Fitting in
Trends and the PDF report
Whether the numbers are moving, where the work sits, and a document to send upstairs.
Filtered to whatever you are looking at
Connection, organization, repository, branch and period, and the boxes narrow each other: choosing a connection stops offering every branch in the estate, and choosing an organization stops offering somebody else's repositories. The connection list is never narrowed, because narrowing what is to the right of a box is a filter and narrowing what is to its left is a trap.
A risk matrix rather than a coloured table
Impact down the side, likelihood across the top, and the cell coloured by what the pair means. This product asks those two questions separately and answers them from different evidence, so a critical in a package nothing imports and a medium somebody proved live land in different cells. The colour comes from the same matrix the grade comes out of, so the picture cannot disagree with the number. How many findings are on the grid is printed under it, because a grid holding an eighth of an estate and not saying so is read as the whole estate.
Every figure opens the rows behind it
The heatmap and the matrix are made of links. A number somebody can see and cannot reach is a number they have to take on trust, and the list that opens holds exactly what the cell counted, which took two goes to get right and has a test that follows the links and compares.
Three levels, one page
The estate opens into its organizations, an organization into its repositories, a repository into its branches. It is the same page each time, narrowed: the chart, the risk matrix and the grid all answer to the same filter, so going down a level narrows the picture rather than opening a different one. Every row carries the two ways on, said out loud rather than left to be guessed at from where the underlines are. Drill down is still the question "how much". Findings is the other question, "which ones", and it leaves the page. Below a branch there is nothing, so that row offers only the findings.
Sorted and paged on the server
Worst first by grade is the right default and the wrong answer to "who has the most lows", so every column heading sorts on itself and clicking it again turns it around. Both the sort and the paging run over the whole set rather than over the rows on screen, because a browser can only sort the page it was given, which looks identical and answers a different question. Twenty five rows to a page, with the count of what is behind it underneath, since an account holding thirty repositories and an account holding three hundred should not look the same.
History from before it was recorded
A finding carries when it was first seen and when it was closed, so whether it was open on a given day is a fact already in the database. That fills in the days before daily history was kept. The counts from it are exact; the severity split uses today's grades applied backwards, so the chart marks where the worked out history ends rather than drawing one line across two things that do not mean the same.
A report built from the same filter
Whatever is on the screen writes a PDF, through the same permission scoped query, so it can never hold a repository the reader could not open and can never disagree with the page it came from. It opens with what has been proved rather than what has been rated, then what to do in order with the packages and repositories named, then the matrix, the heatmap, and a section per severity grouped by the weakness each finding is an example of. Your organization name, logo and a footer line for a classification marking come from settings.
Written for somebody who is not an engineer
US English, no jargon where a plain word exists, and nothing invented: every sentence is built from a number already in the report. Where nothing was confirmed it says nothing was confirmed rather than implying an all clear, and a scope where everything was fixed says so rather than rendering as a blank form.
What it does not do
History starts when the scanning does, so a repository scanned for the first time yesterday has a short chart. The drill down goes three levels because that is how far the data goes: below a branch there is a file, and the findings list is where that question is answered. There is no measure of how long a finding has sat open, no attribution to a team, and nothing is mailed on a schedule.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.