Up for Site of the Day — Closes at Mon 23:35 UK time
№ 0000 — Portfolio · Agency · Technology
Hallume
by Hallume · The premium UI & code library for the vibe coding era.
Early days
0 votes so far
Hallume by Hallume is up for Site of the Day until 19 October. It scores 76 for mobile performance.
An independent library of original UI, made in the UK. Hallume makes production-ready templates, components and effects for designers, developers and AI-assisted builders. Everything is original, typed, accessible and documented. The story: AI-assisted building has made it faster than ever to ship a site or an app. Hallume exists to make the starting point better: original, well-made UI you can trust in client and commercial work. New items are published every day: templates, components, UI kits, shaders, backgrounds, 3D, fonts and more. Each ships as clean source you can read, with Figma files where they help and an AI Kit so coding agents use it properly.
Score breakdown
Early days — 0 votes so far. Bars appear at 5 votes.
Weighted, trimmed mean, Bayesian smoothing (m = 15). How scoring works →
Who scored it
0 verified voters. Public voters are revealed after the window closes, so nobody herds.
Speed insights
Google PageSpeed InsightsB+80/100+Mozilla HTTP Observatory: B+, score 80, 11/12 tests passed. Shown only, not part of awards.- LCP
- 0.2 s
- TBT
- -135 ms
- CLS
- -0.02
- Speed Index
- -1.0 s
Measured with Google PageSpeed Insights (one test when the site was submitted, 16 Oct 2026). Shown for information; it doesn't affect the design score.
Security headers
Mozilla HTTP Observatory- Score
- 80/100
- Passed
- 11
- Failed
- 1
- cross-origin-embedder-policy: passed Cross-Origin-Embedder-Policy header not implemented. 0
- cross-origin-opener-policy: passed Cross-Origin-Opener-Policy header set to same-origin, enforcing site isolation from the opener. +10
- Content Security Policy (CSP): failed Content Security Policy (CSP) implemented unsafely. This includes 'unsafe-inline' or data: inside script-src, overly broad sources such as https: inside object-src or script-src, or not restricting the sources for object-src or script-src. -20
- Strict Transport Security (HSTS): passed Strict-Transport-Security header set to a minimum of six months (15768000). 0
- X-Frame-Options / frame-ancestors: passed X-Frame-Options (XFO) implemented via the CSP frame-ancestors directive. +5
- X-Content-Type-Options: passed X-Content-Type-Options header set to nosniff. 0
- Referrer-Policy: passed Referrer-Policy header set to no-referrer, same-origin, strict-origin or strict-origin-when-cross-origin. +5
- Cookies: failed No cookies detected 0
- Redirection (HTTP → HTTPS): passed Initial redirection is to HTTPS on same host, final destination is HTTPS 0
- Subresource Integrity (SRI): failed Subresource Integrity (SRI) not implemented, but all scripts are loaded from a similar origin. 0
- Cross-Origin-Resource-Policy (CORP): failed Cross Origin Resource Policy (CORP) is not implemented (defaults to cross-origin). 0
- Cross-Origin Resource Sharing (CORS): passed Public content is visible via cross-origin resource sharing (CORS) Access-Control-Allow-Origin header. 0
- Permissions-PolicyPresent. Shown for information; Observatory doesn't score it.n/a
Grade scale
- A+ 100+
- A 90–99
- A- 85–89
- B+ 80–84
- B 70–79
- B- 65–69
- C+ 60–64
- C 50–59
- C- 45–49
- D+ 40–44
- D 30–39
- D- 25–29
- F 0–24
Measured with Mozilla HTTP Observatory: one scan when the site was submitted. Shown for information only; it never counts towards scores or awards.
Accessibility (automated)
axe-coreCheck queued
One automated accessibility check runs when the site is submitted and appears here shortly. Shown for information only.
Credits
Design
- mrlouiswright
Design
Details
- Categories
- PortfolioAgencyTechnology
- Colours
- Country
- 🇬🇧 United Kingdom
- Published on Noticed
- 16 Oct 2026
Awards timeline
- Nominee — voting now
Window closes Mon 19 Oct, 23:35 UK