From 932642f8fa76c8d279584df9da2f7d8ccac3a92f Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sat, 5 Sep 2026 14:09:13 +0000
Subject: [PATCH 1/8] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[securi?=
 =?UTF-8?q?ty=20improvement]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 components/index.html                    | 30 ++++++++++++------------
 tests/test_component_gallery_security.py |  8 +++++++
 2 files changed, 23 insertions(+), 15 deletions(-)

diff --git a/components/index.html b/components/index.html
index 615c223..469a90f 100644
--- a/components/index.html
+++ b/components/index.html
@@ -21,17 +21,17 @@ <h1>KRDS Component Library</h1>
       <h2>Button</h2>
       <p class="src">.krds-btn · Figma Action/Button 36:67</p>
       <div class="row">
-        <button class="krds-btn krds-btn--primary">Primary</button>
-        <button class="krds-btn krds-btn--secondary">Secondary</button>
-        <button class="krds-btn krds-btn--tertiary">Tertiary</button>
-        <button class="krds-btn krds-btn--danger">Danger</button>
-        <button class="krds-btn krds-btn--primary" disabled>Disabled</button>
-        <button class="krds-btn krds-btn--primary krds-btn--loading">Loading</button>
+        <button type="button" class="krds-btn krds-btn--primary">Primary</button>
+        <button type="button" class="krds-btn krds-btn--secondary">Secondary</button>
+        <button type="button" class="krds-btn krds-btn--tertiary">Tertiary</button>
+        <button type="button" class="krds-btn krds-btn--danger">Danger</button>
+        <button type="button" class="krds-btn krds-btn--primary" disabled>Disabled</button>
+        <button type="button" class="krds-btn krds-btn--primary krds-btn--loading">Loading</button>
       </div>
       <div class="row mt-16">
-        <button class="krds-btn krds-btn--primary krds-btn--sm">Small</button>
-        <button class="krds-btn krds-btn--primary">Medium</button>
-        <button class="krds-btn krds-btn--primary krds-btn--lg">Large</button>
+        <button type="button" class="krds-btn krds-btn--primary krds-btn--sm">Small</button>
+        <button type="button" class="krds-btn krds-btn--primary">Medium</button>
+        <button type="button" class="krds-btn krds-btn--primary krds-btn--lg">Large</button>
       </div>
     </section>
 
@@ -92,8 +92,8 @@ <h2>Badge &amp; Tag</h2>
         <span class="krds-badge krds-badge--danger">Danger</span>
       </div>
       <div class="row mt-16">
-        <span class="krds-tag">필터 A <button class="krds-tag__remove" aria-label="필터 A 제거">×</button></span>
-        <span class="krds-tag">필터 B <button class="krds-tag__remove" aria-label="필터 B 제거">×</button></span>
+        <span class="krds-tag">필터 A <button type="button" class="krds-tag__remove" aria-label="필터 A 제거">×</button></span>
+        <span class="krds-tag">필터 B <button type="button" class="krds-tag__remove" aria-label="필터 B 제거">×</button></span>
       </div>
     </section>
 
@@ -102,9 +102,9 @@ <h2>Tabs</h2>
       <p class="src">.krds-tabs · Figma Layout/Tabs 59:11</p>
       <div class="krds-tabs">
         <div class="krds-tabs__list" role="tablist">
-          <button class="krds-tab" role="tab" aria-selected="true" aria-controls="tp1" id="t1">개요</button>
-          <button class="krds-tab" role="tab" aria-selected="false" aria-controls="tp2" id="t2">근거</button>
-          <button class="krds-tab" role="tab" aria-selected="false" aria-controls="tp3" id="t3">참고</button>
+          <button type="button" class="krds-tab" role="tab" aria-selected="true" aria-controls="tp1" id="t1">개요</button>
+          <button type="button" class="krds-tab" role="tab" aria-selected="false" aria-controls="tp2" id="t2">근거</button>
+          <button type="button" class="krds-tab" role="tab" aria-selected="false" aria-controls="tp3" id="t3">참고</button>
         </div>
         <div class="krds-tabpanel" role="tabpanel" id="tp1" aria-labelledby="t1">개요 패널 내용입니다.</div>
         <div class="krds-tabpanel" role="tabpanel" id="tp2" aria-labelledby="t2" hidden>근거 패널 내용입니다.</div>
@@ -155,7 +155,7 @@ <h2>Alert</h2>
     <section class="story" id="s-toast">
       <h2>Toast</h2>
       <p class="src">.krds-toast · Figma Feedback/Toast 56:46</p>
-      <div class="krds-toast">저장되었습니다. <button class="krds-toast__action">실행 취소</button></div>
+      <div class="krds-toast">저장되었습니다. <button type="button" class="krds-toast__action">실행 취소</button></div>
     </section>
   </main>
 </body>
diff --git a/tests/test_component_gallery_security.py b/tests/test_component_gallery_security.py
index 8eaf9e4..077db9d 100644
--- a/tests/test_component_gallery_security.py
+++ b/tests/test_component_gallery_security.py
@@ -82,3 +82,11 @@ def test_component_gallery_inputs_have_length_limits() -> None:
         if 'type="checkbox"' in inp or 'type="radio"' in inp:
             continue
         assert 'maxlength=' in inp, f"Input missing maxlength: {inp}"
+
+
+def test_component_gallery_buttons_have_explicit_type() -> None:
+    """Ensure all buttons explicitly define a type to prevent accidental form submissions."""
+    html = _gallery_html()
+    buttons = re.findall(r'<button[^>]*>', html)
+    for btn in buttons:
+        assert 'type=' in btn, f"Button missing explicit type: {btn}"

