The Policies tab
Where a project stands against the policies you publish, with every gap carrying the control it contradicts and the passage from the document that shows it.
Taiga reads the project's own architecture, data flow and privacy documents against the text of your policies, and records each contradiction as a divergence. That catches what no scanner can: personal data kept with no retention limit, or a service storing in plaintext what your data policy says must be encrypted.
Every divergence carries the control's own sentence, the passage that contradicts it, and which documents were read. Only critical and high ones are reported, and a gap Taiga cannot cite is not reported at all.
A gap has a Fix that raises an initiative onto the end of the queue. It stays listed while that work runs, because only the next assessment can record that the documents no longer support it, and that assessment is asked for an explicit verdict once the initiative is done.
A divergence that first appears after a push to your default branch is news, and the inbox says so. What an import found is the baseline you curate, and never raises an item.