From e9cee53a0cdcc58db32f7d41249a212ac095900f Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 3 Sep 2026 19:04:43 +0000
Subject: [PATCH 1/5] =?UTF-8?q?=F0=9F=8E=A8=20Palette:=20=EC=83=88=20?=
 =?UTF-8?q?=ED=83=AD=EC=97=90=EC=84=9C=20=EC=97=B4=EB=A6=AC=EB=8A=94=20?=
 =?UTF-8?q?=EC=99=B8=EB=B6=80=20=EB=A7=81=ED=81=AC=20=EC=A0=91=EA=B7=BC?=
 =?UTF-8?q?=EC=84=B1=20=EA=B0=9C=EC=84=A0?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .jules/palette.md            | 4 ++++
 scanner/dashboard/index.html | 2 +-
 2 files changed, 5 insertions(+), 1 deletion(-)

diff --git a/.jules/palette.md b/.jules/palette.md
index ea004e2d..3dd07ba3 100644
--- a/.jules/palette.md
+++ b/.jules/palette.md
@@ -81,3 +81,7 @@
 ## 2026-08-12 - Skip to Content Accessibility
 **Learning:** Screen reader and keyboard-only users experience significant friction when forced to navigate through repetitive header controls on every page load.
 **Action:** Keep a visible-on-focus skip link as the first interactive element, target a programmatically focusable main container, and give the focused link a high-contrast outline.
+
+## 2025-02-18 - External Links Context Switch Accessibility
+**Learning:** External links with `target="_blank"` cause a sudden context switch, which can disorient screen reader users if they are not explicitly warned beforehand.
+**Action:** When using `target="_blank"`, explicitly warn screen reader users of the context switch by adding text like `(opens in a new tab)` to the `aria-label` or visually hidden text.
diff --git a/scanner/dashboard/index.html b/scanner/dashboard/index.html
index 132bc31b..8df0a0ee 100644
--- a/scanner/dashboard/index.html
+++ b/scanner/dashboard/index.html
@@ -281,7 +281,7 @@ <h1>Dashboard</h1>
 function openDetail(f){
   lastFocus = document.activeElement;
   const s = String(f.severity||'INFO').toUpperCase();
-  const refs = (f.references||[]).map(r=>`<a href="${esc(safeUrl(r))}" target="_blank" rel="noopener">${esc(r)}</a>`).join('<br>');
+  const refs = (f.references||[]).map(r=>`<a href="${esc(safeUrl(r))}" target="_blank" rel="noopener" aria-label="${esc(r)} (opens in a new tab)">${esc(r)}</a>`).join('<br>');
   const owasp = (f.owasp||[]).join(', ');
   const cwe = (f.cwe||[]).join(', ');
   const d = document.getElementById('detail');

From 4546b4de325b69059b362fd215675e13b24b3f17 Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Fri, 4 Sep 2026 04:19:49 +0900
Subject: [PATCH 2/5] test(a11y): require perceivable new-tab hint without
 replacing link name

---
 ...dashboard_external_link_context_contract.py | 18 ++++++++++++++++++
 1 file changed, 18 insertions(+)
 create mode 100644 tests/test_dashboard_external_link_context_contract.py

diff --git a/tests/test_dashboard_external_link_context_contract.py b/tests/test_dashboard_external_link_context_contract.py
new file mode 100644
index 00000000..650e52f1
--- /dev/null
+++ b/tests/test_dashboard_external_link_context_contract.py
@@ -0,0 +1,18 @@
+"""Accessibility contract for dashboard links that open a new browser tab."""
+
+from pathlib import Path
+
+
+_DASHBOARD = Path("scanner/dashboard/index.html")
+
+
+def test_external_reference_link_warns_visually_and_in_accessible_name() -> None:
+    """New-tab references keep the visible URL and expose a perceivable context hint."""
+    source = _DASHBOARD.read_text(encoding="utf-8")
+
+    assert 'target="_blank" rel="noopener"' in source
+    assert 'aria-label="${esc(r)} (opens in a new tab)"' not in source
+    assert (
+        '${esc(r)} <span aria-hidden="true">↗</span>'
+        '<span class="sr-only"> (opens in a new tab)</span></a>'
+    ) in source