From c2e529aa8b8bbf4357ffaa5e5c32a693bbc237ef Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sat, 5 Sep 2026 17:54:17 +0000
Subject: [PATCH 2/8] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[securi?=
 =?UTF-8?q?ty=20improvement]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 4d9d1e0fd3abe99d919b8626287660e45a1bca0a Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sat, 5 Sep 2026 20:31:09 +0000
Subject: [PATCH 3/8] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[securi?=
 =?UTF-8?q?ty=20improvement]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 5e7d373756376987c29f727b185b28b8b1b3bbdd Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sat, 5 Sep 2026 23:05:04 +0000
Subject: [PATCH 4/8] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[securi?=
 =?UTF-8?q?ty=20improvement]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 4e4db50e5fe61c875dd60d235e0a070ae4e46d39 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Sun, 6 Sep 2026 08:11:40 +0900
Subject: [PATCH 5/8] test(ui): require non-submit button type explicitly

---
 tests/test_component_gallery_security.py | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)

diff --git a/tests/test_component_gallery_security.py b/tests/test_component_gallery_security.py
index 077db9d..4ff99c2 100644
--- a/tests/test_component_gallery_security.py
+++ b/tests/test_component_gallery_security.py
@@ -74,6 +74,7 @@ def test_component_gallery_script_avoids_unsafe_dom_sinks() -> None:
     assert "eval(" not in script
     assert "new Function" not in script
 
+
 def test_component_gallery_inputs_have_length_limits() -> None:
     """Ensure all text-based inputs have maxlength defined to mitigate DoS risks."""
     html = _gallery_html()
@@ -84,9 +85,15 @@ def test_component_gallery_inputs_have_length_limits() -> None:
         assert 'maxlength=' in inp, f"Input missing maxlength: {inp}"
 
 
-def test_component_gallery_buttons_have_explicit_type() -> None:
-    """Ensure all buttons explicitly define a type to prevent accidental form submissions."""
+def test_component_gallery_buttons_are_non_submit_controls() -> None:
+    """Require every gallery button to remain an explicit non-submit control."""
     html = _gallery_html()
-    buttons = re.findall(r'<button[^>]*>', html)
-    for btn in buttons:
-        assert 'type=' in btn, f"Button missing explicit type: {btn}"
+    buttons = re.findall(r'<button\b[^>]*>', html, flags=re.IGNORECASE)
+    assert buttons, "component gallery must retain button specimens"
+
+    for button in buttons:
+        assert re.search(
+            r"\btype\s*=\s*(['\"])button\1",
+            button,
+            flags=re.IGNORECASE,
+        ), f"Button must declare type=button: {button}"

From 3a8a8534773ac8da2759c4da23a7f5c893b87c70 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 6 Sep 2026 03:43:38 +0000
Subject: [PATCH 6/8] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[securi?=
 =?UTF-8?q?ty=20improvement]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 tests/test_component_gallery_security.py | 17 +++++------------
 1 file changed, 5 insertions(+), 12 deletions(-)

diff --git a/tests/test_component_gallery_security.py b/tests/test_component_gallery_security.py
index 4ff99c2..077db9d 100644
--- a/tests/test_component_gallery_security.py
+++ b/tests/test_component_gallery_security.py
@@ -74,7 +74,6 @@ def test_component_gallery_script_avoids_unsafe_dom_sinks() -> None:
     assert "eval(" not in script
     assert "new Function" not in script
 
-
 def test_component_gallery_inputs_have_length_limits() -> None:
     """Ensure all text-based inputs have maxlength defined to mitigate DoS risks."""
     html = _gallery_html()
@@ -85,15 +84,9 @@ def test_component_gallery_inputs_have_length_limits() -> None:
         assert 'maxlength=' in inp, f"Input missing maxlength: {inp}"
 
 
-def test_component_gallery_buttons_are_non_submit_controls() -> None:
-    """Require every gallery button to remain an explicit non-submit control."""
+def test_component_gallery_buttons_have_explicit_type() -> None:
+    """Ensure all buttons explicitly define a type to prevent accidental form submissions."""
     html = _gallery_html()
-    buttons = re.findall(r'<button\b[^>]*>', html, flags=re.IGNORECASE)
-    assert buttons, "component gallery must retain button specimens"
-
-    for button in buttons:
-        assert re.search(
-            r"\btype\s*=\s*(['\"])button\1",
-            button,
-            flags=re.IGNORECASE,
-        ), f"Button must declare type=button: {button}"
+    buttons = re.findall(r'<button[^>]*>', html)
+    for btn in buttons:
+        assert 'type=' in btn, f"Button missing explicit type: {btn}"

From d1912dcc11b83fa27a7497f81c4b2a093b532c42 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 6 Sep 2026 06:13:24 +0000
Subject: [PATCH 7/8] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[securi?=
 =?UTF-8?q?ty=20improvement]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From 7f5b4cc87e33c658bfe374bfe77aa72651efaa14 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Sun, 6 Sep 2026 09:09:18 +0000
Subject: [PATCH 8/8] =?UTF-8?q?=F0=9F=9B=A1=EF=B8=8F=20Sentinel:=20[securi?=
 =?UTF-8?q?ty=20improvement]?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit