keyboard-a11y-tester

Miradi inayofuata mazoea bora hapa chini inaweza kujihakikisha kwa hiari na kuonyesha kuwa wamepata nishani ya mazoea bora ya Open Source Security Foundation (OpenSSF).

Hakuna seti ya mazoea yawezayo kuhakikisha kuwa programu haitakuwa na kasoro au udhaifu; hata mbinu rasmi zinaweza kushindwa ikiwa vipimo au dhana ni sahihi. Wala hakuna seti ya mazoea yawezayo kuhakikisha kuwa mradi utaendelea kuwa na jamii ya maendeleo yenye afya na inayofanya kazi vizuri. Hata hivyo, kufuata mazoea bora kunaweza kusaidia kuboresha matokeo ya miradi. Kwa mfano, baadhi ya mazoea huwezesha ukaguzi wa watu wengi kabla ya kutolewa, ambayo inaweza kusaidia kupata udhaifu wa kiufundi ambao vinginevyo ni vigumu kupata na kusaidia kujenga uaminifu na hamu ya mwingiliano wa kurudia kati ya wasanidi programu kutoka makampuni tofauti. Ili kupata nishani, vigezo vyote vya LAZIMA na LAZIMA WALA USIWAHI lazima vifuatwe, vigezo vyote vya INAPASWA lazima vifuatwe AU visivyo fufufutiliana na thibitisho, na vigezo vyote vya PENDEKEZA lazima vifuatwe AU visivyo fufufutiliana (tunataka vifikiwe angalau). Ikiwa unataka kuingiza maandishi ya thibitisho kama maoni ya jumla, badala ya kuwa maelezo ya busara kwamba hali ni inakubaliwa, anza kifungu cha maandishi na '//' ikifuatiwa na nafasi. Maoni ni karibu kupitia tovuti ya GitHub kama masuala au maombi ya kuvuta Kuna pia orodha ya barua pepe kwa majadiliano ya jumla.

Tunafuraha kutoa habari katika lugha nyingi, hata hivyo, ikiwa kuna mgongano au kutokuwa na usawa kati ya tafsiri, toleo la Kiingereza ni toleo lenye mamlaka.
Ikiwa huu ni mradi wako, tafadhali onyesha hadhi ya nishani yako kwenye ukurasa wa mradi wako! Hadhi ya nishani inaonekana kama hii: Kiwango cha nishani kwa mradi 13561 ni passing Hapa ni jinsi ya kuiweka:
Unaweza kuonyesha hali ya nishani yako kwa kuweka hii katika faili yako ya markdown:
[![OpenSSF Best Practices](https://www.bestpractices.dev/projects/13561/badge)](https://www.bestpractices.dev/projects/13561)
au kwa kuweka hii katika HTML yako:
<a href="https://www.bestpractices.dev/projects/13561"><img src="https://www.bestpractices.dev/projects/13561/badge"></a>


Hizi ni vigezo vya kiwango cha Dhahabu. Unaweza pia kuangalia vigezo vya kiwango cha Kupita au Fedha.

Baseline Series: Kiwango cha Msingi 1 Kiwango cha Msingi 2 Kiwango cha Msingi 3

        

 Misingi 0/5 ●

  • Jumla

    Kumbuka kwamba miradi mingine inaweza kutumia jina sawa.

    An AI-assisted web accessibility tester that behaves like two W3C personas at once: a keyboard-only user ("Ade") and a screen-reader user ("Lakshmi"). It drives a page keyboard-only, records what happens at every focus stop, and emits evidence-linked findings mapped to specific WCAG success criteria — against any website.

