Gauntlet report

https://optimusrex.web.app/ · 2026-09-01T15:38:15.623Z · 5 vantage points · tracker list 2026-09-01 · bundle 288cc9a43976aefe…

Highest finding: medium — 0 critical, 0 high, 5 medium, 5 low.

ES medium

egress ES · residential · tz Europe/Madrid · session …2.bnthbhRb9KlGyNE_wOB5dA · navigation 4064ms · session replay recorded (npm run replay ip-10-0-10-243:53d0ce22-7037-4013-9af7-df20b77982f5:cmtirt4xl0230o101q6i2cb9k:1788277096512.bnthbhRb9KlGyNE_wOB5dA)

10third-party requests before consent

1distinct third parties

0third-party cookies

0web-storage keys

Before any interaction

0 ms4746 ms since navigation started

Consent layer

Banner detected: yes
Accept in first layer: Accept
Reject in first layer: Decline
Reject clicked: yes — 0 third-party requests observed afterwards

Keyboard walk

#	role	accessible name	focus visible	in banner
1	`link`	Home	yes
2	`button`	Products	no
3	`link`	Products	yes
4	`link`	TrainerPass	yes
5	`link`	My cart: 0	yes
6	`link`	Tracking	yes
7	`button`	Shop Now	yes
8	`button`	TrainerPass	yes
9	`textbox`	View details for Core - Zero	yes
10	`textbox`	View details for Ring - 12 custom free-spin	yes
11	`textbox`	View details for Metal X adapter	yes
12	`link`	Instagram	yes
13	`link`	TikTok	yes
14	`link`	YouTube	yes
15	`link`	Linktree	yes
16	`link`	Contact	yes
17	`link`	About us	yes
18	`link`	Legal notice	yes
19	`link`	Privacy policy	yes
20	`link`	Cookie policy	yes
21	`link`	firezenk	yes
22	`button`	Accept	yes	yes
23	`button`	Decline	yes	yes

Evidence

HAR · requests · cookies · web storage · keyboard walk · AX tree · consent layer · findings · 01-pre-consent · 02-after-reject

Findings

medium

The banner is 21 tab stops deep

BANNER_LATE_IN_FOCUS_ORDER

A modal layer that blocks the page should receive focus immediately. Here the keyboard user must traverse the page behind the banner before reaching it.

EN 301 549 §9.2.4.3 / WCAG 2.1 SC 2.4.3 (Focus Order)

Evidence (5)

1. link "Home"
2. button "Products"
3. link "Products"
4. link "TrainerPass"
5. link "My cart: 0"

low

IP address disclosed to Google Fonts on load

THIRD_COUNTRY_TRANSFER

These hosts are not trackers, but loading them discloses the visitor's IP to a third-country recipient. German courts have treated the Google Fonts case as actionable; self-hosting removes it.

GDPR Chapter V — disclosing an IP address to a third-country recipient is a transfer

Evidence (4)

t=2964ms · GET https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap · loaded by https://optimusrex.web.app/css/styles.min.css
t=4053ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pa8FvOreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=4053ms · GET https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=4053ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pbYF_Oreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap

none

Reject-all was honoured for the observation window

REJECT_HONOURED

No consent-requiring third-party requests were seen after the refusal.

ePrivacy Directive 2002/58/EC Art. 5(3) — storing or accessing information on a user's device requires prior consent unless strictly necessary

DE medium

egress DE · residential · tz Europe/Berlin · session …3.vLUkEMS7dDPbUDmhUJD13w · navigation 2982ms · session replay recorded (npm run replay ip-10-0-11-133:8b08dfc7-206c-48e1-b872-061061edc248:cmtirt4xl0230o101q6i2cb9k:1788277125833.vLUkEMS7dDPbUDmhUJD13w)

10third-party requests before consent

1distinct third parties

0third-party cookies

0web-storage keys

Before any interaction

0 ms3753 ms since navigation started

Consent layer

Banner detected: yes
Accept in first layer: Accept
Reject in first layer: Decline
Reject clicked: yes — 0 third-party requests observed afterwards

