{% extends "base.html" %} {% from "_macros.html" import findings_badges, info_tip %} {% block title %}secfoo — Dashboard{% endblock %} {% block content %} {% from "_icons.html" import icon %} {% set urgent = severity.critical + severity.high %} {% set sev_total = severity.critical + severity.high + severity.medium + severity.low %}
{{ icon("shield", "posture__eyebrow-icon") }}Security posture

{% if urgent %}{{ urgent }} critical and high finding{{ 's' if urgent != 1 }} need attention {% else %}No critical or high findings open{% endif %}

{{ projects | length }} application{{ 's' if projects | length != 1 }} · {{ run_count }} run{{ 's' if run_count != 1 }} {% if recent_runs %}· last run {{ recent_runs[0].started_at | fmt_ago }}{% endif %}

{{ icon("plus", "btn__icon") }}New assessment Review top findings
{% for key, count in [("critical", severity.critical), ("high", severity.high), ("medium", severity.medium), ("low", severity.low)] %} {% if count %}{% endif %} {% endfor %} {% if not sev_total %}{% endif %}
Critical
{{ severity.critical }}
High
{{ severity.high }}
Medium
{{ severity.medium }}
Low
{{ severity.low }}
{% if not (setup | selectattr("done") | list | length == setup | length) %} {% set completed = setup | selectattr("done") | list | length %}
Getting started

Four steps to your first signed-off review

    {% for step in setup %}
  1. {% if step.done %}✓{% else %}{{ loop.index }}{% endif %} {{ step.label }}{{ step.detail }}
    2. {% endfor %}
{% endif %}
{% call info_tip("Applications reviewed") %}

Every application recorded in this local store.

A project appears here once it has been added, including ones that have not finished a review.

{% endcall %} {{ icon("projects") }} {{ projects | length }} Applications reviewed
{% call info_tip("Total findings") %}

Finding counts written on runs, added up across every activity.

Repeat scans count again. This is not the same as Top findings, which lists open Critical and High items only.

{% endcall %} {{ icon("findings") }} {{ severity.total }} Total findings
{% call info_tip("Third-party assessments") %}

Assessments whose type is Third-Party.

Open the third-party view for vendor CCM conformance, scored from the vendor's own documents.

{% endcall %} {{ icon("third-party") }} {{ third_party_count }} Third-party assessments
{% call info_tip("Responsible AI coverage") %}

Assessments that have a Responsible AI risk rating.

The rating comes from an attached Responsible AI Compliance run. An assessment without that run is not counted.

{% endcall %} {{ icon("responsible-ai") }} {{ responsible_ai_count }} Responsible AI coverage
{% call info_tip("AI spend") %}

Cost that metered agents have reported back to secfoo.

Subscription agents run on your own plan and do not report a price, so they are not in this total.

{% endcall %} {{ icon("spend") }} {{ total_cost | fmt_cost }} AI spend

Top findings across the program

The highest-severity items across every activity — SAST, SCA, third-party vendor assessments, secret scanning, past-due architecture exceptions, and unmitigated threat-model gaps — not just this activity's own coverage. Open, de-duplicated Critical and High items only; SAST findings are banded by CVSS score, so a finding written as High in a report can appear here as Critical.

{% if top_findings %}
{% for f in top_findings %} {% endfor %}
SeveritySourceFindingProjectDetail
{{ f.severity | capitalize }} {{ f.source }} {{ f.title }} {{ f.project }} {{ f.detail }}
{% else %}
No Critical/High findings across any activity right now.
{% endif %}
{% call info_tip("Findings by severity") %}

Counts the severity written in each run's report, summed across all runs.

Repeat scans count again. It can differ from Top findings, which lists open, de-duplicated items scored by CVSS.

{% endcall %}

Findings by severity

Counts the severity written in each run's report, summed across all runs (repeat scans count again). It can differ from "Top findings", which lists open, de-duplicated items scored by CVSS.

{% for row in severity_rows %}
{{ row.label }}
{{ row.count }}
{% endfor %}
{% call info_tip("Activity coverage") %}

How many applications have at least one successful run of each activity.

The total is every application in this store, including ones that have never been scanned with that activity.

{% endcall %}

Activity coverage

Projects with at least one successful run of each activity.

{% for skill in skill_coverage %}
{{ skill.label }} {{ skill.covered }}/{{ skill.total }}
{% endfor %}
{% call info_tip("Responsible AI risk mix") %}

How many assessments carry a Responsible AI risk rating, plus the models and tools recorded in the AI bill of materials.

Open the Responsible AI view to see which assessments are high-risk or still provisional.

{% endcall %}

Responsible AI risk mix

{{ responsible_ai_count }} assessment(s) with a risk rating · AI-BOM: {{ models_count }} model(s), {{ tools_count }} tool(s) tracked.

Open Responsible AI view
{% call info_tip("AI spend by agent") %}

Cost and token use reported per agent.

Metered agents send a price. Subscription agents run on your own plan and show no cost here.

{% endcall %}

AI spend by agent

{% if cost_by_agent %}
{% for row in cost_by_agent %} {% set metered = row.label in cost_reporting_agents %} {% set priced = row.unpriced_runs < row.runs %} {% set priced = row.unpriced_runs < row.runs %} {# A priced run can still have no token counts (e.g. cost-only agents), so don't add None. #} {% set tokens_known = row.input_tokens is not none or row.output_tokens is not none %} {% endfor %}
AgentRunsTokensCost
{{ row.label }}
{% if metered %}Metered{% else %}Subscription{% endif %}		 {{ row.runs }}{{ (((row.input_tokens or 0) + (row.output_tokens or 0)) | fmt_tokens) if tokens_known else '-' }} {{ (row.cost_usd | fmt_cost) if priced else '-' }}

Subscription agents run on your own plan and don't report their cost to secfoo.

{% else %}

No runs yet.

{% endif %}

Recent runs

{% if recent_runs %} {% else %}

No runs yet. Start one from New assessment.

{% endif %}

Agents

All agents →

Recent assessments

{% if assessments %}
{% for a in assessments %} {% endfor %}
ProjectTypeStatusFindingsReviewed
{{ a.project_display_name }} {{ a.assessment_type | assessment_type_label }} {{ a.status | assessment_status_label }}
{{ findings_badges(a) }}
 {{ a.review_date or (a.updated_at | fmt_time) }}
{% else %}
No assessments yet. Run secfoo assessment create --type internal, or use the "New Assessment" button on the Assessments page.
{% endif %} {% endblock %}