    Tafadhali tumia muundo wa maneno ya leseni ya SPDX; mifano ni pamoja na "Apache-2.0", "BSD-2-Clause", "BSD-3-Clause", "GPL-2.0+", "LGPL-3.0+", "MIT", na "(BSD-2-Clause OR Ruby)". Usitumie alama za nukuu za moja au mbili.
    Ikiwa kuna lugha zaidi ya moja, ziorodhe kama thamani zilizotengwa kwa koma (nafasi ni za hiari) na ziorodhe kuanzia iliyotumiwa zaidi hadi iliyotumiwa kidogo. Ikiwa kuna orodha ndefu, tafadhali orodhesha angalau tatu za kawaida zaidi. Ikiwa hakuna lugha (k.m., huu ni mradi wa nyaraka tu au wa majaribio tu), tumia herufi moja "-". Tafadhali tumia herufi kubwa za kawaida kwa kila lugha, k.m., "JavaScript".
    Common Platform Enumeration (CPE) ni mpango wa kuweka majina yenye muundo kwa mifumo ya teknolojia ya habari, programu, na vifurushi. Inatumika katika mifumo na hifadhidata nyingi wakati wa kuripoti udhaifu.

    keyboard-a11y-tester

    An AI-assisted web accessibility tester that behaves like two W3C personas at once: a
    keyboard-only user ("Ade") and a screen-reader user ("Lakshmi"). It drives a page
    keyboard-only, records what happens at every focus stop, and emits evidence-linked
    findings mapped to specific WCAG success criteria — against any website. Both
    personas run in the same pass by default; a --persona flag restricts to just one.

    It has two layers:

    • a deterministic runner (scripts/runner.mjs) that owns the mechanical, reproducible
      work — driving the page keyboard-only, capturing a per-step trace + screenshots, and
      computing the machine-decidable checks for both personas;
    • an AI-judgment layer — the invoking agent — that reads the trace/screenshots/census
      and judges what rules can't (task completion, logical focus/reading order, form
      quality, announcement quality). See SKILL.md for how an agent drives it.

    Standalone and portable: it depends only on playwright, yaml, pngjs, pixelmatch,
    and @guidepup/virtual-screen-reader, needs no bundled test cases, and writes all output
    to a per-user temp directory (never into this folder). The screen-reader persona
    never drives a real screen reader (NVDA/VoiceOver) — see "Screen-reader detection" below.

    Documentation: docs/usage.md (setup, dependencies, quick start,
    CAPTCHAs) · docs/interface.md (full CLI reference, output file
    schema, WCAG checks table).

    Quick start

    As a Claude Code plugin — register this repo as a plugin marketplace, then install it:

    /plugin marketplace add ezufelt/keyboard-a11y-tester
/plugin install keyboard-a11y-tester@ezufelt

    The first command registers this repo as a marketplace (named ezufelt, per
    .claude-plugin/marketplace.json); the second installs the plugin. Once installed, the
    skill in SKILL.md becomes available to the agent.

    As a standalone clone — clone the repo and install its dependencies:

    git clone https://github.com/ezufelt/keyboard-a11y-tester.git
cd keyboard-a11y-tester
npm install
npx playwright install chromium

    Then drive it directly (see Run against any URL).

    Requirements & dependencies

    Requires Node.js ≥ 20 and Chromium (via Playwright), plus five small npm dependencies —
    no build step. Run node scripts/setup-check.mjs to verify both before your first run.

    See docs/usage.md for the full dependency
    table, licensing credit for @guidepup/virtual-screen-reader, and setup instructions.

    Run against any URL (no test file needed)

    # quick unattended blind Tab-crawl of the start page, per viewport
node scripts/runner.mjs --url https://example.com

# a full scenario, driven live by the agent one keystroke at a time
node scripts/runner.mjs serve --url https://example.com --goal "find the pricing page" \

     --viewport desktop --port 9400
#   → prints:  READY <session-dir>   (under the system temp dir)
node scripts/runner.mjs observe <session-dir>
node scripts/runner.mjs step    <session-dir> --press Tab      # one keystroke; prints observation
node scripts/runner.mjs step    <session-dir> --press Enter
node scripts/runner.mjs step    <session-dir> --type "hello@example.com"
node scripts/runner.mjs finish  <session-dir>                  # writes trace + findings
node scripts/runner.mjs stop    <session-dir>

    See docs/usage.md for the full
    quick-start walkthrough, and docs/interface.md for every CLI flag and
    the complete output file schema.

