| name | transilience-report-style |
| description | Threat Intelligence Report Design System — ReportLab-based PDF generation for A4 reports with Transilience branding, typography, and layout standards. |
Transilience AI — Threat Intelligence Report Design System
Version: 5.0 — Light theme (modern, minimal, professional)
Format: PDF (A4), ReportLab
Last Updated: July 7, 2026
0. Theme (v5.0)
The report now renders a light theme by default (white page, dark ink, brand accents). Both palettes live
in the THEME dict in generate_report.py; select with --theme light|dark (or engagement.theme).
Precedence: --theme > engagement.theme > light; an unknown value falls back to light (never errors).
The pentest-engagement finalize gate passes no --theme, so all gated PDFs are light. The sections below marked
"(dark fallback)" describe the retained --theme dark palette.
0.1 Light palette (brand: purple #6941C6 → magenta #C9317C)
| Token | Hex | Use |
|---|
PAGE / SURFACE | #FFFFFF | page + card background |
TINT / ALT | #F6F4FB / #FBFAFE | KPI boxes · table headers/tracks · zebra rows |
INK | #1B1725 | headings + body text |
INK_SOFT | #5A5568 | secondary text |
LBL | #6B7280 | small labels / captions |
BORDER | #E7E3F0 | hairlines, card borders, table grid |
BRAND / BRAND2 | #6941C6 / #C9317C | section numbers, rules, subheads / gradient end |
CODE_BG / CODE_INK / CODE_BORDER | #F5F4F8 / #2A2536 / #E4E0EE | boxed code / samples (codebox) |
GREEN / BLUE / AMBER | #15803D / #2563EB / #B45309 | remediation / refs·CVE / caveat labels |
SEV | Critical #DC2626 · High #EA580C · Medium #CA8A04 · Low #16A34A · Info #64748B | severity |
0.2 What v5 adds / changes
- Light, airy layout — white surfaces, hairline separators, generous padding/leading; colour used only
semantically (severity / score / status).
- Colour-coded risk & score — severity via the finding-card left stripe +
[SEV] tag; and in every
risk table (findings summary, CVE register, per-finding CVE table) both the severity label and the
CVSS score cell are band-coloured + bold — the label by its severity, the score by score_band(score).
tbl(..., sevcol=, scorecol=) selects the columns; the colour is emitted as an inline <font> tag inside
the cell (a TableStyle TEXTCOLOR is ignored on ReportLab Paragraph cells, so it must live in the
cell markup). Empty/non-numeric score cells stay uncoloured.
- Highlighted code/samples —
codebox() renders CVSS vectors, PoC/test requests, affected assets, and
endpoints in a bordered light-grey monospace block; screenshots are framed with a border + caption.
- Finding cards are a single-column multi-row
Table (severity left-stripe + hairline box + padding)
so tall Critical findings split cleanly across pages (border redrawn per fragment).
- Logo is drawn at its true aspect ratio (1024×468 → 0.457; ~48mm wide) — never squished.
- Graphical (severity-bar chart) + Tabular (findings index) summaries, DURATION cover row, per-finding Ease of
Exploitation + References, and a Conclusion section are all light-themed.
