[NO-TICKET] Explain why the report button is missing, and name every way to connect a site

[mariojgt]

What changed

The two JavaScript / Node.js pages now explain the real reason the Report a vulnerability button does not show up after an install, and the install page gains a Connecting the site to your account section that lists all three routes, led by the widget's own panel.

Why the old explanation was wrong

Both pages told readers to set data-report-form="true" on the script tag to reveal the button. The widget does not read that attribute: it is absent from the auto_init_data_attributes table and from the init() parameter list in the widget reference. Anyone who followed the instruction changed nothing, still had no button, and had been pointed away from the actual cause.

The actual cause is claim state. data-build-mode is on by default, and while a site is unclaimed the widget shows a one-time "Connect this website" panel instead of the report button. Connect the site and the button takes its place for good. The real opt-out is data-build-mode="false", which skips onboarding and always shows the report form.

Fix

• installing-on-javascript-node-projects.md
  • New Connecting the site to your account section: the widget panel first (no terminal, no copied URL), then the dashboard link, then npx @patchstack/connect claim. Notes that an unconnected site stays claimable by anyone who loads the page, because the UUID is public and claiming is first-come.
  • The data-report-form paragraph is replaced by the claim-state behaviour, the production-build case, and #patchstack / ?patchstack for owners on a live site.
  • The section lead no longer calls the widget a report button outright, since that is only its connected form.
  • The end-of-setup paragraph points at the new section instead of naming the dashboard link as the only way in.
• troubleshooting-javascript-node-projects.mdx
  • "The widget is not visible on my site" step 1 now says to connect the site, and offers data-build-mode="false" as the way to always show the form. Step 2 explains that a hidden panel on a published build is expected rather than a failed install.

How it was verified

npm run build — 197 pages, no broken links or MDX errors. Both new anchors (#connecting-the-site-to-your-account, #the-disclosure-widget) resolve against their headings. Behaviour checked against the widget's own public reference rather than inferred from the connector.

Out of scope, worth a follow-up

public/schemas/threat-intel-npm.postman_collection.json is stale: a build regenerates it with matched_range content that the committed copy is missing. Unrelated to this change, so I reverted it here — it wants its own commit.

The connector printed the same wrong expectation, fixed in patchstack/connect#277.

🤖 Generated with Claude Code

[coderbuds]

Clear documentation explaining missing report button and connection methods.

🎯 Quality: 95% Elite · 📦 Size: Small

📈 This month: Your 144th PR — above team average · Averaging Excellent

_{See how your team is trending →}

[netlify]

✅ Deploy Preview for deluxe-meerkat-8daf24 ready!

Name	Link
🔨 Latest commit	32f8b04
🔍 Latest deploy log	https://app.netlify.com/projects/deluxe-meerkat-8daf24/deploys/6ab12d79eb715d0008b73e20
😎 Deploy Preview	https://deploy-preview-88--deluxe-meerkat-8daf24.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify project configuration.

[mariojgt]

/review