Reference B: Finding side panel fields

Select a row to open the finding side panel. The Package Operational Risk page uses a dedicated side panel evidence component, registered at findings.extensions.config.ts:110, which presents the following fields per package-integrity-side-panel-sections.component.ts:87.

Field	Description
Data Source	The VCS provider, displayed with a provider icon and a link to the data source
Repository	The repository containing the dependency manifest
Package Manager	The ecosystem, displayed with an ecosystem icon
Dependency Type	Direct or Transitive
Branch	The branch the finding was detected on
Backlog Status	Whether the finding is New or pre-existing backlog
Collaborator	The Git author associated with the commit that introduced the dependency
First Hash	The commit that first introduced the dependency
First Commit Date	Timestamp of that commit
Actions	The policy actions that matched the finding, displayed as labels. Empty when no policy matched

Read the Actions field to diagnose a policy gap on a single finding. An empty Actions field is the per-finding equivalent of the population-level policy gap described in the audit workflows: the finding was detected, no policy matched, and no issue was created.

Note. Backlog Status distinguishes a newly introduced dependency from pre-existing technical debt. A New operational risk finding means a developer has just added a dependency that was already unmaintained at the time of adoption, which is a prevention failure rather than a modernization backlog item. For enforcement at intake, refer to Unified Application Security Policies.