Update frontend/src/pages/Help.jsx

frontend/src/pages/Help.jsx

@@ -1,4 +1,5 @@
 import React, { useState } from 'react';
+import { Link } from 'react-router-dom';
 
 export const Help = () => {
   const [activeFaq, setActiveFaq] = useState(null);
@@ -21,8 +22,60 @@ export const Help = () => {
       answer: "SPAs often handle routing dynamically on the client side, which can trick traditional scanners into thinking non-existent pages are real (Soft 404s). LarShield uses advanced baseline fingerprinting to minimize these, but if you notice recurring issues, please contact support."
     },
     {
-      question: "How can I manage members in my organization?",
-      answer: "If you are an Organization Admin, go to the 'Organization' settings. From there, you can invite new members via email, manage their roles (e.g., Executive User, Admin), and revoke access if necessary."
+      question: "How is the Security Risk Score calculated?",
+      answer: `This assessment utilizes an enterprise CVSS-weighted, category-capped vulnerability risk scoring algorithm. The score calculation is fully deterministic, auditable, and reproducible.
+
+1. Severity Base Weights & Formula
+Deduction per Finding = Severity Base Weight × [0.2 + 0.8 × (CVSS / 10)] × Confidence Multiplier
+
+• Critical: 25.0 pts (CVSS Scaling Range: 0.20 - 1.00x) - Immediate threat to core business logic or full system compromise.
+• High: 12.0 pts (CVSS Scaling Range: 0.20 - 1.00x) - Direct threat to application confidentiality or integrity.
+• Medium: 4.0 pts (CVSS Scaling Range: 0.20 - 1.00x) - Indirect threat or security control misconfiguration.
+• Low: 1.5 pts (CVSS Scaling Range: 0.20 - 1.00x) - Minor hardening flaw or minimal impact finding.
+• Informational: 0.0 pts (CVSS Scaling Range: 0.00x) - Best practice advisory or design note.
+
+2. Category Deduction Caps
+To prevent non-exploitable misconfigurations from disproportionately penalizing the overall score, category deduction caps are enforced:
+• Security Headers: 15.0 pts max (Capped)
+• SSL/TLS Configuration: 15.0 pts max (Capped)
+• HTTP Method Tampering: 12.0 pts max (Capped & Root-Cause Deduped)
+• Cookie Security: 10.0 pts max (Capped)
+• DNS Security: 10.0 pts max (Capped)
+• Compliance Framework Signals: 0.0 pts (Unlinked — Reported Separately)
+
+3. Graduated Confidence Multipliers & Posture Floor
+• Confirmed / High: 1.00x Multiplier. Floor: 75 / 100 (Grade C) if 0 Critical & 0 Highs (≤ 15 Mediums).
+• Likely: 0.60x Multiplier. Floor: 60 / 100 (Grade D) if 0 Critical & 0 Highs (> 15 Mediums).
+• Medium: 0.50x Multiplier. Floor: 55 / 100 (Grade D) if 0 Criticals (≤ 15 Mediums).
+• Low / Unconfirmed: 0.20x Multiplier. No Floor (Grade F) if 1+ Critical Vulnerability.
+
+4. Worked Calculation Examples
+Example 1: Application with 15 Missing Security Headers (Capped Deduction)
+• Raw calculation: 15 × [4.0 × (0.2 + 0.8 × 0.53) × 1.0] = 37.4 pts.
+• Category Cap applied: Security Headers deduction is capped at 15.0 pts max.
+• Posture Floor rule: No Critical/High findings → Score = 100 - 15 = 85 / 100 (Grade B — Good).
+
+Example 2: Audit with 1 High, 5 Mediums, and 1 Low Finding
+• High (No Brute-Force, CVSS 7.5): 12.0 × (0.2 + 0.8 × 0.75) × 1.0 = 9.6 pts.
+• Mediums (CORS, Cookie, DNS): Sum of capped category deductions = 15.8 pts.
+• Low (Server Header): 1.5 × (0.2 + 0.8 × 0.31) × 1.0 = 0.7 pts.
+• Total Deduction = 26.1 pts → Score = 100 - 26.1 = 74 / 100 (Grade C — Fair).
+
+Example 3: Application with Critical Blind SQL Injection (CVSS 9.8)
+• Critical (Blind SQLi, CVSS 9.8): 25.0 × (0.2 + 0.8 × 0.98) × 1.0 = 24.6 pts.
+• High (Auth Bypass, CVSS 8.1): 12.0 × (0.2 + 0.8 × 0.81) × 1.0 = 10.2 pts.
+• Total Deduction = 34.8 pts → Posture Floor Disabled (Critical Present).
+• Final Score = 100 - 34.8 = 65 / 100 (Grade D — Poor).`
+    },
+    {
+      question: "Privacy Policy & Data Handling",
+      answer: `We are fully committed to protecting your data and privacy. We align our data collection and handling procedures with global standards, including GDPR, CCPA, and India's DPDP Act.
+
+• Data Encryption: All vulnerability scan data is encrypted at rest (AES-256) and in transit (TLS 1.3).
+• Audit Logs: To prevent abuse, we retain metadata regarding IP origins, target configurations, and timestamped actions.
+• Third-Party Sharing: We do not sell or share your data with third parties for marketing purposes. Data is only shared with essential infrastructure providers or law enforcement if legally compelled.`,
+      linkText: "Read our full Privacy Policy",
+      linkUrl: "/legal/privacy"
     }
   ];
 
