# Report Format Specification The final report is a **self-contained HTML file** (`security-report.html`). It opens in any browser, uses no external dependencies, and includes interactive features (collapsible sections, filters, color-coded severity). --- ## Output Format Single HTML file with embedded CSS and JS. No external CDN, no build step. The report must work offline when opened with `file://`. --- ## Severity Color System | Severity | Color | Badge HTML | |----------|-------|-----------| | Critical | `#dc2626` (red-600) | `CRITICAL` | | High | `#ea580c` (orange-600) | `HIGH` | | Medium | `#ca8a04` (yellow-600) | `MEDIUM` | | Low | `#16a34a` (green-600) | `LOW` | | Info | `#6b7280` (gray-500) | `INFO` | --- ## HTML Template Generate the report using this structure. Replace `{{placeholders}}` with actual data. ```html Security Audit — {{repo-name}}

🛡️ Security Audit Report

Repository
{{repo-name}}
Date
{{date}}
Target
{{target-urls}}
Methodology
SAST + DAST (localhost) + DAST (production) + Pentest

Resumo

{{critical-count}}
Critical
{{high-count}}
High
{{medium-count}}
Medium
{{low-count}}
Low
{{info-count}}
Info

{{executive-summary-paragraph}}

Achados

{{SEVERITY}} {{finding-title}}
📁 {{file}}:{{line}}

{{description}}

Evidência 
{{evidence-code}}
Remediação

{{remediation-text}}

{{remediation-code}}

Análise de CVEs × Contexto do Projeto

#AdvisorySev. GenéricaPrecondiçãoPresente?Sev. RealRazão
{{n}} {{advisory-id}} {{generic-sev}} {{precondition}} {{yes-no}} {{real-sev}} {{rationale}}

Pentest — Testes Ativos

P{{n}}: {{test-name}} {{PASS|FAIL}}
Detalhes

Objetivo: {{objective}}

{{command-or-payload}}

Resposta: {{response-summary}}

Verificado Seguro ✅

TesteResultadoEvidência
{{test-name}} PASS {{evidence}}

Remediação Prioritária

#AçãoEsforçoImpacto
{{n}}{{action}}{{effort}}{{impact}}
``` --- ## Generation Rules 1. **Output a single `.html` file** — not markdown. Name it `security-report.html` in the repo root. 2. **Replace all `{{placeholders}}`** with actual data from the scan. 3. **Repeat blocks** as indicated by comments (``, etc.). 4. **Sort findings** by severity descending (critical first), then alphabetically. 5. **Collapsible evidence/remediation** — keeps the report scannable without hiding info. 6. **Filter buttons** — JS filters findings by severity interactively. 7. **Code in evidence** — use `
` blocks, HTML-escape all special characters.
8. **Links in CVE table** — advisory IDs link to the GitHub advisory URL.
9. **No external dependencies** — no CDN fonts, no JS libs. Pure HTML/CSS/JS.
10. **Dark theme by default** — matches terminal-native developer workflows.

---

## Content Rules (unchanged from markdown era)

- Every finding needs source location, data flow trace, and concrete exploitability.
- Never truncate evidence to the point where it loses meaning.
- Keep descriptions factual. No speculative language.
- The report must be self-contained.
- Include ALL tests performed (pentest section), including those that passed.
- CVE analysis table is mandatory when dependency vulns exist.
- Negative results table is mandatory — reader needs to know what was tested and found secure.