue-count changes cannot be attributed solely to this work. Norma does not expose the scanned commit SHA in this view; these are branch-level checkpoints.
Rule: rct-unsafe-href-binding-1.0, Dynamic Value Bound to href Without URL Validation.
File: src/components/reviews/review-detail.tsx.
The approved Figma link was bound directly to a generated URL. We added
safeNavigationHref(...) at rendering, alongside validation at the data boundaries.
Unsafe URL schemes are rejected. The final scan reports zero high-severity security
findings. The fix is included in PR #4.
Norma's dynamic-link warnings exposed inconsistent validation between Figma candidate creation, saved records, and browser responses. We aligned those boundaries and added a final rendering guard. GitHub links also receive path and host validation. Plain email links reject injected headers and parameters.
We sanitized gallery HTML with DOMPurify, replaced a fixed synthetic signing-test key with per-test keys, and tested rejection of mismatched signatures.
The async audit found real missing deadlines in source font loading, a sandbox policy request, and server-side SDK calls. Those are now bounded. Convex HTTP requests abort; authentication SDK waits fail after a deadline, although the SDK's underlying request may finish later. Timeouts do not silently retry mutations or mark an already-claimed review failed.
We also removed nested ternaries from production source, preserved the distinction between findings and unavailable evidence, and made failed retry refreshes visible.
Changes: initial validation, security pass, link and deadline follow-up, and readability and async fixes.
Rule: rct-open-redirect-1.0, Potential Open Redirect via Dynamic Navigation.
File: src/lib/analysis/checks/rules/contract-rule.ts, in runContractRule.
The flagged findings.push(...) appends an analysis result to a typed Finding[]
array; it does not navigate or redirect a browser.
The source is ctx.baselineRecords.get(obs.componentId), a lookup in a
Map<string, ComponentRecord>. The rule's generic .get() source and .push()
sink patterns mistake this Map-to-array flow for URL parameters reaching a router.
There is no navigation API at the flagged sink. We left the code unchanged and
ask that these inspected findings be considered false positives when scoring.
We also retained the selector formatter's small membership lookup: its preferred
order is the fixed list ['variant', 'size'], so that lookup is linear in selector
keys, not quadratic. Sorting has its separate cost.
An await without a local catch is not proof of a hang. Rejecting tests must fail,
and production helpers may propagate errors to their callers. We fixed actual
missing deadlines instead of adding catch blocks that conceal failures.
494 tests across 83 files, TypeScript, and the production webpack build passed. Biome reports 11 existing warnings. Regression tests cover unsafe links, malicious gallery markup, SDK timeouts, sandbox cancellation, authentication failure, and retry handling.
Chrome verified component groups, filters, collapsed passed results, review-list navigation, and public links using disposable synthetic data. This was not a new hosted provider review. No approved baseline, Norma rule, severity, exclusion, or suppression was changed to obtain a better score.