1. Page & Document Configuration
| Property | Value |
|---|
| Page Size | A4 (595.28 × 841.89 pt) |
| Margins | 20mm all sides |
| Content Width (CW) | 555.28 pt (A4 width − 2 × 20mm) |
| Top Margin Offset | +8 pt (28mm effective top) |
| Bottom Margin Offset | +10 pt (30mm effective bottom) |
| Background Color | #FFFFFF (light default) · #07040B under --theme dark |
| Output | Embedded fonts, single PDF file |
2. Typography
2.1 Font Stack
| Alias | Font | Weight | Role |
|---|
FH | Poppins-Bold | 700 | Headlines, metric values, section numbers, score values |
FM | Poppins-Medium | 500 | Subheads, section labels, card section headers, sidebar labels |
FR | Poppins (Regular) | 400 | Footer text, metadata labels, TOC sub-items |
FL | Poppins-Light | 300 | Reserved (registered, not actively used) |
FI | Poppins-Italic | 400i | Reserved (registered, not actively used) |
FB | Carlito (Regular) | 400 | Body text, card summaries, table cells, bullet content |
FBB | Carlito-Bold | 700 | Bold inline emphasis within body paragraphs |
FBI | Carlito-Italic | 400i | Confidentiality notices, closing statement |
FBBI | Carlito-BoldItalic | 700i | Registered for <b><i> combinations within Carlito |
FMONO | Courier | — | MITRE technique IDs, CVE identifiers, subdomain names |
Family Registration: Carlito is registered as a full family (normal, bold, italic, boldItalic) enabling automatic style switching via ReportLab's <b> and <i> XML tags.
2.2 Type Scale
| Style Key | Font | Size | Leading | Color | Alignment | Usage |
|---|
ct | Poppins-Bold | 36 pt | 44 pt | #FFFFFF | Left | Cover title ("THREAT INTELLIGENCE", "REPORT") |
cc | Poppins-Medium | 18 pt | 24 pt | #8B5CF6 | Left | Cover client name |
h1 | Poppins-Bold | 20 pt | 26 pt | #FFFFFF | Left | Section titles |
h2 | Poppins-Medium | 16 pt | 21 pt | #FFFFFF | Left | Subsection titles |
h3 | Poppins-Medium | 13 pt | 17 pt | #8B5CF6 | Left | Sub-headers within sections |
tt | Poppins-Medium | 13 pt | 18 pt | #FFFFFF | Left | Card titles, posture item titles |
body | Carlito | 12 pt | 17 pt | #F0F2F5 | Justify | Body paragraphs |
bs | Carlito | 11 pt | 15 pt | #F0F2F5 | Left | Small body (table cells, metadata values) |
ts | Carlito | 11 pt | 16 pt | #F0F2F5 | Justify | Card description text |
label | Poppins | 10 pt | 13 pt | #E0E3E8 | Left | Cover metadata labels |
sl | Poppins-Medium | 10 pt | 13 pt | #8B5CF6 |
2.3 Advisory Card Typography
| Element | Font | Size | Color | Notes |
|---|
| Serial + Severity Tag | Poppins-Bold | 14 pt | Severity color | Format: #1 [CRITICAL] |
| Card Title | Poppins-Bold | 14 pt | #FFFFFF | Same line as serial, leading 20pt |
| Metadata Row | Carlito | 10 pt | #F0F2F5 | Labels in #8B5CF6, pipe-separated |
| Score Labels | Poppins-Medium | 10 pt | #F0F2F5 | "SEVERITY", "RELEVANCE", "PRIORITY" |
| Score Values | Poppins-Bold | 12 pt | Dynamic color | 0.85 format |
| Score Band Label | Poppins-Bold | 10 pt | Dynamic color | "HIGH", "MEDIUM", "LOW" (priority row only) |
| Section Headers | Poppins-Medium | 10 pt | #8B5CF6 | "TECHNICAL DETAILS", "IMPACT CONTEXT", etc. |
| Detection Evidence Header | Poppins-Medium | 10 pt | #10B981 | Green to distinguish from purple headers |
| Section Body | Carlito | 11 pt | #F0F2F5 | leading 15pt |
| MITRE Label | Carlito | 11 pt | #F59E0B | Amber for "MITRE Tactics:", "Techniques:" |
| CVE Label | Carlito | 11 pt | #3B82F6 | Blue for "CVEs:" |
| CVE/Technique Values | Courier | 10–11 pt | #F0F2F5 | Monospace for IDs |