From 7cef2ecead7517538e60fb8b0b6a12666f308e6b Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Thu, 3 Sep 2026 19:33:06 +0000
Subject: [PATCH 3/5] =?UTF-8?q?=F0=9F=8E=A8=20Palette:=20=EC=83=88=20?=
 =?UTF-8?q?=ED=83=AD=EC=97=90=EC=84=9C=20=EC=97=B4=EB=A6=AC=EB=8A=94=20?=
 =?UTF-8?q?=EC=99=B8=EB=B6=80=20=EB=A7=81=ED=81=AC=20=EC=A0=91=EA=B7=BC?=
 =?UTF-8?q?=EC=84=B1=20=EA=B0=9C=EC=84=A0=20(=EA=B6=8C=EA=B3=A0=20?=
 =?UTF-8?q?=ED=98=95=ED=83=9C)?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .jules/palette.md            | 2 +-
 scanner/dashboard/index.html | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/.jules/palette.md b/.jules/palette.md
index 3dd07ba3..a7a77cb4 100644
--- a/.jules/palette.md
+++ b/.jules/palette.md
@@ -84,4 +84,4 @@
 
 ## 2025-02-18 - External Links Context Switch Accessibility
 **Learning:** External links with `target="_blank"` cause a sudden context switch, which can disorient screen reader users if they are not explicitly warned beforehand.
-**Action:** When using `target="_blank"`, explicitly warn screen reader users of the context switch by adding text like `(opens in a new tab)` to the `aria-label` or visually hidden text.
+**Action:** When using `target="_blank"`, explicitly warn users of the context switch by adding a visible advisory hint (like `↗`) with visually hidden text (like ` (opens in a new tab)`), rather than a universal screen-reader-only rule or replacing the visible label in the accessible name.
diff --git a/scanner/dashboard/index.html b/scanner/dashboard/index.html
index 8df0a0ee..be5cb296 100644
--- a/scanner/dashboard/index.html
+++ b/scanner/dashboard/index.html
@@ -281,7 +281,7 @@ <h1>Dashboard</h1>
 function openDetail(f){
   lastFocus = document.activeElement;
   const s = String(f.severity||'INFO').toUpperCase();
-  const refs = (f.references||[]).map(r=>`<a href="${esc(safeUrl(r))}" target="_blank" rel="noopener" aria-label="${esc(r)} (opens in a new tab)">${esc(r)}</a>`).join('<br>');
+  const refs = (f.references||[]).map(r=>`<a href="${esc(safeUrl(r))}" target="_blank" rel="noopener">${esc(r)} <span aria-hidden="true">↗</span><span class="sr-only"> (opens in a new tab)</span></a>`).join('<br>');
   const owasp = (f.owasp||[]).join(', ');
   const cwe = (f.cwe||[]).join(', ');
   const d = document.getElementById('detail');

From f6e32201aee24bb03fa5f0d1549c1137129d60f3 Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Fri, 4 Sep 2026 06:07:00 +0000
Subject: [PATCH 4/5] =?UTF-8?q?=F0=9F=8E=A8=20Palette:=20=EC=99=B8?=
 =?UTF-8?q?=EB=B6=80=20=EB=A7=81=ED=81=AC=20=EC=BB=A8=ED=85=8D=EC=8A=A4?=
 =?UTF-8?q?=ED=8A=B8=20=EC=A0=84=ED=99=98=EC=9D=84=20=EC=9C=84=ED=95=9C=20?=
 =?UTF-8?q?=EC=8B=9C=EA=B0=81=EC=A0=81=20=ED=9E=8C=ED=8A=B8=20=EC=B6=94?=
 =?UTF-8?q?=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit


From ec3945e67a0e45623262fae21e7f8987c55cf71d Mon Sep 17 00:00:00 2001
From: seonghobae <8172694+seonghobae@users.noreply.github.com>
Date: Fri, 4 Sep 2026 06:39:52 +0000
Subject: [PATCH 5/5] =?UTF-8?q?=F0=9F=8E=A8=20Palette:=20=EC=99=B8?=
 =?UTF-8?q?=EB=B6=80=20=EB=A7=81=ED=81=AC=20=EC=BB=A8=ED=85=8D=EC=8A=A4?=
 =?UTF-8?q?=ED=8A=B8=20=EC=A0=84=ED=99=98=EC=9D=84=20=EC=9C=84=ED=95=9C=20?=
 =?UTF-8?q?=EC=8B=9C=EA=B0=81=EC=A0=81=20=ED=9E=8C=ED=8A=B8=20=EC=B6=94?=
 =?UTF-8?q?=EA=B0=80?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit