What should dependency risk review include?

Review available dependency findings, recommendations, source report details, and platform readiness where evidence exists.

Should missing dependency data be treated as safe?

No. Missing data should be shown as unavailable or missing rather than treated as zero risk.

Guide

Dependency risk pages should show exactly what report data exists, what is missing, and what recommendations can be traced back to the audit.

Package findings, dependency recommendations, and Darwin/SPM readiness can inform the same review without becoming the same metric.

If a tool report is missing or does not contain readiness fields, the dashboard should show that limitation instead of implying safety.

Can dependency reports include project paths?

Yes. Reports may contain paths, metadata, summaries, and generated evidence. Review the data-boundary page before sharing broadly.

Is Darwin/SPM readiness a separate paid feature?

No. It is presented as dependency/platform readiness context where report evidence supports it.