    Authenticated runs

    Pages behind a login can't be tested with a fresh, logged-out browser. Pass a Playwright
    storageState JSON file with --storage-state <file> to start the browser with its cookies
    and localStorage already loaded (e.g. an already-logged-in session). Generate one with
    context.storageState({ path: 'auth.json' }) or npx playwright codegen --save-storage=auth.json <url>.
    The file is validated (exists, parses as JSON, and looks like a real storageState export —
    i.e. has cookies/origins arrays) before the browser launches — a missing or malformed file
    fails the run immediately rather than silently testing the logged-out site. In serve mode
    it's applied once at launch and the session browser keeps the state alive for every subsequent
    step.

    A storageState file holds live session cookies/tokens — treat it as a secret. Don't commit
    it; .gitignore already excludes auth.json, storageState.json, and *storage-state*.json,
    but a differently-named file won't be caught automatically.

    What the runner does (deterministic layer)

    Playwright (full Chromium, new-headless + SwiftShader for real pixels) drives the page with
    only the keyboard — it never calls .click() or .focus(); if a control is only
    reachable by pointer, that is itself a finding. It drops to a raw CDP session for the
    accessibility tree (Accessibility.getPartialAXTree), the ground truth for name/role/state.
    At startup it fails fast if :focus-visible does not fire on CDP-driven key events
    (every focus-indicator check would otherwise be invalid) — skipped entirely when
    --persona screen-reader is passed, since that persona has no pixel/focus-ring work.

    Checks are evaluated per focus stop the persona actually visits (keyboard persona) or
    against a page-wide structural census (screen-reader persona) — this is scenario
    testing, not an exhaustive page audit. Conformance target: AA is pass/fail, AAA is
    informative.

    WCAG Level Persona Check
    2.4.7 AA keyboard Focus indicator present
    2.4.13 AAA (informative) keyboard Focus indicator strength
    1.4.1 AA keyboard Indicator is not colour-only
    2.1.2 AA keyboard Keyboard trap
    2.4.1 AA keyboard No skip link
    2.4.3 AA keyboard Positive tabindex
    3.2.1 AA keyboard Context change from focus alone
    3.3.2 AA keyboard File input named only by the user-agent default ("Choose File")
    4.1.2 AA keyboard Focusable control with no accessible name
    1.1.1 AA screen-reader Missing alt text/aria-label
    1.3.1 AA screen-reader Heading level skip
    1.3.1 AA screen-reader Duplicate, unlabeled landmark roles
    4.1.2 AA screen-reader Interactive control announced as a bare role
    4.1.3 AA screen-reader Declared live region that never announced anything

    See docs/interface.md for the authoritative version of
    this table (full check descriptions) and the W3C persona references.

    Output

    Everything is written under a per-user temp dir (${TMPDIR}/keyboard-a11y-tester/…, or
    --out): a trace.json (per-step evidence), deterministic-findings.json (WCAG findings),
    screen-reader-census.json (screen-reader persona), and cropped screenshots/step_NNNN.png
    per viewport. See docs/interface.md for the
    complete directory layout and field-by-field schema of every output file.

    Focus-visible detection (2.4.7 AA presence + 2.4.13 AAA strength)

    Presence (AA) uses two independent signals, so a faint-but-real indicator is never
    missed:

    1. the focused element's computed style declares an outline or box-shadow (ground
      truth — recorded in the trace as computed_focus_style), or
    2. pixels change on focus (catches background/colour indicators with no outline).

    Either one means the indicator is present → AA pass. Pixel diffing compares the focused
    frame to a scroll-aligned baseline (the next step's frame, where the element is no longer
    focused — so focus is never manipulated programmatically), measuring ring slices at
    increasing offset (thin and offset outlines), the interior, and top/bottom edge bands.

    Strength (AAA, informative) measures whether the indicator meets 2.4.13 Focus
    Appearance — changed area ≥ a 2px-thick perimeter of the control, and ≥ 3:1 WCAG luminance
    contrast between focused and unfocused states. Advisory only. (This measure is unreliable
    on pages that mutate between steps — e.g. "load more" — because the neighbour-frame
    baseline then differs by content, not just the focus ring; treat AAA numbers on such pages
    with caution. AA presence is unaffected, being driven by the computed style.)

    So 2.4.7 (AA) requires only that an indicator is visible with no size/contrast minimum: a
    faint 1px or low-opacity ring passes AA and is flagged weak at AAA — rather than being
    falsely reported as "no focus indicator."

    Screen-reader detection (Lakshmi)

    The screen-reader persona is emulated, never driven for real: @guidepup/virtual-screen-reader
    builds an ARIA/ACCNAME-spec accessible tree over the live page and computes what a
    spec-compliant screen reader would announce, entirely in the browser's own JS engine — no
    NVDA/JAWS/VoiceOver is launched, and it works the same way on any OS the runner itself
    supports.

    Its self-contained browser bundle is injected via Playwright's context.addInitScript,
    which is not subject to the page's own CSP — verified against both a synthetic CSP-locked
    page and a real CSP-locked production site. Once injected, its virtual cursor tracks
    real keyboard focus automatically     (it listens for native focusin events), so every
    step you drive with real Tab/Enter/etc. produces a matching sr_announcement with no
    separate "chasing" logic and no drift between what's focused and what's reported as
    announced. The same mechanism also wires a MutationObserver that computes WAI-ARIA
    live-region semantics and captures "assertive: …"/"polite: …" announcements as they
    happen — this is what 4.1.3 (Status Messages) findings are derived from.

    Separately, once per newly-visited page URL, an ephemeral instance walks the entire page
    in reading order (never touching the live per-step monitor) to build
    screen-reader-census.json — the source for the heading-hierarchy, duplicate-landmark,
    missing-alt-text, and bare-role-control checks, since those need whole-page context rather
    than just the stops a keyboard user's Tab order happens to visit.

    This augments but does not replace testing with a real screen reader and real users —
    the upstream library's own README says exactly that, and it's worth repeating: this checks
    what a spec-compliant screen reader should announce given the page's ARIA/HTML, not the
    specific quirks of any one real screen reader implementation.

    CAPTCHAs

    CAPTCHAs detect automation and refuse to run; the runner has a page-scoped, human-approved
    compatibility workaround. See docs/usage.md for details.

    License

    MIT © Everett Zufelt. See LICENSE.

  • Mahitaji ya awali


    Si ya kutosha kwa nishani.

    Mradi LAZIMA ufikie kiwango cha nishani ya fedha. [achieve_silver]

  • Usimamizi wa mradi


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uwe na "bus factor" ya 2 au zaidi. (URL inahitajika) [bus_factor]
    "Bus factor" (pia inajulikana kama "truck factor") ni idadi ya chini ya washiriki wa mradi ambao wanapaswa kutoweka ghafla kutoka kwenye mradi ("kupigwa na basi") kabla ya mradi kusimama kwa sababu ya ukosefu wa wafanyakazi wenye elimu au wenye uwezo. Zana ya truck-factor inaweza kukadiria hii kwa miradi kwenye GitHub. Kwa maelezo zaidi, angalia Kutathmini Bus Factor ya Hifadhi za Git na Cosentino et al.

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uwe na angalau wachangiaji wawili wasiohusika. (URL inahitajika) [contributors_unassociated]
    Wachangiaji wanahusianishwa ikiwa wanalipwa kufanya kazi na shirika moja (kama mwajiriwa au mkandarasi) na shirika lile linapata faida kutokana na matokeo ya mradi. Misaada ya kifedha haihesabiwi kuwa kutoka shirika sawa ikiwa inapitia mashirika mengine (k.m., misaada ya sayansi inayolipwa kwa mashirika tofauti kutoka serikali ya kawaida au chanzo cha NGO haifanyi wachangiaji kuhusianishwa). Mtu ni mchangiaji muhimu ikiwa amefanya michango isiyojulikana kwa mradi katika mwaka uliopita. Mifano ya viashiria vizuri vya mchangiaji muhimu ni: ameandika angalau mistari 1,000 ya msimbo, amechangia commits 50, au amechangia angalau kurasa 20 za nyaraka.

