Why we use an open engine and name it
Rule engines are commodity infrastructure. Writing a private one would mean re-deriving hundreds of checks, and a client would still have to take our word for what a finding means. An open engine can be audited by the developer who has to fix the code.
The trade is that the engine is not a moat, and we do not pretend it is. Our work sits in the layers a procurement reviewer actually reads: the clause mapping, the regression history, the manual sign-off and the sealed pack that ties them together.
What rules catch, and what they cannot
The first eight rows are machine-checkable. The last three are in every serious audit and no engine can decide them.
| Rule | What it detects | Typical impact | Decided by |
|---|---|---|---|
| image-alt | Images without a text alternative | critical | automated |
| color-contrast | Text below the contrast ratio | serious | automated |
| label | Form fields without a programmatic label | critical | automated |
| link-name | Links with no discernible name | serious | automated |
| target-size | Targets under 24 by 24 CSS pixels | serious | automated |
| html-has-lang | Missing or wrong language attribute | serious | automated |
| heading-order | Heading levels skipped | moderate | automated |
| aria-* | Invalid roles, states and properties | critical | automated |
| focus order | Whether the order makes sense | — | manual |
| keyboard traps | Whether a user can leave a widget | — | manual |
| screen reader flow | Whether the page reads coherently | — | manual |
What Conforma adds on top of the engine
Raw rule output is a list. What a client needs is a chain of custody with a history and a name attached to the judgement calls.
Automated testing covers a subset of accessibility barriers. Manual verification is required for a complete assessment.
How it runs inside the pipeline
- Playwright opens each page in chromium, waits for the network to settle, injects the engine and runs the configured rule set at the level and version the site is monitored against.
- Unmodified engine output is archived per page, so any claim can be traced back to the exact measurement that produced it.
- Each violation becomes a finding with a fingerprint of rule, selector and path, which is how a fix that returns after a deploy is reported as a regression.
- Our own short description and repair suggestion are attached per rule, in place of copied standard text, so a developer gets a next step rather than a quotation.
Licence, attribution and trademark
axe-core is published by Deque Systems under the Mozilla Public License 2.0. We consume it as an unmodified dependency: the library is installed from its published package, injected into the page at runtime by Playwright, and never edited. Because no MPL-covered file is changed, no file-level copyleft obligation is triggered on our own source; the licence text and the copyright notice travel with the dependency and are reproduced on our attributions page.
We do not use the “axe” trademark in our product name, our domain, our logo or our marketing claims. Conforma is not affiliated with or endorsed by Deque Systems. Naming the engine is a statement of provenance so a developer can verify a finding against the upstream rule, not a borrowed endorsement.
If the engine is upgraded, the version used for a scan is recorded in the run metadata and travels inside the evidence pack, so a finding from March can still be traced to the exact rule set that produced it.
- Library
- axe-core, by Deque Systems
- Licence
- Mozilla Public License 2.0
- Use
- Unmodified dependency, wrapped
- Trademark
- Not used in our name or marketing
Questions we get on this
Do you modify axe-core?
No. It is a dependency under MPL-2.0, injected at runtime, wrapped rather than edited. Attribution is published, and the axe trademark is not used in our product name or marketing.
So is Conforma just a wrapper?
The engine is one stage. Crawling, clause mapping, regression diffing, manual workflow, statement generation and the sealed evidence pack are ours, and they are what gets read in a tender.
Which impact levels are reported?
Critical, serious, moderate and minor. We keep those labels, weight them into a score, and always show the raw counts next to it so the weighting is visible.