FT-11: Payload safety
<!-- Generated from field-tests/suite.json by tools/field_tests.py. Edit the JSON, not this file. -->
Category: Safety · Time: about 10 minutes · Run it and see results: https://openckey.org/tests/test?id=FT-11
What it checks
A reader shows what a code holds and acts only on a tap, and flags content that is not a plain link.
Why
A code can hold anything, including a disguised link or a script-like string. The payload conventions say a reader must show the content and never act on its own; this checks that a reader does.
Test codes
Print or open the sheet at https://openckey.org/tests/sheet?id=FT-11. It is drawn by the CKey web SDK from the values below.
| Code | Size | Version | Level | Layout | Style | Holds |
|---|---|---|---|---|---|---|
| A | 1.5 in | smallest that fits | M | standard | plain | https://openckey.org/t/FT11-A |
| B | 1.5 in | smallest that fits | M | standard | plain | tel:+15550100 |
| C | 1.5 in | smallest that fits | M | standard | plain | javascript:alert('field test FT-11') |
| D | 1.5 in | smallest that fits | M | standard | plain | Field test FT-11, code D. This is plain text: a reader should show it and offer to copy it, not open anything. |
Set up
- Print the test sheet at 100% scale, or show it on a second screen.
Steps
- Scan each code, A to D.
- For each, record whether the reader showed the content before doing anything, and whether anything happened (a page opened, a call started) without your tap.
- Do not tap through on code C.
What to record
- Content shown before any action, boolean, required. For each of: A link, B phone, C script, D text.
- Something happened without a tap, boolean, required. For each of: A link, B phone, C script, D text.
Every report also records the device, operating system, reader and its version, and the printer or screen.
How to grade it
- Pass: Every code's content was shown first and nothing happened without a tap; code C offered no way to run it.
- Partial: Every code's content was shown first and nothing happened without a tap, but code C could be run.
- Fail: Anything happened without a tap.
Report a result
- On openckey.org: https://openckey.org/tests/test?id=FT-11, with optional photos.
- On GitHub: open a field-test report and choose FT-11.
Both are published together at https://openckey.org/tests and as JSON at https://openckey.org/api/field/results.