| Relevance Bullets | Carlito | 11 pt | #F0F2F5 | • symbol, 16pt leftIndent, leading 16pt |
| Source Link | Carlito | 10 pt | #3B82F6 | Underlined |
3. Color Palette
3.1 Backgrounds — dark fallback (--theme dark; light palette in §0.1)
| Token | Hex | RGB | Usage |
|---|
BG | #07040B | (7, 4, 11) | Page background — deepest layer |
BG2 | #0D0A14 | (13, 10, 20) | Reserved secondary background |
BGC | #13101C | (19, 16, 28) | Card backgrounds, table header rows, metric boxes |
BGCA | #1A1625 | (26, 22, 37) | Alternating table rows, progress bar track |
BGEL | #18181B | (24, 24, 27) | Reserved elevated surface |
GL | #1E1A2E | (30, 26, 46) | Table gridlines, footer bar background |
BS | #2A2535 | (42, 37, 53) | Card/box border stroke (0.4pt width) |
3.2 Brand Colors
| Token | Hex | RGB | Usage |
|---|
BP | #6941C6 | (105, 65, 198) | Primary brand — TOC numbers, metric accents, section number ghost |
BPL | #8B5CF6 | (139, 92, 246) | Primary light — h3 headers, card section headers, metadata labels, page numbers |
BM | #C9317C | (201, 49, 124) | Magenta accent — third-party tech stack category |
3.3 Text Colors
| Token | Hex | Usage |
|---|
T1 | #FFFFFF | Brightest — headlines, card titles, tech names in evidence |
T2 | #F0F2F5 | Primary body — paragraphs, table cells, card content |
T3 | #E0E3E8 | Muted — labels, impact context field names, no-match text |
TM | #CDD1D8 | Most muted — fallback severity color |
3.4 Severity Colors
| Token | Hex | Severity | Usage |
|---|
SC | #EF4444 | Critical | Accent bars, score coloring, badges, immediate recommendations |
SH | #FB923C | High | Accent bars, score coloring, badges, short-term recommendations |
SM | #EAB308 | Medium | Accent bars, score coloring, badges, medium-term recommendations |
SL | #22C55E | Low | Accent bars, score coloring, badges, security posture "STRONG" |
3.5 Accent Colors
| Token | Hex | Usage |
|---|
AB | #3B82F6 | Info blue — CVE labels, source links, "ASSETS" metric box |
AE | #10B981 | Emerald green — "Implemented" status, detection evidence header |
AA | #F59E0B | Amber — MITRE labels, analytics tech category |
3.6 Gradient Specification
The brand gradient is a linear interpolation between two endpoints used across multiple components:
| Property | Start (left) | End (right) |
|---|
| Red | 0.412 (105/255) | 0.788 (201/255) |
| Green | 0.255 (65/255) | 0.192 (49/255) |
| Blue | 0.776 (198/255) | 0.486 (124/255) |
| Hex equivalent | #6941C6 (BP) | #C9317C (BM) |
Rendered as: 80 discrete steps, left-to-right. Used in: page top rule (3.5pt), section dividers (2pt), cover separators (3pt), progress bars, card bottom dividers.
4. Component Library
4.1 GradientLine
A full-width or partial-width horizontal rule using the brand gradient.
| Property | Value |
|---|
| Default height | 2 pt |
| Steps | 80 |
| Corner radius | None (rectangular) |
| Usage | Section dividers (full CW, 2pt), cover (full CW, 3pt), cover sub-separator (CW×0.35, 2pt), card bottom (CW×0.5, 1pt) |
4.2 GradientBar
A proportional progress bar with gradient fill and rounded track.
| Property | Value |
|---|
| Track height | 12 pt |
| Track background | BGCA (#1A1625) |
| Track corner radius | 3 pt |
| Fill | Brand gradient, clipped to fraction width |
| Min fraction | 0.06 (floor) |
| Max width | 160 pt (default) |
4.3 CardBox
A bordered container with optional accent sidebar. Used for posture items, recommendations, methodology phases.