@@ -63,44 +116,26 @@ export const Help = () => {
               </button>
               
               <div 
-                className={`px-md overflow-hidden transition-all duration-300 ease-in-out ${activeFaq === index ? 'max-h-96 pb-md opacity-100' : 'max-h-0 opacity-0'}`}
+                className={`px-md overflow-hidden transition-all duration-300 ease-in-out ${activeFaq === index ? 'max-h-[2000px] pb-md opacity-100' : 'max-h-0 opacity-0'}`}
               >
-                <p className="text-on-surface-variant font-body-md leading-relaxed m-0 border-t border-outline-variant/30 pt-sm">
-                  {faq.answer}
-                </p>
+                <div className="border-t border-outline-variant/30 pt-sm">
+                  <p className="text-on-surface-variant font-body-md leading-relaxed m-0 whitespace-pre-line">
+                    {faq.answer}
+                  </p>
+                  {faq.linkUrl && (
+                    <Link 
+                      to={faq.linkUrl} 
+                      className="inline-flex items-center gap-xs mt-md text-primary font-bold hover:underline font-label-md"
+                    >
+                      {faq.linkText} <span className="material-symbols-outlined text-sm">arrow_forward</span>
+                    </Link>
+                  )}
+                </div>
               </div>
             </div>
           ))}
         </div>
       </div>
-
-      <div className="grid grid-cols-1 md:grid-cols-2 gap-lg mb-xl">
-        <div className="bg-surface-container-lowest border border-outline-variant rounded-xl p-lg flex flex-col items-start gap-sm hover:shadow-md transition-shadow">
-          <div className="w-12 h-12 rounded-lg bg-primary/10 flex items-center justify-center text-primary mb-xs">
-            <span className="material-symbols-outlined text-[28px]">book</span>
-          </div>
-          <h3 className="text-lg font-bold text-on-surface m-0">Documentation</h3>
-          <p className="text-on-surface-variant font-body-sm mb-md flex-1">
-            Dive deep into our API references, detailed scanner methodology, and integration guides.
-          </p>
-          <button className="text-primary font-label-md font-bold hover:underline bg-transparent border-0 cursor-pointer p-0 flex items-center gap-xs">
-            Read Docs <span className="material-symbols-outlined text-sm">arrow_forward</span>
-          </button>
-        </div>
-
-        <div className="bg-surface-container-lowest border border-outline-variant rounded-xl p-lg flex flex-col items-start gap-sm hover:shadow-md transition-shadow">
-          <div className="w-12 h-12 rounded-lg bg-secondary/10 flex items-center justify-center text-secondary mb-xs">
-            <span className="material-symbols-outlined text-[28px]">support_agent</span>
-          </div>
-          <h3 className="text-lg font-bold text-on-surface m-0">Contact Support</h3>
-          <p className="text-on-surface-variant font-body-sm mb-md flex-1">
-            Can't find what you're looking for? Our security experts are here to help you resolve any issues.
-          </p>
-          <button className="text-secondary font-label-md font-bold hover:underline bg-transparent border-0 cursor-pointer p-0 flex items-center gap-xs">
-            Submit a Ticket <span className="material-symbols-outlined text-sm">arrow_forward</span>
-          </button>
-        </div>
-      </div>
     </div>
   );
 };