Home/Advanced/Security & accessibility
Advanced / Zidom JS

Security & accessibility

Safe boundaries and responsibilities.

Understand the boundaries#

Zidom uses real DOM nodes and native browser event listeners. Its runtime also rejects common dangerous script URL protocols in supported URL attributes. These defenses are helpful but do not replace security reviews or application safeguards.

Application responsibilities#

  • Sanitize or validate untrusted user content, URLs and data before using them in application-controlled HTML or script contexts.
  • Authenticate and authorize every protected backend request independently of client-side route guards.
  • Deploy with a deliberate CSP and secure cookie/session policy. Test the application, not just the framework.
  • Handle errors and request cancellation, including stale responses and unexpected network failures.

Accessibility fundamentals#

  • Use semantic HTML: proper buttons, labels, headings, landmarks and accessible names.
  • Keep interactive UI usable by keyboard and visible focus.
  • Add focus restoration, trapping and Escape behavior to modal overlays; a Zidom Portal is not an accessible dialog widget.
  • Connect form errors to their controls using aria-describedby and focus invalid fields when appropriate.
  • Verify contrast and user preferences across light/dark themes; respect reduced motion.

Status of external audits#

Independent WCAG 2.2 AA, screen reader, CSP/XSS and threat-model reviews remain incomplete for the framework and pilot. Existing Node and partial browser test coverage should not be described as an external certification.

Read the upstream security and accessibility guide and release checklist.