{
  "schemaVersion": 1,
  "type": "resource",
  "id": "govuk-design-system",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser",
      "source-review"
    ],
    "summary": "The public 200-character example reported the correct remaining and excess counts and preserved an over-limit value. No form submission or backend validation was exercised.",
    "reportUrl": "/design-evaluations/resource-govuk-design-system.json",
    "identity": {
      "target": "https://design-system.service.gov.uk/components/character-count/default/index.html",
      "version": "Unversioned public hosted page sampled on 2026-10-19; no installed package version attested.",
      "integrity": "Recorded document SHA-256 387d07b0f08b718668941ecaf11604412d91962b8f425fca57552beb42f66235. This is the HTML response only, not an integrity guarantee for scripts, dependencies or the whole service."
    },
    "environment": [
      "Fresh anonymous Chromium 155.0.8059.82 context on Windows; 1365 × 900 viewport; reduced motion requested.",
      "GET and HEAD only; non-GET methods and WebSockets blocked. No owner browser session, account, credentials, private fixtures, uploads or purchases.",
      "Only the named public controls and synthetic values were used. Screenshots and compact request observations were retained as review evidence."
    ],
    "tests": [
      {
        "name": "Public document response",
        "mode": "http",
        "method": "Navigate to the recorded public target in a fresh anonymous browser.",
        "result": "pass",
        "observation": "The sampled document returned HTTP 200 over HTTPS. Its response body SHA-256 was 387d07b0f08b718668941ecaf11604412d91962b8f425fca57552beb42f66235; this fingerprints only the recorded HTML response."
      },
      {
        "name": "Within-limit counter",
        "mode": "browser",
        "method": "Type the 15-character synthetic string “Synthetic note.” into the default public textarea.",
        "result": "pass",
        "observation": "The value length was 15 and the visible feedback reported 185 characters remaining."
      },
      {
        "name": "Over-limit feedback without truncation",
        "mode": "browser",
        "method": "Replace the value with 205 synthetic x characters and leave the field.",
        "result": "pass",
        "observation": "All 205 characters remained. The feedback reported 5 characters too many and the textarea received its error class."
      },
      {
        "name": "Primary-source scope review",
        "mode": "source-review",
        "method": "Read the official pages and relevant repository or standard references linked below.",
        "result": "pass",
        "observation": "Reviewed character-count use guidance and the official v6.6.0 release announcement. The hosted demo’s exact package build was not independently established."
      },
      {
        "name": "Broader workflow and assurance coverage",
        "mode": "browser",
        "method": "Keep authenticated, installation, private-data and broader accessibility workflows outside this bounded pass.",
        "result": "not-run",
        "observation": "No server-side validation, submission, screen-reader announcement, other component variant, non-Latin length rule or installation was tested."
      }
    ],
    "security": {
      "scope": "Passive observation of the sampled public pages, response headers and request destinations, plus the specific documented boundaries below. No intrusive scanning or security certification.",
      "findings": [
        {
          "level": "info",
          "basis": "observed",
          "title": "No service submission in the sample",
          "detail": "The isolated example requested only the design-system origin. No non-GET request or page error was observed, and the synthetic text was never submitted to a service endpoint."
        },
        {
          "level": "caution",
          "basis": "observed",
          "title": "Frontend counters are not enforcement",
          "detail": "The sample deliberately retained 205 characters despite a 200-character limit. Enforce service constraints on the server as well as providing usable client-side feedback."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Treat real service data separately",
          "detail": "Do not paste personal applications or case histories into public examples. Integrate and test the component in the approved service environment before using real data."
        }
      ],
      "limits": [
        "No backend, authenticated authorization, session isolation, vulnerability exploitation, dependency scan or account-data retention assessment was performed.",
        "The GET/HEAD-only guard can change hosted behavior; blocked background traffic is reported rather than treated as a product defect. Request observations are a bounded sample, not proof of all data handling."
      ]
    },
    "practicalCaveats": [
      "Choose a justified limit and explain it before the user starts typing.",
      "Preserve entered text on error and test the same rule in the backend; this counter alone cannot establish that behavior."
    ],
    "limits": [
      "No server-side validation, submission, screen-reader announcement, other component variant, non-Latin length rule or installation was tested.",
      "One browser, one viewport and a short observation window; no cross-browser, assistive-technology or complete accessibility audit.",
      "Proposed use-case examples in this review were not implemented as a production workflow."
    ],
    "sources": [
      {
        "label": "Official design system",
        "url": "https://design-system.service.gov.uk/"
      },
      {
        "label": "Character count guidance",
        "url": "https://design-system.service.gov.uk/components/character-count/"
      },
      {
        "label": "Public character-count example",
        "url": "https://design-system.service.gov.uk/components/character-count/default/index.html"
      },
      {
        "label": "GOV.UK Frontend repository",
        "url": "https://github.com/alphagov/govuk-frontend"
      },
      {
        "label": "v6.6.0 release",
        "url": "https://github.com/alphagov/govuk-frontend/releases/tag/v6.6.0"
      }
    ]
  }
}