Many of the points I've actually specifically catered for in my compliance report are reassuring. For example, linking CVEs, sensible layouts etc.
The application itself caters for helping actual devs triage, fix, etc., with the report catering to audit and compliance needs. I've tried to avoid baking this into the report as the tool itself allows devs to get AI remediation guidance. Dev's don't read these reports IMO but they would jump into the application and click a button to see what the fix is - I hope.
Thanks again. I appreciate the time taken to respond with such detail.