| Property | Value |
|---|
| Background | BGC (#13101C) |
| Corner radius | 6 pt |
| Border | BS (#2A2535), 0.4 pt stroke |
| Accent bar | 4 pt wide, full height, left side, 2pt corner radius |
| Default padding | 11 pt |
| Content offset | padding + 6pt (when accent present) |
4.4 MetricBox
A compact KPI display used in the executive summary row.
| Property | Value |
|---|
| Height | 58 pt |
| Width | (CW − 30) / 5 per box |
| Background | BGC (#13101C) |
| Border | BS 0.4pt stroke, 6pt corner radius |
| Top accent | 3pt colored bar across full width, 1pt corner radius |
| Value | Poppins-Bold 22pt, centered, severity-colored |
| Label | Poppins 9pt, centered, T2, 7pt from bottom |
4.5 SeverityBadge
A colored pill showing severity level.
| Property | Value |
|---|
| Width | 60 pt |
| Height | 16 pt |
| Corner radius | 3 pt |
| Background | Severity color fill |
| Text | Poppins-Medium 9pt, centered |
| Text color | White (critical/high/low), Black (medium) |
4.6 SectionNumber
A large decorative section number with ghost double-strike effect.
| Property | Value |
|---|
| Width | Full CW |
| Height | 38 pt |
| Front layer | Poppins-Bold 42pt, rgba(105, 65, 198, 0.7) at (0, 0) |
| Ghost layer | Poppins-Bold 42pt, rgba(140, 92, 230, 0.5) at (1, 1) — offset 1pt right and up |
4.7 ScoreRow
Three horizontal inline score bars stacked vertically.
| Property | Value |
|---|
| Total height | 60 pt |
| Row height | 16 pt |
| Row padding | 4 pt |
| Bar max width | CW × 0.48 |
| Bar height | 8 pt |
| Bar track | BGCA, 3pt radius |
| Bar fill | Severity color at 0.85 alpha, min 4pt width |
| Glow dot | Circle at fill endpoint, severity color at 0.3 alpha, 5pt radius |
| Layout x-positions | Label: 0, Value: CW×0.12 + 10, Bar: CW×0.22, Band: CW×0.72 + 10 |
Dynamic color rules:
| Score Type | Thresholds |
|---|
| Severity | ≥0.75 → SC (red), ≥0.5 → SH (orange), else → SM (yellow) |
| Relevance | ≥0.6 → AE (green), ≥0.3 → AA (amber), else → T3 (muted) |
| Priority | ≥0.7 → SC (red), ≥0.5 → SH (orange), ≥0.3 → SM (yellow), else → T3 |
4.8 AccentBar (Card Top)
A thin colored bar at the top of each advisory card.
| Property | Value |
|---|
| Width | Full CW |
| Height | 4 pt |
| Corner radius | 2 pt |
| Color | Severity color of the advisory |
4.9 TechStackBlock
A category block displaying technology items as a bulleted list.
| Property | Value |
|---|
| Width | CW × 0.48 |
| Background | BGC, 5pt radius |
| Border | BS 0.3pt stroke |
| Header bar | 22pt height, category color fill, 5pt radius |
| Header text | Poppins-Medium 10pt, white, 10pt left offset |
| Item bullet | 2pt radius circle, category color, at (14, y+3) |
| Item text | Carlito 10pt, T2, at (22, y) |
| Item spacing | 16pt vertical |
5. Page Template
Applied to every page via the page-template onPage hook. Light default: white page fill, a 2.5pt brand
gradient hairline at the very top, and a hairline-ruled footer (muted text + purple page number) — no dark
footer bar. The dark-fallback specifics below apply under --theme dark.
