{
  "schemaVersion": 1,
  "type": "resource",
  "id": "heroui",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "http",
      "browser"
    ],
    "summary": "The public checkbox changed and restored selection through Space and its visible label. A disabled example ignored synthetic Space events. No HeroUI package was installed; v2 migration, form submission and Pro assets were not tested.",
    "reportUrl": "/design-evaluations/resource-heroui.json",
    "identity": {
      "target": "https://heroui.com/en/docs/react/components/checkbox",
      "version": "Unversioned public demo observed 2026-10-19; registry snapshot @heroui/react 3.2.6 was not locally executed.",
      "integrity": "Public document SHA-256 83e3951fce9223fb52fd8853acf1c5ac1973bd46f25719817911a49de907a09c; initial response only, not complete application integrity. Source snapshot ce90ea3ab49d58f6c428f71bfd6fe8ae2a87b960 does not identify the hosted deployment."
    },
    "environment": [
      "Chrome 155.0.8059.82, 1280 x 900 desktop viewport; UTC browser context.",
      "Fresh temporary browser profile and context; no inherited account storage. Child environment allowed only runtime paths, with credential variables omitted.",
      "Public HTTPS GET/HEAD only; form submission, non-read methods, WebSockets, service workers and downloads blocked. Selected telemetry requests were blocked."
    ],
    "tests": [
      {
        "name": "Public sample response",
        "mode": "http",
        "method": "Anonymous public GET; capture status, response-body hash and selected headers.",
        "result": "pass",
        "observation": "HTTP 200; https://heroui.com/en/docs/react/components/checkbox. Reachability only."
      },
      {
        "name": "Keyboard selection cycle",
        "mode": "browser",
        "method": "Focus the first documented checkbox/switch; press Space twice and inspect its checked state.",
        "result": "pass",
        "observation": "Checked false -> true -> false. No external form submitted."
      },
      {
        "name": "Pointer selection cycle",
        "mode": "browser",
        "method": "Click the same sample control twice and inspect state restoration.",
        "result": "pass",
        "observation": "Pointer toggled state=true; original state restored=true."
      },
      {
        "name": "Disabled sample boundary",
        "mode": "browser",
        "method": "Inspect a documented disabled control and try a synthetic Space key event without force-clicking or altering properties.",
        "result": "pass",
        "observation": "Disabled=true; checked unchanged=true. Programmatic events only; tab-order test not included."
      }
    ],
    "security": {
      "scope": "Passive inspection of official public response headers and request hosts, declared package metadata, and the exact local fixture where stated. No exploitation, authentication, private input or backend writes.",
      "findings": [
        {
          "level": "caution",
          "basis": "documented",
          "title": "Version alignment is a real integration requirement",
          "detail": "The captured v3 package manifest lists React 19, Tailwind 4 and multiple React Aria peers. A successful hosted demo does not show that an older application's dependency graph can accept those requirements."
        },
        {
          "level": "info",
          "basis": "observed",
          "title": "Sampled response and request surface",
          "detail": "The anonymous HTTPS demo response included strict-transport-security. Requests attempted 3 additional host(s), including agent.heroui.pro, api.heroui.pro, api.github.com. The guard blocked 0 request(s). Host attempts include blocked requests; this does not establish retained data or exploit resistance."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Check the installed dependency graph separately",
          "detail": "The registry snapshot identifies @heroui/react 3.2.6, but this review did not install or audit it. Lock and review the versions that actually enter your application; the hosted demo's success is not a dependency audit."
        }
      ],
      "limits": [
        "No authentication, authorization, tenant isolation, retention or backend processing was tested.",
        "No comprehensive source/dependency audit, vulnerability scan or security certification. Header presence or absence describes one response, not the safety of a product.",
        "Request guards can alter normal page behavior. Full browser, mobile, assistive-technology and performance coverage is outside this evaluation."
      ]
    },
    "practicalCaveats": [
      "Major-version migration can affect component names, imports, styling and peer dependencies.",
      "Preserve the hidden input and visible label relationship when customizing checkbox appearance.",
      "A disabled option does not protect a restricted operation; the server still needs to reject unauthorized requests."
    ],
    "limits": [
      "Only public v3 checkbox samples were exercised. The disabled check did not establish full tab order or screen-reader announcements.",
      "No local bundle, v2 migration, native platform, paid asset, server rendering or application workflow was evaluated."
    ],
    "sources": [
      {
        "label": "Official documentation",
        "url": "https://heroui.com/en/docs/react/getting-started"
      },
      {
        "label": "Official evaluated sample",
        "url": "https://heroui.com/en/docs/react/components/checkbox"
      },
      {
        "label": "Upstream repository",
        "url": "https://github.com/heroui-inc/heroui"
      },
      {
        "label": "GitHub repository snapshot endpoint",
        "url": "https://api.github.com/repos/heroui-inc/heroui",
        "scope": "Star count and repository identity observed 2026-10-19."
      },
      {
        "label": "Sampled source revision",
        "url": "https://github.com/heroui-inc/heroui/commit/ce90ea3ab49d58f6c428f71bfd6fe8ae2a87b960",
        "scope": "Default branch snapshot; not a claim that the hosted demo deploys this exact commit."
      },
      {
        "label": "Package manifest snapshot",
        "url": "https://registry.npmjs.org/@heroui/react/3.2.6",
        "scope": "Exact registry version and dependency/license declaration; installed only where the evaluation says so."
      },
      {
        "label": "HeroUI v2 to v3 migration",
        "url": "https://heroui.com/en/docs/react/migration"
      }
    ]
  }
}