sc-report

SC: Report Generator — Final Security Assessment

Purpose

Generates the final consolidated security assessment report from verified findings. Produces an executive summary, detailed findings with CVSS v3.1-style severity ratings, scan statistics, and a prioritized remediation roadmap. This is the primary deliverable of the security-check pipeline.

Activation

Runs in Phase 4 of the pipeline, after sc-verifier has completed.

Input

• security-report/verified-findings.md
• security-report/findings.json
• security-report/coverage-ledger.md
• security-report/architecture.md
• security-report/dependency-audit.md

Output

File: security-report/SECURITY-REPORT.md

Report Generation Process

1. Data Collection

Read all input files and extract:

• Verified findings list with confidence scores and severity
• Architecture summary (languages, frameworks, app type)
• Dependency audit summary
• Total files scanned and lines of code (from architecture.md)
• Skills executed and their individual result counts
• Final verdicts, explicit coverage gaps, validation limits, and run completeness

Only confirmed records may appear in severity sections or risk-score arithmetic. Put needs_validation records in a separate unscored section, rejected records in an optional decision appendix, and missing defense-in-depth in hardening notes.

2. CVSS v3.1-Style Severity Mapping

Map each finding to a CVSS-aligned severity level:

Critical (CVSS 9.0-10.0):

• Remote Code Execution with no authentication required
• SQL Injection allowing full database access
• Hardcoded admin credentials or private keys
• Deserialization RCE with network-reachable endpoint
• Authentication bypass allowing full account takeover

High (CVSS 7.0-8.9):

• SQL Injection with limited scope
• Stored XSS affecting all users
• SSRF with access to internal services
• Broken access control (IDOR) exposing sensitive data
• Weak cryptography protecting sensitive data
• Privilege escalation from user to admin