5.1 Background Fill
- Full page
PAGE rectangle — #FFFFFF light · #07040B under --theme dark
5.2 Top Gradient Rule
- Brand gradient (80 steps, BP → BM), 3.5pt height, full page width, positioned at page top
5.3 Footer Bar
| Property | Value |
|---|
| Height | 26 pt |
| Background | GL (#1E1A2E) |
| Left text | Poppins 7pt, T3: TRANSILIENCE AI · Threat Intelligence Report · CONFIDENTIAL |
| Left offset | 20mm margin |
| Page number | Poppins-Bold 9pt, BP — right-aligned |
| Page label | Poppins 8pt, T2: Page — immediately left of number |
5.4 Left Accent Strip
- 2.5pt wide vertical bar, full page height minus footer,
rgba(105, 65, 198, 0.12), positioned at x=0
6. Radar Visualization
A custom Flowable rendering a polar threat radar.
6.1 Dimensions
| Property | Value |
|---|
| Canvas size | 300pt + 100pt width, 300pt + 60pt height |
| Center | (200, 180) |
| Max radius | 300 × 0.38 = 114 pt |
6.2 Background Glow
Concentric filled circles from max_r + 20 down to 0 (step −2), each with increasing alpha (0.03 → 0.05), color rgba(10, 5, 20, alpha).
6.3 Ring Grid
4 dashed concentric rings at 25%, 50%, 75%, 100% of max radius.
| Ring | Fraction | Label | Label Color |
|---|
| Inner | 0.25 | CRITICAL | SC (#EF4444) |
| Mid-inner | 0.50 | HIGH | SH (#FB923C) |
| Mid-outer | 0.75 | MEDIUM | SM (#EAB308) |
| Outer | 1.00 | LOW | SL (#22C55E) |
- Ring stroke:
rgba(105, 65, 198, 0.3), 0.5pt, dash pattern (3, 3)
- Labels positioned along 15° angle from center at each ring's radius, Poppins-Medium 7pt
6.4 Sector Spokes
12 spokes at 30° intervals, representing attack surfaces:
Web Apps/API, Cloud/Infra, Network, Endpoints, Email, Mobile, IoT/OT, Data Storage, Identity, Third-Party, Physical, Social Eng.
- Spoke stroke:
rgba(105, 65, 198, 0.25), 0.3pt
- Labels: Poppins-Medium 9pt, white, at
max_r + 32 from center
- Alignment: centered if near vertical, left-aligned if right half, right-aligned if left half
6.5 Center Crosshair
- 16pt arms, color
rgba(140, 92, 230, 0.4), 0.4pt
- Center glow: 16 concentric circles,
rgba(105, 65, 198, 0.04 × (16−r))
6.6 Threat Points
Each threat plotted using theta_deg and radius_norm from data.
| Severity | RGB | Point radius |
|---|
| Critical | (0.937, 0.267, 0.267) | 7 pt |
| High | (0.984, 0.573, 0.235) | 5.5 pt |
| Medium | (0.918, 0.702, 0.031) | 4.5 pt |
| Low | (0.133, 0.773, 0.369) | 3.5 pt |
Three-layer rendering per point:
- Outer glow: severity color at 0.12 alpha, radius + 7pt
- Mid glow: severity color at 0.25 alpha, radius + 3pt
- Core dot: severity color at 0.9 alpha, exact radius
- Specular highlight: white at 0.3 alpha, offset (−0.15r, +0.15r), radius 0.35r
7. Advisory Card Structure
Cards are returned as flat lists of Flowables (not wrapped in CardBox), enabling ReportLab page-split. Between cards: CondPageBreak(220) — only breaks if <220pt space remains.
7.1 Card Layout (top to bottom)
| # | Section | Spacing After |
|---|
| 1 | AccentBar (4pt, severity color) | 8pt |
| 2 | Title — #{serial} [{SEVERITY}] {title} | 2pt (spaceAfter) |
| 3 | Metadata Row — pipe-separated: Source │ Surface │ Status │ First Seen | 2pt + 10pt gap |
| 4 | ScoreRow — 3 inline progress bars (60pt) | 12pt gap |
| 5 | Summary — justified body text | 4pt + 6pt gap |
| 6 | TECHNICAL DETAILS (conditional) — Tactics, Techniques, CVEs | 4pt per item + 6pt gap |
| 7 | IMPACT CONTEXT (always shown) — Industries, Regions, Assets | 4pt per item + 6pt gap |
| 7b | DETECTION EVIDENCE (conditional) — Techstack fingerprint matches | 3pt per item + 6pt gap |
| 8 | RELEVANCE ANALYSIS (conditional) — Bullet-point reasoning | 4pt per item + 4pt gap |
| 9 | Source Link — blue underlined URL | 0pt |
| 10 | Bottom Divider — GradientLine at CW×0.5, 1pt height | 8pt before |
7.2 Metadata Row Format
Source: THREAT INTEL │ Surface: Endpoint / Email │ Status: NEW │ First Seen: 2026-02-24
Labels in BPL (#8B5CF6), values in T2, separator: unicode │ (U+2502) with 4-space padding.
Source label mapping: threat → THREAT INTEL, product → PRODUCT VULN, breach → BREACH INTEL.
7.3 Detection Evidence Format
• {TechName} — {evidence_string}
Tech name in T1 (white, bold), em-dash separator, evidence string in T2. Max 6 items per card.
7.4 Section Header Coloring
| Header | Color |
|---|
| TECHNICAL DETAILS | BPL (#8B5CF6) |
| IMPACT CONTEXT | BPL (#8B5CF6) |
| DETECTION EVIDENCE | AE (#10B981) — green to visually distinguish |
| RELEVANCE ANALYSIS | BPL (#8B5CF6) |
8. Cover Page Layout
8.1 Structure (top to bottom)
| Element | Configuration |
|---|
| Logo row | 3-column table: [Transilience logo (55×22mm), spacer, Client logo (38×27mm)], row height 28mm |
| Gap | 26mm |
| Gradient separator | Full CW, 3pt height |
| Gap | 12mm |
| Title line 1 | "THREAT INTELLIGENCE" — ct style (Poppins-Bold 36pt, white) |
| Title line 2 | "REPORT" — ct style |
| Gap | 6mm |
| Client name | cc style (Poppins-Medium 18pt, BPL) |
| Gap | 4mm |
| Sub-separator | GradientLine CW×0.35, 2pt |
| Gap | 8mm |
| Metadata table | 6 rows, 2 columns (CW×0.3 label, CW×0.7 value) |
| Gap | 15mm |
| Confidentiality notice | Carlito-Italic 10pt, T3 |
8.2 Metadata Fields
| Label | Style |
|---|
| REPORT DATE | Poppins 10pt T3 → value Carlito 11pt T2 |
| CLASSIFICATION | Same |
| SECTOR | Same |
| REGION | Same |
| GENERATED BY | Same |
| REPORT ID | Same — format: TI-{CLIENT}-{YYYYMMDD} |
9. Table of Contents Layout
| Element | Style |
|---|
| Title | "TABLE OF CONTENTS" — h1 style |
| Divider | GradientLine full CW, 2pt |
| Gap | 8mm |
| Main entry | 3-column table: section number (Poppins-Bold 13pt BP, 35pt col), title (Poppins-Medium 10.5pt T1), page (Poppins-Bold 11pt T1, right-aligned, 40pt col) |
| Entry separator | 0.3pt GL line below |
| Sub-entry | Indented 15pt, Poppins 10pt, sub-number in T3, title in T2 |
10. Report Section Blueprint
10.1 Standard Section Header Pattern
Every numbered section follows this sequence:
SectionNumber(num) — decorative ghost number (38pt height)- Section title in
h1 style (Poppins-Bold 20pt)
GradientLine(CW, 2) — full-width separatorSpacer(1, 4*mm) — breathing room
10.2 Section Inventory (12 sections)
| # | Section | Content Type |
|---|
| 01 | Executive Summary | MetricBox row + narrative + bulleted key findings |
| 02 | Threat Landscape Overview | Source distribution table + attack surface table |
| 03 | Threat Radar Visualization | RadarVisualization flowable + legend |
| 04 | Critical Severity Advisories | Advisory cards (PageBreak before section) |
| 05 | High Severity Advisories | Advisory cards (PageBreak before section) |