Keyboard walk

#	role	accessible name	focus visible	in banner
1	`link`	Home	yes
2	`button`	Products	no
3	`link`	Products	yes
4	`link`	TrainerPass	yes
5	`link`	My cart: 0	yes
6	`link`	Tracking	yes
7	`button`	Shop Now	yes
8	`button`	TrainerPass	yes
9	`textbox`	View details for Core - Zero	yes
10	`textbox`	View details for Ring - 12 custom free-spin	yes
11	`textbox`	View details for Metal X adapter	yes
12	`link`	Instagram	yes
13	`link`	TikTok	yes
14	`link`	YouTube	yes
15	`link`	Linktree	yes
16	`link`	Contact	yes
17	`link`	About us	yes
18	`link`	Legal notice	yes
19	`link`	Privacy policy	yes
20	`link`	Cookie policy	yes
21	`link`	firezenk	yes
22	`button`	Accept	yes	yes
23	`button`	Decline	yes	yes

Evidence

HAR · requests · cookies · web storage · keyboard walk · AX tree · consent layer · findings · 01-pre-consent · 02-after-reject

Findings

medium

The banner is 21 tab stops deep

BANNER_LATE_IN_FOCUS_ORDER

A modal layer that blocks the page should receive focus immediately. Here the keyboard user must traverse the page behind the banner before reaching it.

EN 301 549 §9.2.4.3 / WCAG 2.1 SC 2.4.3 (Focus Order)

Evidence (5)

1. link "Home"
2. button "Products"
3. link "Products"
4. link "TrainerPass"
5. link "My cart: 0"

low

IP address disclosed to Google Fonts on load

THIRD_COUNTRY_TRANSFER

These hosts are not trackers, but loading them discloses the visitor's IP to a third-country recipient. German courts have treated the Google Fonts case as actionable; self-hosting removes it.

GDPR Chapter V — disclosing an IP address to a third-country recipient is a transfer

Evidence (4)

t=1771ms · GET https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap · loaded by https://optimusrex.web.app/css/styles.min.css
t=2977ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pa8FvOreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=2977ms · GET https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=2977ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pbYF_Oreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap

none

Reject-all was honoured for the observation window

REJECT_HONOURED

No consent-requiring third-party requests were seen after the refusal.

ePrivacy Directive 2002/58/EC Art. 5(3) — storing or accessing information on a user's device requires prior consent unless strictly necessary

FR medium

egress FR · residential · tz Europe/Paris · session …4.jpnrEzm87xlAMsDE0SdHag · navigation 2969ms · session replay recorded (npm run replay ip-10-0-10-243:dd69056c-05d3-4ab8-862e-1c15ec8c10bd:cmtirt4xl0230o101q6i2cb9k:1788277155164.jpnrEzm87xlAMsDE0SdHag)

10third-party requests before consent

1distinct third parties

0third-party cookies

0web-storage keys

Before any interaction

0 ms3398 ms since navigation started

Consent layer

Banner detected: yes
Accept in first layer: Accept
Reject in first layer: Decline
Reject clicked: yes — 0 third-party requests observed afterwards

Keyboard walk

#	role	accessible name	focus visible	in banner
1	`link`	Home	yes
2	`button`	Products	no
3	`link`	Products	yes
4	`link`	TrainerPass	yes
5	`link`	My cart: 0	yes
6	`link`	Tracking	yes
7	`button`	Shop Now	yes
8	`button`	TrainerPass	yes
9	`textbox`	View details for Core - Zero	yes
10	`textbox`	View details for Ring - 12 custom free-spin	yes
11	`textbox`	View details for Metal X adapter	yes
12	`link`	Instagram	yes
13	`link`	TikTok	yes
14	`link`	YouTube	yes
15	`link`	Linktree	yes
16	`link`	Contact	yes
17	`link`	About us	yes
18	`link`	Legal notice	yes
19	`link`	Privacy policy	yes
20	`link`	Cookie policy	yes
21	`link`	firezenk	yes
22	`button`	Accept	yes	yes
23	`button`	Decline	yes	yes

Evidence

HAR · requests · cookies · web storage · keyboard walk · AX tree · consent layer · findings · 01-pre-consent · 02-after-reject

Findings

medium

The banner is 21 tab stops deep

BANNER_LATE_IN_FOCUS_ORDER

A modal layer that blocks the page should receive focus immediately. Here the keyboard user must traverse the page behind the banner before reaching it.

