From 51ca0ad20e2cf10cc5a5299e6c514980eb9070ff Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:49:29 +0000
Subject: [PATCH 1/2] fix(dashboard): add accessible warnings to external links

Modified scanner/dashboard/index.html to append screen reader only text
(.sr-only) and a visual indicator (aria-hidden="true") to target="_blank"
external links. This ensures users are aware of context changes when
navigating away from the dashboard.
---
 .jules/palette.md            | 4 ++++
 scanner/dashboard/index.html | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.jules/palette.md b/.jules/palette.md
index ea004e2d2..1eb172b7e 100644
--- a/.jules/palette.md
+++ b/.jules/palette.md
@@ -81,3 +81,7 @@
 ## 2026-08-12 - Skip to Content Accessibility
 **Learning:** Screen reader and keyboard-only users experience significant friction when forced to navigate through repetitive header controls on every page load.
 **Action:** Keep a visible-on-focus skip link as the first interactive element, target a programmatically focusable main container, and give the focused link a high-contrast outline.
+
+## 2026-10-09 - Accessible External Links
+**Learning:** `target="_blank"` external links without explicit accessible warnings fail to notify screen reader users of context changes and lack visual indicators for sighted users. English-only `aria-label` overrides visible text and breaks localization.
+**Action:** For `target="_blank"` external links, always provide both an assistive-technology warning (e.g., visually hidden `.sr-only` text inside the `<a>` tag) and a visible warning (e.g., an `aria-hidden="true"` icon).
diff --git a/scanner/dashboard/index.html b/scanner/dashboard/index.html
index 132bc31b2..24cbdf36d 100644
--- a/scanner/dashboard/index.html
+++ b/scanner/dashboard/index.html
@@ -281,7 +281,7 @@ <h1>Dashboard</h1>
 function openDetail(f){
   lastFocus = document.activeElement;
   const s = String(f.severity||'INFO').toUpperCase();
-  const refs = (f.references||[]).map(r=>`<a href="${esc(safeUrl(r))}" target="_blank" rel="noopener">${esc(r)}</a>`).join('<br>');
+  const refs = (f.references||[]).map(r=>`<a href="${esc(safeUrl(r))}" target="_blank" rel="noopener">${esc(r)} <span class="sr-only">(opens in a new tab)</span><span aria-hidden="true">↗</span></a>`).join('<br>');
   const owasp = (f.owasp||[]).join(', ');
   const cwe = (f.cwe||[]).join(', ');
   const d = document.getElementById('detail');

From 312f5e8ddbbab44783474bb7af489f4ddcdae2e7 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Fri, 9 Oct 2026 18:54:53 +0000
Subject: [PATCH 2/2] Trigger CI re-run