  • Mengine


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA ujumuishe tamko la leseni katika kila faili ya chanzo. Hii YAWEZA kufanyika kwa kujumuisha yafuatayo ndani ya maoni karibu na mwanzo wa kila faili: SPDX-License-Identifier: [maneno ya leseni ya SPDX kwa mradi]. [license_per_file]
    Hii pia YAWEZA kufanyika kwa kujumuisha tamko katika lugha asilia ikitambulisha leseni. Mradi pia YAWEZA kujumuisha URL thabiti inayoelekeza kwenye maandishi ya leseni, au maandishi kamili ya leseni. Kumbuka kwamba kigezo cha license_location kinahitaji leseni ya mradi iwe mahali pa kawaida. Angalia mafunzo haya ya SPDX kwa maelezo zaidi kuhusu maneno ya leseni ya SPDX. Kumbuka uhusiano na copyright_per_file, ambayo yaliyomo yake kwa kawaida yangetangulia maelezo ya leseni.

 Udhibiti wa Mabadiliko 1/4 ●

  • Hifadhi ya chanzo ya kudhibiti toleo ya hadharani


    Ya kutosha kwa nishani!

    Hifadhi ya chanzo ya mradi LAZIMA itumie programu ya kawaida ya kudhibiti toleo linalosambazwa (k.m., git au mercurial). [repo_distributed]
    Git haihitajiki kihususa na miradi inaweza kutumia programu ya udhibiti wa toleo iliyokusanyika (kama subversion) na sababu.

    Repository on GitHub, which uses git. git is distributed.


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA utambulishe kazi ndogo ambazo zinaweza kufanywa na wachangiaji wapya au wa mara kwa mara. (URL inahitajika) [small_tasks]
    Utambulisho huu kwa kawaida unafanyika kwa kuweka alama masuala yaliyochaguliwa katika kifuatiliaji cha masuala kwa lebo moja au zaidi ambazo mradi unatumia kwa madhumuni hayo, k.m., up-for-grabs, first-timers-only, "Marekebisho madogo", microtask, au IdealFirstBug. Kazi hizi mpya hazihitaji kujumuisha kuongeza utendaji; zinaweza kuwa kuboresha nyaraka, kuongeza hali za majaribio, au chochote kingine kinachosaidia mradi na kusaidia mchangiaji kuelewa zaidi kuhusu mradi.

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uhitaji uthibitishaji wa mambo mawili (2FA) kwa wasanidi programu ili kubadilisha hifadhi ya kati au kupata data nyeti (kama ripoti za faragha za udhaifu). Utaratibu huu wa 2FA YAWEZA kutumia taratibu bila taratibu za usimbuaji kama SMS, ingawa hii hairuhusiwi. [require_2FA]

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Uthibitishaji wa mambo mawili (2FA) ya mradi INAPASWA kutumia taratibu za usimbuaji ili kuzuia ujigeuzi. Uthibitishaji wa 2FA unaotegemea Huduma ya Ujumbe Mfupi (SMS), peke yake, HAUKIDHI kigezo hiki, kwa kuwa haufichui. [secure_2FA]
    Utaratibu wa 2FA unaokidhi kigezo hiki unaweza kuwa programu ya Nywila ya Mara Moja Inayotegemea Muda (TOTP) ambayo inazalisha kiotomatiki msimbo wa uthibitishaji unaobadilika baada ya muda fulani. Kumbuka kwamba GitHub inasaidia TOTP.

 Ubora 1/7 ●

  • Viwango vya msimbo


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uandike mahitaji yake ya kukagua msimbo, pamoja na jinsi ukaguzi wa nambari unafanywa, nini lazima ichunguzwe, na nini kinachohitajika ili ikubalike. (URL inahitajika) [code_review_standards]
    Angalia pia two_person_review na contribution_requirements.

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uwe na angalau 50% ya marekebisho yote yaliyopendekezwa kupitishwa kabla ya kutolewa na mtu mwingine isipokuwa mwandishi, ili kuamua ikiwa ni marekebisho ya manufaa na huru ya masuala yaliyojulikana ambayo yangepingana na ujumuishaji wake [two_person_review]

  • Mfumo wa ujenzi unaofanya kazi


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uwe na ujenzi unaorudiwa. Ikiwa hakuna ujenzi unaofanyika (k.m., lugha za uandishi ambapo msimbo wa chanzo unatumika moja kwa moja badala ya kukusanywa), chagua "haihusiki" (N/A). (URL inahitajika) [build_reproducible]
    Ujenzi unaorudiwa unamaanisha kwamba pande nyingi zinaweza kwa uhuru kurudia mchakato wa kuzalisha taarifa kutoka faili za chanzo na kupata matokeo sawa ya biti-kwa-biti. Katika hali fulani, hii inaweza kutatuliwa kwa kulazimisha mpangilio fulani wa aina. Wasanidi wa JavaScript wanaweza kuzingatia kutumia npm shrinkwrap na webpack OccurrenceOrderPlugin. Watumiaji wa GCC na clang wanaweza kupata chaguo la -frandom-seed kuwa na manufaa. Mazingira ya ujenzi (ikijumuisha zana) kwa kawaida yanaweza kufafanuliwa kwa pande za nje kwa kubainisha hash ya usimbuaji ya chombo maalum au mashine ya kawaida ambayo wanaweza kutumia kwa kujenga upya. Mradi wa majengo yanayorudiwa una nyaraka za jinsi ya kufanya hivi.

  • Seti ya majaribio otomatiki


    Ya kutosha kwa nishani!

    Seti ya majaribio LAZIMA iweze kuitwa kwa njia ya kawaida kwa lugha hiyo. (URL inahitajika) [test_invocation]
    Kwa mfano, "make check", "mvn test", au "rake test" (Ruby).

    https://github.com/ezufelt/keyboard-a11y-tester/blob/main/package.json


    Si ya kutosha kwa nishani.

    Mradi LAZIMA utekeleze ujumuishaji wa kuendelea, ambapo msimbo mpya au uliobadilishwa unajumuishwa mara kwa mara katika hifadhi ya msimbo ya kati na majaribio ya kiotomatiki yanafanywa kwenye matokeo. (URL inahitajika) [test_continuous_integration]
    Katika hali nyingi hii inamaanisha kwamba kila msanidi programu anayefanya kazi kikamilifu kwenye mradi anajumuisha angalau kila siku.

    New project


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uwe na seti ya majaribio ya kiotomatiki ya FLOSS ambayo inatoa angalau 90% ya ufikio wa tamko ikiwa kuna angalau zana moja ya FLOSS ambayo inaweza kupima kigezo hiki katika lugha iliyochaguliwa. [test_statement_coverage90]

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uwe na seti ya jaribio zilizofanywa kiotomatiki za FLOSS ambazo zinatoa angalau asilimia 80 ya uangaliaji wa tawi ikiwa kuna angalau zana moja ya FLOSS inayoweza kupima kigezo hiki katika lugha iliyochaguliwa. [test_branch_coverage80]

 Usalama 0/5 ●

  • Tumia mazoea mazuri ya msingi ya usimbuaji

    Kumbuka kwamba programu fulani haihitaji kutumia taratibu za usimbuaji. Ikiwa mradi wako unazalisha programu ambayo (1) inajumuisha, inaamilisha, au inafanya usimbuaji kuwa hai, na (2) inaweza kutolewa kutoka Marekani (US) kwenda nje ya Marekani au kwa raia asiye wa Marekani, inaweza kuwa ni lazima kisheria kuchukua hatua chache za ziada. Kawaida hii inahusisha tu kutuma barua pepe. Kwa maelezo zaidi, tazama sehemu ya usimbuaji ya Kuelewa Teknolojia ya Chanzo Wazi & Udhibiti wa Usafirishaji wa Marekani.

