Executive Security Dashboard
{{ scope_label | default('All Folders') }} — Security Posture Overview
{# State-aware Summary-mode banner — prose preserved verbatim from
pre-migration lines 79-82. #}
{% if mode == "summary" %}
Summary mode: dashboard built from platform summary endpoints (not per-finding scan). For per-finding detection histograms and Critical/High severity-over-time lines, rerun with --detailed.
{% endif %}
{# Partial-report warning — prose preserved verbatim from
pre-migration lines 84-89. The `⚠` is the warning sign
Unicode entity ⚠. #}
{% if failed_projects and failed_projects | length > 0 %}
⚠ Partial data:
{{ failed_projects | length }} project(s) could not be fetched
({{ failed_projects | join(", ") }}). Totals below exclude them.
{% endif %}
{# Component-detail degradation — poisoned platform rows (ALLOY-3274
family) make /components unfetchable for a version even though
the project itself is healthy. SCA KPIs fall back to version
rollups; license/policy charts exclude these projects. #}
{% if degraded_components_projects and degraded_components_projects | length > 0 %}
⚠ Component detail unavailable:
{{ degraded_components_projects | length }} project(s)
({{ degraded_components_projects | join(", ") }}) — a platform-side
data issue blocked their full component lists. Their SCA KPIs use
version rollups; License and Policy Health charts include only
what could be salvaged (possibly nothing).
{% endif %}
{# Portfolio Summary — 3 KPI cells via fs.kpi_cell.
Delta passes through as plain text (no `delta_class` — see plan
§ Design tokens: the macro's up=green/down=red semantics are
inverted from exec dashboard's up=BAD/down=GOOD, so we drop
the delta-class color encoding for Phase 1b/1c consistency). #}
{% if sca_summary and sca_summary | length > 0 %}
Portfolio Summary
{{ fs.kpi_cell("Projects", sca_summary.get('projects', 0)) }}
{{ fs.kpi_cell("Components", sca_summary.get('components', 0)) }}
{% set _findings_delta = sca_summary.get('findings_delta') %}
{{ fs.kpi_cell(
"Total Findings",
sca_summary.get('findings', 0),
delta=((_findings_delta | string) ~ "%") if _findings_delta is not none else None,
) }}
{% endif %}
{# License Summary — 4 KPI cells via fs.kpi_cell.
Inline conditional value-colors from pre-migration (lines 142-154)
dropped per the migration trade-off (consistent with Phase 1b/1c
precedent — fs.kpi_cell-macro contract preserved). #}
{% if license_kpis and license_kpis.get('total', 0) > 0 %}
License Summary
{{ fs.kpi_cell("Copyleft %", (license_kpis.get('copyleft_pct', 0) | string) ~ "%") }}
{{ fs.kpi_cell("Strong Copyleft", license_kpis.get('copyleft_strong', 0)) }}
{{ fs.kpi_cell("Permissive", license_kpis.get('permissive', 0)) }}
{{ fs.kpi_cell("No License", license_kpis.get('no_license', 0)) }}
{% endif %}
{# Policy Health (horizontal stacked bar). Nested ph_has_data gate
preserved from pre-migration lines 160-162: outer truthy check on
datasets AND inner sum-of-values check across both datasets.
Skipping the nested check would render an empty chart shell when
both datasets are present but all values are zero. #}
{% if policy_health and policy_health.datasets | default([]) | length >= 2 %}
{% set ph_has_data = (policy_health.datasets[0].data | default([]) | sum > 0)
or (policy_health.datasets[1].data | default([]) | sum > 0) %}
{% if ph_has_data %}
Policy Health
Security and license policy violations and warnings across the portfolio.
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% endif %}
{% endif %}
{# Findings by Folder (stacked bar, tall). #}
{% if findings_by_folder and findings_by_folder.labels | default([]) | length > 0 %}
Findings by Folder
Distribution of security findings across folders by severity.
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% endif %}
{# Findings by Project (stacked bar, tall). #}
{% if findings_by_project and findings_by_project.labels | default([]) | length > 0 %}
Findings by Project
Distribution of security findings across projects by severity.
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% endif %}
{# Layout branch 1 — ALWAYS-ON two-col: Severity Trends + Risk Donut +
Top-10 Products table. Pre-migration lines 196-241; mirrors the
UNCONDITIONAL wrapper at line 196 (no outer Jinja gate). #}
Severity Trends ({% if severity_trends.get('start_date') and severity_trends.get('end_date') %}{{ severity_trends.start_date }} to {{ severity_trends.end_date }}{% else %}{{ severity_trends.get('month_count', 12) }} Months{% endif %})
{% if mode == "summary" %}
Total findings per month: for each month, we pick each project's version in effect at month-end and sum their findingCount.
{% else %}
Critical and High severity findings over the report period.
{% endif %}
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
Highest-Risk Products
{% if mode == "summary" %}
Projects bucketed by their highest-severity finding.
{% else %}
Projects bucketed by risk score (critical*10 + high*5 + medium*2 + low*0.5).
