Phase 4: AI Reporting & SMB-Friendly UX

[ToryMic]

Phase 4 — AI Reporting & SMB-Friendly UX

Depends on: Phase 3

Drips Wave alignment

• Maps to Wave #29 secure key storage — encrypted ANTHROPIC_API_KEY at rest
• Plain-English output for non-specialist users (dual-audience design in PRD)

Deliverables

• Grounded AI reports with finding ID citations in ai_reporter.py
• Per-OWASP-category remediation cards in dashboard
• Documented safety score algorithm (A–F grading)
• Optional passphrase-encrypted API key storage module
• Template fallback quality audit (no hallucinated CVEs)
• Presentation slides 9–10 screenshots from live demo

Acceptance criteria

• AI report cites only findings present in scan results
• Dashboard shows plain-English "how to fix" per finding
• secrets.validate_settings() warns on production without encryption
• Demo workflow completable in < 5 minutes for viva panel

References

• PRD §4 Solution
• FUT Minna thesis Chapter 5