Output Reporters
Relevant source files
The following files were used as context for generating this wiki page:
Output Reporters are the specialized modules within the Unified Security Scanner responsible for transforming raw scan findings into structured, human-readable, or machine-consumable formats. They represent the final stage of the scanning pipeline, taking validated findings from the orchestrator and formatting them for local development, CI/CD integration, or enterprise auditing.
The system supports multiple concurrent output formats, allowing developers to receive immediate feedback in their terminal while simultaneously generating detailed SARIF or JSON reports for automated security gates and compliance tracking.
Sources: QUICK_START.md:126-140, CONTRIBUTING.md:15-20
Reporter Architecture and Data Flow
The reporter system is located in the core package and interacts directly with the SARIFProcessor and the main scanning engine. Once the MultiScanOrchestrator completes its 3-phase analysis—Traditional SAST, AI-Enhanced Analysis, and Targeted Deep Dives—the resulting findings are passed to the reporter modules.
Scan to Report Pipeline
The diagram above illustrates how raw findings are processed and distributed to various reporter types.
Sources: README.md:104-124, src/index.ts:1-10
Supported Output Formats
The scanner provides a diverse range of formats to support different stages of the Software Development Life Cycle (SDLC).
| Format | Primary Use Case | Key Features |
|---|---|---|
| terminal | Local Development | Human-readable, color-coded severity, code snippets, and remediation tips. |
| sarif | CI/CD & GitHub | Integration with GitHub Security tab and PR inline annotations. |
| json | Automation & APIs | Machine-readable structured data for custom dashboards and tools. |
| html | Compliance & Audits | Static visual reports suitable for management and security reviews. |
Sources: QUICK_START.md:143-150, README.md:132-135
SARIF Integration
The Static Analysis Results Interchange Format (SARIF) is the primary machine-readable format for CI/CD integration. It allows the scanner to communicate directly with platforms like GitHub Code Scanning.
The sequence diagram shows the flow of findings from the CLI to GitHub's UI using the SARIF processor.
Sources: README.md:200-220, src/index.ts:8
Reporter Configuration
Reporters are configured via the output section of the project's configuration file (e.g., .securityrc.json or configs/default.json).
| Configuration Option | Type | Default | Description |
|---|---|---|---|
formats | String Array | ["terminal"] | List of enabled reporter types (terminal, sarif, json, html). |
dir | String | ./reports | Target directory where file-based reports will be saved. |
verbose | Boolean | false | Enables detailed logging, including scan coverage and suppressed findings. |
quiet | Boolean | false | Suppresses terminal output except for critical errors. |
Configuration Example
"output": {
"formats": ["terminal", "sarif", "json"],
"dir": "./security-reports",
"verbose": true
}
Sources: configs/default.json:34-39, README.md:130-138
Reporting Logic and Findings Classification
The reporters categorize findings based on severity and status. This classification determines how the information is displayed (e.g., red text for Critical) and whether the reporter should signal a build failure.
Severity Levels
- 🔴 CRITICAL: Requires immediate action; typically blocks deployments. Examples: exposed secrets, shell injection.
- 🟠 HIGH: Requires review before production merging. Examples: SQL injection, XSS.
- 🟡 MEDIUM: General security improvements and outdated packages.
- ⚪ LOW: Minor optimizations and code quality issues.
Suppression and False Positives
The reporters also track "Suppressed" findings. The scanner targets an industry-leading false positive rate of <5%. Findings identified as false positives by the AI validation phase are omitted from the primary report but can be viewed in verbose mode.
Sources: QUICK_START.md:65-85, SECURITY_REVIEW.md:10-25, README.md:4-10
Conclusion
Output Reporters provide the critical interface between the scanner's complex analysis engine and the end-user. By supporting formats ranging from interactive terminal summaries to standardized SARIF files, the reporting system ensures that security findings are both actionable for developers and traceable for security teams.