Clarify Exposure Scan Wording in Application Inventory to Reflect Actual Support for SAST vs. DAST

1. Problem Statement

In the Application Inventory → Exposures tab, the current descriptive text states that users can “import a DAST or SAST scan.” This wording implies that DAST results appear at the application level, which is not supported.

As confirmed in IBM Support Case TS021451342, DAST findings are only displayed in the Environment Inventory, not on the application level. This inconsistency leads to incorrect expectations, confusion for end users, and unnecessary support inquiries.

2. Current Behavior

• SAST scan results → displayed in the Application Inventory (Exposures tab)
• DAST scan results → displayed only in the Environment Inventory
• UI text suggests both scan types can be viewed at application level.

Current UI text:

"Import dynamic or static exposure scans
Use the toolkit to configure continuous data ingestion or import a DAST or SAST scan to access and prioritize non‑CVE exposure vulnerabilities."

3. Desired Behavior (RFE Request)

Update the UI text in the Application Inventory → Exposures tab so that it accurately reflects that only SAST scan results are shown at the application level.

4. Proposed Text Update

Option A (most concise):

"Import static exposure scans
Use the toolkit to configure continuous data ingestion or import a SAST scan to access and prioritize non‑CVE exposure vulnerabilities."

Option B (fully explicit):

"The Exposures tab displays SAST scan results. DAST scan results are available at the environment level."