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Programu iliyozalishwa na mradi LAZIMA isaidie itifaki salama kwa mawasiliano yake yote ya mtandao, kama vile SSHv2 au zaidi, TLS1.2 au zaidi (HTTPS), IPsec, SFTP, na SNMPv3. Itifaki zisizo salama kama vile FTP, HTTP, telnet, SSLv3 au mapema zaidi, na SSHv1 LAZIMA zizimwe kwa chaguo-msingi, na kuzimwa tu ikiwa mtumiaji anaisanidi mahususi. Ikiwa programu iliyozalishwa na mradi haiesaidii mawasiliano ya mtandao, chagua "haihusiki" (N/A). [crypto_used_network]

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Programu iliyozalishwa na mradi LAZIMA, ikiwa inasaidia au inatumia TLS, isaidie angalau toleo la TLS 1.2. Kumbuka kwamba kabla ya TLS kuitwa SSL. Ikiwa programu haitumii TLS, chagua "haihusiki" (N/A). [crypto_tls12]

  • Utoaji salama dhidi ya mashambulizi ya mtu-katikati (MITM)


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Tovuti ya mradi, hifadhi (ikiwa inapatikana kupitia wavuti), na tovuti ya kupakua (ikiwa ni tofauti) LAZIMA ijumuishe vichwa muhimu vya kuimarisha na thamani zisizo na ruhusa. (URL inahitajika) [hardened_site]
    Kumbuka kwamba GitHub na GitLab zinajulikana kukidhi hii. Tovuti kama vile https://securityheaders.com/ zinaweza kuangalia hii haraka. Vichwa muhimu vya kuimarisha ni: Sera ya Usalama wa Maudhui (CSP), Usalama wa Usafiri wa HTTP Mkali (HSTS), X-Content-Type-Options (kama "nosniff"), na X-Frame-Options. Tovuti za wavuti zilizo za tuli kabisa bila uwezo wa kuingia kupitia kurasa za wavuti zinaweza kuacha baadhi ya vichwa vya kuimarisha na hatari ndogo, lakini hakuna njia ya kuaminika ya kugundua tovuti kama hizo, kwa hivyo tunahitaji vichwa hivi hata kama ni tovuti za tuli kabisa.

  • Masuala mengine ya usalama


    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Mradi LAZIMA uwe umefanya ukaguzi wa usalama ndani ya miaka 5 iliyopita. Ukaguzi huu LAZIMA uzingatie mahitaji ya usalama na mpaka wa usalama. [security_review]
    Hii YAWEZA kufanywa na wanachama wa mradi na/au tathmini huru. Tathmini hii YAWEZA kusaidiwa na zana za uchambuzi za tuli na zenye nguvu, lakini lazima pia kuwe na ukaguzi wa binadamu ili kutambua matatizo (hasa katika muundo) ambayo zana haziwezi kugundua.

    Taarifa inayohitajika haijulikani, si ya kutosha kwa nishani.

    Taratibu za kuimarisha LAZIMA zitumike katika programu iliyozalishwa na mradi ili kasoro za programu ziwe na uwezekano mdogo wa kusababisha udhaifu wa usalama. (URL inahitajika) [hardening]
    Taratibu za kuimarisha zinaweza kujumuisha vichwa vya HTTP kama Sera ya Usalama wa Maudhui (CSP), bendera za mkusanyaji ili kupunguza mashambulizi (kama vile -fstack-protector), au bendera za mkusanyaji ili kuondoa tabia isiyofafanuliwa. Kwa madhumuni yetu upendeleo mdogo hauhesabiwi kuwa utaratibu wa kuimarisha (upendeleo mdogo ni muhimu, lakini tofauti).

