Rubric: 100 points
The guided scaffold route can earn all 100 points. Assess only concepts and actions taught in the required worksheet.
| Area | Points | Full-credit evidence |
|---|---|---|
| Ordinary-message observations | 15 | Records ordinary text, punctuation, spaces-only feedback, and the short HTML example before repair. |
| Harmless demonstration | 20 | Uses the local demo and records UNCHANGED before and DEMO EXECUTED after Reader view in the starter, plus the actual initial check results. |
| Guided or independent repair | 30 | Submitted render.js displays complete messages as text, keeps messages separate and in order, and replaces previous displayed items when rendering again. No suppressed messages or weakened checks. |
| Verification after repair | 25 | Reports normal/punctuation/spaces-only/order cases, literal tags and demo text, unchanged marker, reset to two examples, and all six actual check outcomes. |
| Simple explanation | 10 | Explains that the starter interpreted message text as HTML instructions and the repair displays that same content as text. Everyday language is acceptable. |
Give partial credit within each area for the evidence supplied. Copying the provided scaffold and using its hint is expected. Do not grade typing speed, memorization of the payload, or independent implementation when a student chose the guided route.
Trust boundaries, backend controls, databases, real cross-user delivery, OWASP mapping, dependency scanning, and the optional challenge are not graded. No extension is required for full credit.
Accept equivalent safe implementations that satisfy the plain-text requirement. A passed suite alone does not replace the simple explanation. If an environment problem blocks execution, give credit for demonstrated work and reasoning, and mark practical verification incomplete; do not invent results or penalize honest reporting as dishonesty.