{% endif %}
{% if risk_donut and risk_donut.get('total_artifacts') %} {{ risk_donut.total_artifacts }} total projects.{% endif %}
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% if top_risk_products and top_risk_products | length > 0 %}
| # | Product | Risk Score | KEV |
Critical | High | Medium | Low |
{% for p in top_risk_products[:10] %}
| {{ loop.index }} |
{{ p.project }} |
{{ p.risk_score }} |
{% if (p.kev|default(0)) > 0 %}{{ p.kev }}{% else %}0{% endif %} |
{% if (p.critical|default(0)) > 0 %}{{ p.critical }}{% else %}0{% endif %} |
{% if (p.high|default(0)) > 0 %}{{ p.high }}{% else %}0{% endif %} |
{% if (p.medium|default(0)) > 0 %}{{ p.medium }}{% else %}0{% endif %} |
{% if (p.low|default(0)) > 0 %}{{ p.low }}{% else %}0{% endif %} |
{% endfor %}
{% endif %}
{# Layout branch 2 — has_license_data two-col vs. single-col. The
openIssuesPieChart container renders EXACTLY ONCE per render
(pre-migration duplicated it across both branches; the migration
consolidates to one container ID per render — duplicate-DOM-ID
consolidation). #}
{# open_issues_pie data presence — used to suppress blank chart shell
when data is empty or all-zero (round-1 M2-1). #}
{% set _oip_total = (open_issues_pie.data | default([]) | sum) %}
{% if has_license_data %}
{% if mode == "summary" %}Findings by Triage Status{% else %}Open Issues by Severity{% endif %}
{% if mode == "summary" %}
Distribution of findings by VEX triage status across the portfolio.
{% else %}
Distribution of unresolved findings by severity (excluding resolved/triaged).
{% endif %}
{% if _oip_total > 0 %}
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% else %}
{% if mode == "summary" %}No findings to triage{% else %}No open issues{% endif %}
{% endif %}
License Distribution
Software licenses by component count.
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% else %}
{% if mode == "summary" %}Findings by Triage Status{% else %}Open Issues by Severity{% endif %}
{% if mode == "summary" %}
Distribution of findings by VEX triage status across the portfolio.
{% else %}
Distribution of unresolved findings by severity (excluding resolved/triaged).
{% endif %}
{% if _oip_total > 0 %}
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% else %}
{% if mode == "summary" %}No findings to triage{% else %}No open issues{% endif %}
{% endif %}
{% endif %}
{# Layout branch 3 — has_exploit_data two-col vs. findings-by-type-
only. The findingsByTypeChart container renders EXACTLY ONCE per
render (duplicate-DOM-ID consolidation). #}
{% if has_exploit_data %}
Exploit Intelligence
Findings with exploit indicators (KEV, known exploits, ransomware, etc.).
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
Findings by Type
Finding counts categorized by type (CVEs, Crypto, Credentials, etc.).
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% elif findings_by_type and findings_by_type.labels | default([]) | length > 0 %}
Findings by Type
Finding counts categorized by type (CVEs, Crypto, Credentials, etc.).
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% endif %}
{# Finding Age Distribution (full-width). Mode-aware description. #}
{% if finding_age and finding_age.labels | default([]) | length > 0 %}
Finding Age Distribution
{% if mode == "summary" %}
Findings bucketed by the age of the version they live in.
{% else %}
Open findings bucketed by days since detection.
{% endif %}
{% if render_mode == 'fragment' and not fragment_scripts_enabled %}
Chart unavailable in fragment view
{% else %}
{% endif %}
{% endif %}
{# Project Findings Summary table (full-width). Plain-text project
names — exec dashboard has no entity-link contract. #}
{% if project_table and project_table | length > 0 %}
Project Findings Summary
| Project |
KEV |
Critical |
High |
Medium |
Low |
Total |
{% for row in project_table %}
| {{ row.project }} |
{% if (row.kev|default(0)) > 0 %}{{ row.kev }}{% else %}0{% endif %} |
{% if (row.critical|default(0)) > 0 %}{{ row.critical }}{% else %}0{% endif %} |
{% if (row.high|default(0)) > 0 %}{{ row.high }}{% else %}0{% endif %} |
{% if (row.medium|default(0)) > 0 %}{{ row.medium }}{% else %}0{% endif %} |
{% if (row.low|default(0)) > 0 %}{{ row.low }}{% else %}0{% endif %} |
{{ row.total | default(0) }} |
{% endfor %}
{% endif %}
{% if render_mode != 'fragment' %}
{{ fs.status_bar(items=[
"Recipe: Executive Dashboard",
"Mode: " ~ (mode | string | capitalize),
"Projects: " ~ ((sca_summary.get('projects', 0)) | string),
generated_at or "—",
], version='fs-report ' ~ (fs_report_version | default('dev'))) }}
{% endif %}
{% if render_mode != 'fragment' or fragment_scripts_enabled %}
{% include '_action_buttons.html' %}
{% endif %}