 Uchanganuzi 1/2 ●

  • Uchambuzi wa msimbo wa nguvu za ziada


    Si ya kutosha kwa nishani.

    Mradi LAZIMA utumie angalau zana moja ya uchambuzi wenye nguvu kwa toleo lolote lililopendekezwa kuu la uzalishaji wa programu iliyozalishwa na mradi kabla ya kutolewa kwake. [dynamic_analysis]
    Zana ya uchambuzi wa nguvu inachunguza programu kwa kuitekeleza na ingizo maalum. Kwa mfano, mradi YAWEZA kutumia zana ya fuzzing (k.m., American Fuzzy Lop) au kitafutaji cha programu ya wavuti (k.m., OWASP ZAP au w3af). Katika hali fulani mradi wa OSS-Fuzz unaweza kuwa tayari kutumia majaribio ya fuzz kwenye mradi wako. Kwa madhumuni ya kigezo hiki zana ya uchambuzi wa nguvu inahitaji kubadilisha ingizo kwa njia fulani kutafuta aina mbalimbali za matatizo au kuwa seti kiotomatiki ya majaribio yenye angalau asilimia 80 ya ukaguzi wa tawi. Ukurasa wa Wikipedia kuhusu uchambuzi wa nguvu na ukurasa wa OWASP kuhusu fuzzing hutambulisha baadhi ya zana za uchambuzi wa nguvu. Zana za uchambuzi ZINAWEZA kuzingatia kutafuta udhaifu wa usalama, lakini hii haihitajiki.

    New project


    Kwa shida ya kutosha kwa nishani.

    Mradi INAPASWA kujumuisha madai mengi ya muda wa kutekeleza katika programu inayozalisha na kuangalia madai hayo wakati wa uchambuzi wenye nguvu. [dynamic_analysis_enable_assertions]
    Kigezo hiki hakipendekezi kuwezesha madai wakati wa uzalishaji; hilo ni kabisa kwa mradi na watumiaji wake kuamua. Lengo la kigezo hiki ni badala yake kuboresha ugunduzaji wa hitilafu wakati wa uchambuzi wa nguvu kabla ya kusambazwa. Kuwezesha madai katika matumizi ya uzalishaji ni tofauti kabisa na kuwezesha madai wakati wa uchambuzi wa nguvu (kama vile majaribio). Katika hali fulani kuwezesha madai katika matumizi ya uzalishaji ni busara sana (hasa katika vipengele vya uadilifu wa juu). Kuna hoja nyingi dhidi ya kuwezesha madai katika uzalishaji, k.m., maktaba hazipaswi kuvuruga waita, uwepo wao unaweza kusababisha kukataliwa na maduka ya programu, na/au kuamilisha madai katika uzalishaji kunaweza kufunua data za faragha kama vile funguo za faragha. Kumbuka kwamba katika usambazaji mwingi wa Linux NDEBUG haijafafanuliwa, hivyo C/C++ assert() kwa chaguo-msingi itawezeshwa kwa uzalishaji katika mazingira hayo. Inaweza kuwa muhimu kutumia utaratibu tofauti wa madai au kufafanua NDEBUG kwa uzalishaji katika mazingira hayo.

    New project



Data hii inapatikana chini ya Community Data License Agreement – Permissive, Version 2.0 (CDLA-Permissive-2.0). Hii inamaanisha kuwa Mpokeaji wa Data anaweza kushiriki Data, na au bila marekebisho, mradi Mpokeaji wa Data anapatanisha maandishi ya mkataba huu na Data iliyoshirikiwa. Tafadhali tambua ezufelt na wachangiaji wa nishani ya Mazoea Bora ya OpenSSF.

Ingizo la nishani ya mradi linamilikiwa na: ezufelt.
Ingizo liliundwa siku 2026-07-10 18:22:26 UTC, iliyosasishwa mara ya mwisho siku 2026-07-10 21:04:01 UTC. Ilipata mara ya mwisho nishani ya kupita siku 2026-07-10 21:04:01 UTC.