SARIF

Purpose: Static Analysis Results Interchange Format output for GitHub Security and any SARIF viewer. When to use: Inline findings in pull requests, gate builds, or archive scan results in a standard results format.

Example

cryptarium scan --format sarif --output results.sarif .

With the GitHub Action and upload-sarif: true, results appear under Security → Code scanning (tool: cryptarium). See Uploading SARIF.

Caveats

Pair SARIF with --fail-on when you want a non-zero exit on severity thresholds (CI with —fail-on).
Finding text stays plain and specific — location, class, recommendation, confidence — not alarmist marketing copy.