[claudiacodacy]

Adds the Remediation report to the Security and risk management docs: what each figure means, the rules behind it, how the 90-day trend is calculated, the open backlog, and the filters. Requested in OD-936; the rules come from the project spec, P-OD-442.

Draft until the report ships. The page describes the finished report. Merge it once OD-958 and the rest of P-OD-442 are live.

What changed

The product's Security and risk management tabs are Reports, Findings, Dependencies, App scanning and Container scanning. Every tab had its own page except Reports, so both reports now get one.

• docs/security/reports.md (new, in nav: after index.md): the Overview report, moved from index.md, and the new Remediation report. Remediation subsections have fixed anchors (#remediation-report, -rules, -closed, -weekly, -trend, -backlog, -filters).
• docs/security/index.md: keeps the general SRM content (supported categories, scan types, languages). A short Reports section keeps {: id="dashboard"}, because the product's page header links to security/#dashboard, and links to both reports. The topic card now points at the Reports page.
• findings.md, dependencies.md, app-scanning.md: links that pointed at index.md#dashboard or at the moved panels now point at index.md or reports.md. findings.md also says, under Customize deadlines, that changing an SLA changes the report's past results.

No redirect is needed, because index.md keeps its URL. Panel anchors such as #open-findings-history and #activity-history now live on security/reports/, so outside links to them on security/ land on the page without scrolling to the panel.

Sources

• The trend rule comes from codacy-spa @86a7ac5 (MttrBySla/utils.ts, MttrTrend.tsx, merged in #3182): the current week is left out, the line is fitted through weekly means weighted by closes, the trend is steady under 10% of the SLA or 1 day, and there's no trend with fewer than 5 closes or fewer than 3 in either half of the window.
• Labels and counting rules come from the shipped components and from the P-OD-442 spec where the UI isn't in master yet: the Mean by week chart, the Scan types filter, and filters carrying into Open in Findings.

Before merging

• Add a screenshot of the report (one TODO: verify marker in index.md)
• Check the chart, Scan types filter and Open in Findings text against the shipped UI
• Point the SPA's Reports docs link at security/reports/ (it links to security/#dashboard today, which still works)

👀 Live preview

Preview deployment for this branch: security/reports/

🚧 To do

• If relevant, include the Jira issue key at the end of the pull request title
• Perform a self-review of the changes
• Fix any issues reported by the CI/CD

🤖 Generated with Claude Code

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

AI Reviewer: first review requested successfully. AI can make mistakes. Always validate suggestions.

_{TIP This summary will be updated as you push new changes.}

[github-actions]

Overall readability score: 54.61 (🟢 +0.06)

File	Readability
reports.md	75.72 (-)
index.md	39.99 (🔴 -4.32)
findings.md	52.39 (🔴 -0.08)
dependencies.md	49.69 (🔴 -0.02)
app-scanning.md	75.67 (🟢 +0.08)

View detailed metrics

🟢 - Shows an increase in readability
🔴 - Shows a decrease in readability

File	Readability	FRE	GF	ARI	CLI	DCRS
reports.md	75.72	62.27	8.63	9.9	9.39	5.86
	-	-	-	-	-	-
index.md	39.99	21.29	11.92	14.6	15.77	8.19
	🔴 -4.32	🔴 -5.82	🔴 -0.26	🟢 +0.2	🔴 -0.86	🔴 -0.62
findings.md	52.39	32.73	11.69	14.1	12.24	6.82
	🔴 -0.08	🟢 +0	🟢 +0	🟢 +0	🔴 -0.06	🟢 +0
dependencies.md	49.69	29.14	10.69	13.6	14.32	7.32
	🔴 -0.02	🔴 -0.11	🔴 -0.02	🟢 +0	🟢 +0	🟢 +0.01
app-scanning.md	75.67	57.27	7.72	9.2	10.03	6.14
	🟢 +0.08	🟢 +0	🟢 +0.03	🟢 +0	🟢 +0	🟢 +0.01

Averages:

	Readability	FRE	GF	ARI	CLI	DCRS
Average	54.61	43.33	10.84	12.27	12.23	7.96
	🟢 +0.06	🟢 +0.05	🟢 +0.01	🟢 +0.01	🟢 +0.01	🟢 +0.01

View metric targets

Metric	Range	Ideal score
Flesch Reading Ease	100 (very easy read) to 0 (extremely difficult read)	60
Gunning Fog	6 (very easy read) to 17 (extremely difficult read)	8 or less
Auto. Read. Index	6 (very easy read) to 14 (extremely difficult read)	8 or less
Coleman Liau Index	6 (very easy read) to 17 (extremely difficult read)	8 or less
Dale-Chall Readability	4.9 (very easy read) to 9.9 (extremely difficult read)	6.9 or less

[codacy-production]

Pull Request Overview

⚠️ Resolve issues before merging

Two issues should be addressed before merging: add the final Remediation report screenshot and preserve or redirect legacy Overview anchors moved from index.md. The SPA Reports documentation link also remains unupdated, leaving an acceptance criterion incomplete. No complex-file or coverage risks were identified.

About this PR

• Update the SPA Reports documentation link to point to security/reports/ before merging.

Test suggestions

• Verify the new Reports page is registered in mkdocs navigation and links from the Security and risk management index resolve.
• Verify migrated Overview anchors and updated links resolve to the Reports page and its sections.
• Verify the Remediation report documentation covers metrics, SLA rules, 90-day trend calculation, backlog categories, and filters.
• Verify the documentation includes a final Remediation report screenshot and terminology matches the shipped UI.
• Verify the SPA Reports link points to security/reports/.

Prompt proposal for missing tests

Consider implementing these tests if applicable:
1. Verify the new Reports page is registered in mkdocs navigation and links from the Security and risk management index resolve.
2. Verify migrated Overview anchors and updated links resolve to the Reports page and its sections.
3. Verify the Remediation report documentation covers metrics, SLA rules, 90-day trend calculation, backlog categories, and filters.
4. Verify the documentation includes a final Remediation report screenshot and terminology matches the shipped UI.
5. Verify the SPA Reports link points to security/reports/.

_{TIP Improve review quality by adding custom instructions
TIP How was this review? Give us feedback}

[codacy-production]

_{🟡 MEDIUM RISK}

Preserve the removed Overview section anchors on index.md or provide equivalent redirects so existing deep links remain valid.

[codacy-production]

_{🟡 MEDIUM RISK}

Add the final Remediation report screenshot before merging, or retain this TODO only while the PR remains draft as stated in the description.