EN 301 549 §9.2.4.3 / WCAG 2.1 SC 2.4.3 (Focus Order)

Evidence (5)

1. link "Home"
2. button "Products"
3. link "Products"
4. link "TrainerPass"
5. link "My cart: 0"

low

IP address disclosed to Google Fonts on load

THIRD_COUNTRY_TRANSFER

These hosts are not trackers, but loading them discloses the visitor's IP to a third-country recipient. German courts have treated the Google Fonts case as actionable; self-hosting removes it.

GDPR Chapter V — disclosing an IP address to a third-country recipient is a transfer

Evidence (4)

t=1724ms · GET https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap · loaded by https://optimusrex.web.app/css/styles.min.css
t=2957ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pa8FvOreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=2957ms · GET https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=2957ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pbYF_Oreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap

none

Reject-all was honoured for the observation window

REJECT_HONOURED

No consent-requiring third-party requests were seen after the refusal.

ePrivacy Directive 2002/58/EC Art. 5(3) — storing or accessing information on a user's device requires prior consent unless strictly necessary

IT medium

egress IT · residential · tz Europe/Rome · session …6.TEHciW3bAXIvULufOE7BeQ · navigation 6094ms · session replay recorded (npm run replay ip-10-0-11-133:221da86e-ac7a-4622-9732-fa61e95a366e:cmtirt4xl0230o101q6i2cb9k:1788277186186.TEHciW3bAXIvULufOE7BeQ)

10third-party requests before consent

1distinct third parties

0third-party cookies

0web-storage keys

Before any interaction

0 ms6455 ms since navigation started

Consent layer

Banner detected: yes
Accept in first layer: Accept
Reject in first layer: Decline
Reject clicked: yes — 0 third-party requests observed afterwards

Keyboard walk

#	role	accessible name	focus visible	in banner
1	`link`	Home	yes
2	`button`	Products	no
3	`link`	Products	yes
4	`link`	TrainerPass	yes
5	`link`	My cart: 0	yes
6	`link`	Tracking	yes
7	`button`	Shop Now	yes
8	`button`	TrainerPass	yes
9	`textbox`	View details for Core - Zero	yes
10	`textbox`	View details for Ring - 12 custom free-spin	yes
11	`textbox`	View details for Metal X adapter	yes
12	`link`	Instagram	yes
13	`link`	TikTok	yes
14	`link`	YouTube	yes
15	`link`	Linktree	yes
16	`link`	Contact	yes
17	`link`	About us	yes
18	`link`	Legal notice	yes
19	`link`	Privacy policy	yes
20	`link`	Cookie policy	yes
21	`link`	firezenk	yes
22	`button`	Accept	yes	yes
23	`button`	Decline	yes	yes

Evidence

HAR · requests · cookies · web storage · keyboard walk · AX tree · consent layer · findings · 01-pre-consent · 02-after-reject

Findings

medium

The banner is 21 tab stops deep

BANNER_LATE_IN_FOCUS_ORDER

A modal layer that blocks the page should receive focus immediately. Here the keyboard user must traverse the page behind the banner before reaching it.

EN 301 549 §9.2.4.3 / WCAG 2.1 SC 2.4.3 (Focus Order)

Evidence (5)

1. link "Home"
2. button "Products"
3. link "Products"
4. link "TrainerPass"
5. link "My cart: 0"

low

IP address disclosed to Google Fonts on load

THIRD_COUNTRY_TRANSFER

These hosts are not trackers, but loading them discloses the visitor's IP to a third-country recipient. German courts have treated the Google Fonts case as actionable; self-hosting removes it.

