{
  "schemaVersion": 1,
  "type": "resource",
  "id": "storybook",
  "evaluation": {
    "reviewedOn": "2026-10-19",
    "status": "checked",
    "modes": [
      "browser",
      "source-review"
    ],
    "summary": "The public Storybook design-system demo loaded its Checkbox Playground story, and Space toggled the first checkbox false→true→false. This verifies one built-story interaction; no local build, addon or visual-testing service was run.",
    "reportUrl": "/design-evaluations/resource-storybook.json",
    "identity": {
      "target": "https://master--5ccbc373887ca40020446347.chromatic.com/",
      "version": "Unversioned public build observed 2026-10-19",
      "integrity": "Entry-response SHA-256 ac924094ea3fe0a921f5cd5e345f2162f4512322c7790275abdade025beb4845; not whole-application integrity."
    },
    "environment": [
      "Chromium 155.0.8059.82; fresh disposable browser context, no account state or ambient credential variables.",
      "Synthetic inputs only; no uploads, purchases, accounts or private data.",
      "Exact allowlisted public HTTPS origins with GET/HEAD; credentials, non-default ports, forms, downloads, service writes, auth/telemetry routes and WebSockets blocked. Restrictions may change page behavior."
    ],
    "tests": [
      {
        "name": "Public application entry",
        "mode": "browser",
        "method": "Load fresh browser document and inspect visible controls",
        "result": "pass",
        "observation": "HTTP 200; 45 sampled button controls, 1 visible inputs. Reachability alone does not establish product functionality."
      },
      {
        "name": "Hosted story keyboard interaction",
        "mode": "browser",
        "method": "Select public Checkbox story and toggle its first checkbox with Space twice",
        "result": "pass",
        "observation": "{\"story\":\"Playground\",\"before\":false,\"after\":true,\"restored\":false,\"limit\":\"Public built story only; no local Storybook build/addon/test-runner or authenticated Chromatic workflow.\"}"
      },
      {
        "name": "Local build and test pipeline",
        "mode": "browser",
        "method": "Install/build a project and execute its story test runner",
        "result": "not-run",
        "observation": "Only a public built story was exercised; local integration and automated test coverage remain unverified."
      }
    ],
    "security": {
      "scope": "Passive inspection of the named public response headers, requested origins and bounded public controls. No exploitation, authentication or backend permission tests.",
      "findings": [
        {
          "level": "caution",
          "basis": "observed",
          "title": "The sampled story executed in its preview frame",
          "detail": "The checkbox inside the preview iframe responded to keyboard input and returned to its starting state. That is stronger than iframe presence, but covers only this one public story."
        },
        {
          "level": "caution",
          "basis": "documented",
          "title": "Local development telemetry has an opt-out boundary",
          "detail": "Official documentation describes a boot event before configuration is evaluated and recommends STORYBOOK_DISABLE_TELEMETRY when that event must also be disabled. This pass did not start a local Storybook process."
        },
        {
          "level": "caution",
          "basis": "advice",
          "title": "Keep published stories free of private fixtures",
          "detail": "Review mock data, embedded URLs, source examples and browser-exposed environment configuration before sharing a story build. A development tool can still publish sensitive material if its inputs contain it."
        }
      ],
      "limits": [
        "No install/build process, addon execution, CI test runner, Chromatic login, visual regression service or real backend interaction.",
        "No complete dependency/vulnerability audit, authenticated data access, server authorization, retention or production security certification."
      ]
    },
    "practicalCaveats": [
      "Pick stories that represent failures, loading, empty states and awkward content rather than only the default appearance.",
      "Keep local component tests and full-application authorization tests as separate checks."
    ],
    "limits": [
      "One public Checkbox Playground story from the documented design-system demo; no pinned Storybook runtime build.",
      "No install/build process, addon execution, CI test runner, Chromatic login, visual regression service or real backend interaction."
    ],
    "sources": [
      {
        "label": "Why Storybook and story workflow",
        "url": "https://storybook.js.org/docs/get-started/why-storybook"
      },
      {
        "label": "Officially documented public demo destination",
        "url": "https://storybook.js.org/docs/sharing/storybook-composition"
      },
      {
        "label": "Telemetry controls",
        "url": "https://storybook.js.org/docs/configure/telemetry"
      },
      {
        "label": "Dated repository snapshot source",
        "url": "https://github.com/storybookjs/storybook"
      },
      {
        "label": "Evaluated public sample",
        "url": "https://master--5ccbc373887ca40020446347.chromatic.com/"
      }
    ]
  }
}