use super::html_escape;

pub(super) fn appendix(session_id: &str) -> String {
    format!(
        r##"<!-- ═══════════════ 5. APPENDIX ═══════════════ -->
<div class="page-break"></div>
<h2><span class="section-num">5.</span> Appendix</h2>

<h3>Severity Definitions</h3>
<table class="info">
    <tr><td style="color: var(--sev-critical); font-weight: 700;">Critical</td><td>Vulnerabilities that can be exploited remotely without authentication to execute arbitrary code, exfiltrate sensitive data, or fully compromise the system.</td></tr>
    <tr><td style="color: var(--sev-high); font-weight: 700;">High</td><td>Vulnerabilities that allow significant unauthorized access or data exposure, typically requiring minimal user interaction or privileges.</td></tr>
    <tr><td style="color: var(--sev-medium); font-weight: 700;">Medium</td><td>Vulnerabilities that may lead to limited data exposure or require specific conditions to exploit, but still represent meaningful risk.</td></tr>
    <tr><td style="color: var(--sev-low); font-weight: 700;">Low</td><td>Minor issues with limited direct impact. May contribute to broader attack chains or indicate defense-in-depth weaknesses.</td></tr>
    <tr><td style="color: var(--sev-info); font-weight: 700;">Info</td><td>Observations and best-practice recommendations that do not represent direct security vulnerabilities.</td></tr>
</table>

<h3>Disclaimer</h3>
<p style="font-size: 9pt; color: var(--text-secondary);">
    This report was generated by an automated AI-powered penetration testing engine. While the system
    employs advanced techniques to identify vulnerabilities, no automated assessment can guarantee
    complete coverage. The results should be reviewed by qualified security professionals and validated
    in the context of the target application's threat model. Findings are point-in-time observations
    and may change as the application evolves.
</p>

<!-- ═══════════════ FOOTER ═══════════════ -->
<div class="report-footer">
    <div class="footer-company">Compliance Scanner</div>
    <div>AI-Powered Security Assessment Platform</div>
    <div style="margin-top: 6px;">This document is confidential and intended solely for the named recipient.</div>
    <div>Report ID: {session_id}</div>
</div>

</div><!-- .report-body -->
</body>
</html>"##,
        session_id = html_escape(session_id),
    )
}