GDPR Chapter V — disclosing an IP address to a third-country recipient is a transfer

Evidence (4)

t=4706ms · GET https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap · loaded by https://optimusrex.web.app/css/styles.min.css
t=6083ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pa8FvOreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=6084ms · GET https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=6084ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pbYF_Oreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap

none

Reject-all was honoured for the observation window

REJECT_HONOURED

No consent-requiring third-party requests were seen after the refusal.

ePrivacy Directive 2002/58/EC Art. 5(3) — storing or accessing information on a user's device requires prior consent unless strictly necessary

NL medium

egress NL · residential · tz Europe/Amsterdam · session …4.GdWQ5tYNmsJ6fk36e2rF6Q · navigation 2588ms · session replay recorded (npm run replay ip-10-0-11-133:b6091163-2212-4924-ba8b-418dce44a04f:cmtirt4xl0230o101q6i2cb9k:1788277216114.GdWQ5tYNmsJ6fk36e2rF6Q)

10third-party requests before consent

1distinct third parties

0third-party cookies

0web-storage keys

Before any interaction

0 ms2951 ms since navigation started

Consent layer

Banner detected: yes
Accept in first layer: Accept
Reject in first layer: Decline
Reject clicked: yes — 0 third-party requests observed afterwards

Keyboard walk

#	role	accessible name	focus visible	in banner
1	`link`	Home	yes
2	`button`	Products	no
3	`link`	Products	yes
4	`link`	TrainerPass	yes
5	`link`	My cart: 0	yes
6	`link`	Tracking	yes
7	`button`	Shop Now	yes
8	`button`	TrainerPass	yes
9	`textbox`	View details for Core - Zero	yes
10	`textbox`	View details for Ring - 12 custom free-spin	yes
11	`textbox`	View details for Metal X adapter	yes
12	`link`	Instagram	yes
13	`link`	TikTok	yes
14	`link`	YouTube	yes
15	`link`	Linktree	yes
16	`link`	Contact	yes
17	`link`	About us	yes
18	`link`	Legal notice	yes
19	`link`	Privacy policy	yes
20	`link`	Cookie policy	yes
21	`link`	firezenk	yes
22	`button`	Accept	yes	yes
23	`button`	Decline	yes	yes

Evidence

HAR · requests · cookies · web storage · keyboard walk · AX tree · consent layer · findings · 01-pre-consent · 02-after-reject

Findings

medium

The banner is 21 tab stops deep

BANNER_LATE_IN_FOCUS_ORDER

A modal layer that blocks the page should receive focus immediately. Here the keyboard user must traverse the page behind the banner before reaching it.

EN 301 549 §9.2.4.3 / WCAG 2.1 SC 2.4.3 (Focus Order)

Evidence (5)

1. link "Home"
2. button "Products"
3. link "Products"
4. link "TrainerPass"
5. link "My cart: 0"

low

IP address disclosed to Google Fonts on load

THIRD_COUNTRY_TRANSFER

These hosts are not trackers, but loading them discloses the visitor's IP to a third-country recipient. German courts have treated the Google Fonts case as actionable; self-hosting removes it.

GDPR Chapter V — disclosing an IP address to a third-country recipient is a transfer

Evidence (4)

t=1463ms · GET https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap · loaded by https://optimusrex.web.app/css/styles.min.css
t=2580ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pa8FvOreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=2580ms · GET https://fonts.gstatic.com/s/inter/v20/UcC73FwrK3iLTeHuS_nVMrMxCp50SjIa1ZL7.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap
t=2580ms · GET https://fonts.gstatic.com/s/rajdhani/v17/LDI2apCSOBg7S-QT7pbYF_Oreec.woff2 · loaded by https://fonts.googleapis.com/css2?family=Rajdhani:wght@500;600;700&family=Inter:wght@400;500;600&display=swap

none

Reject-all was honoured for the observation window

REJECT_HONOURED

No consent-requiring third-party requests were seen after the refusal.

ePrivacy Directive 2002/58/EC Art. 5(3) — storing or accessing information on a user's device requires prior consent unless strictly necessary