| 06 | Medium Severity Advisories | Advisory cards (PageBreak before section) |
| 07 | Attack Surface Analysis | Digital footprint table + subdomain inventory |
| 08 | Asset Inventory & Crown Jewels | Crown jewel CardBoxes + full inventory table |
| 09 | Technology Stack Intelligence | TechStackBlocks + security headers table |
| 10 | Security Posture Assessment | Status CardBoxes (6 items) |
| 11 | Strategic Recommendations | Tiered CardBoxes (Immediate/Short/Medium-term) |
| 12 | Methodology & Data Sources | Pipeline CardBoxes + scoring methodology + evidence table |
11. Spacing System
11.1 Vertical Rhythm
| Context | Spacing |
|---|
| After section title | 8pt (h1 spaceAfter) |
| After gradient divider | 4mm (≈11.3pt) |
| Between card sections (within) | 4pt |
| Between card section groups | 6pt |
| After metadata row → scores | 10pt |
| After scores → summary | 12pt |
| After summary → tech details | 6pt |
| Between advisory cards | CondPageBreak(220) |
| Between severity sections | PageBreak() |
| Before Evidence Collection | PageBreak() |
11.2 Table Padding
| Property | Value |
|---|
| Top padding | 4–5 pt |
| Bottom padding | 4–5 pt |
| Left padding | 6–8 pt |
| Row separator | 0.5pt GL line |
12. Data-Driven Components
12.1 Evidence Map Architecture
Technology evidence is extracted from techstack_report.json and indexed by keyword. The extraction traverses:
technologies.frontend[] — name, evidence[].finding, evidence[].detailstechnologies.backend[] — web servers, frameworks, CMS, languagestechnologies.infrastructure[] — DNS, CDN providerstechnologies.security[] — WAF, certificates, headers, email securitytechnologies.third_party[] — analytics, collaboration tools
Each evidence item is indexed under multiple keywords derived from the technology name fragments. Alias mappings expand coverage (e.g., email → proofpoint, microsoft, dmarc).
12.2 Threat-Evidence Matching
get_threat_evidence(threat) scans the threat's title, summary, and threat_name against the keyword index. Returns up to 6 (tech_name, evidence_string) tuples. Deduplication by {tech_name}:{evidence} key.
12.3 Severity Sorting
All threats sorted by: severity rank descending (critical=4, high=3, medium=2, low=1), then prioritization_score descending. Split into four lists for section rendering.
13. Unicode Characters
| Character | Code | Usage |
|---|
│ | U+2502 | Pipe separator in metadata rows |
• | U+2022 | Bullet point in relevance analysis, detection evidence |
— | U+2014 | Em-dash in section headers, posture items, evidence items |
· | U+00B7 | Middle dot in footer text |
✔ | U+2714 | Reserved (previously used in evidence, now removed) |
• | HTML entity | Bullet in executive summary key findings |
14. Adaptive Behaviors
14.1 Page Break Strategy
| Transition | Method |
|---|
| Between advisories (same severity) | CondPageBreak(220) — break only if <220pt remains |
| Between severity sections | PageBreak() — always new page |
| Before Evidence Collection | PageBreak() — separate last page |
14.2 Card Splittability
Advisory cards return flat list[Flowable] instead of monolithic CardBox. This allows ReportLab's frame to split cards across page boundaries at any Paragraph/Spacer seam, eliminating blank pages.
14.3 Client Adaptation
The design system is client-agnostic. Customized per client:
- Cover: client logo, name, sector, region, report ID
- Executive summary: narrative and key findings
- Attack surface: domain/subdomain inventory
- Evidence map: keyword aliases tuned to client's tech stack
- Security posture: assessments specific to client's infrastructure
- Recommendations: actionable items specific to client's vulnerabilities
All visual elements (colors, typography, spacing, components) remain identical across clients.
