diff --git a/README.md b/README.md
index 6eba5f6..6513f08 100644
--- a/README.md
+++ b/README.md
@@ -45,8 +45,8 @@ project page is left out. The report has these parts:
 
 1. the cover and a table of contents,
 2. a summary and the most critical issues across all sources,
-3. one section per SARIF run, named after its tool (e.g. CipherCell SAST, CipherCell Lynkeus),
-4. the dependency vulnerabilities from the VDR,
+3. the dependency vulnerabilities from the VDR,
+4. one section per SARIF run, named after its tool (e.g. CipherCell Lynkeus, CipherCell SAST),
 5. at the end, *False Positives and Suppressed Findings*: every result Polygraph classified as a
    false positive or that carries a SARIF suppression (such as the areas Lynkeus ruled out), with
    the reason.
diff --git a/report_generator/context.py b/report_generator/context.py
index 6577cac..6eb5d7e 100644
--- a/report_generator/context.py
+++ b/report_generator/context.py
@@ -90,7 +90,7 @@ def build_context(
         context["critical"] = critical
 
     if sca is not None:
-        context["sections"].append(_sca_section(sca))
+        context["sections"].insert(0, _sca_section(sca))
 
     set_aside = _set_aside_section(tools)