Output formats

Text, JSON, SARIF and Markdown reports of inkdex-vuln scan, and JSON output of every inkdex command.

Text

The default. In a terminal it is in colour, with a progress line per phase on stderr. In a pipe, a file or CI it is plain text and the progress is off.

--explain adds, under each finding, its details (source, route, authentication, confidence, the steps of the flow): what the JSON meta holds.

Markdown

inkdex-vuln scan --format markdown >> "$GITHUB_STEP_SUMMARY"

The counts, then a table: severity, rule, finding with its CWE and verdict, place, evidence. For a CI job summary or a pull request comment.

JSON

inkdex-vuln scan --format json -o findings.json

An array of findings, worst first:

[
  {
    "rule_id": "VULN-SQLI",
    "cwe": "CWE-89",
    "title": "SQL injection",
    "severity": "critical",
    "verdict": "proven",
    "file": "app/db.py",
    "line": 21,
    "function": "app.db.find_user",
    "evidence": "GET /users (app/routes.py:12) reaches cursor.execute unsanitized",
    "fingerprint": "3b9c…40 hex characters",
    "meta": {
      "category": "sql.query",
      "route": "/users",
      "method": "GET",
      "source": "app/routes.py:12",
      "steps": ["app/routes.py:12 users …", "app/db.py:21 find_user …"]
    }
  }
]

Field	Meaning
`rule_id`, `cwe`, `title`	The rule (see Findings).
`severity`	`critical`, `high`, `medium` or `low`.
`verdict`	`proven` or `verify`.
`file`, `line`, `function`	Where it acts.
`evidence`	The flow or the line, in words.
`fingerprint`	Stable across commits: the same finding keeps it when code moves.
`meta`	Rule-specific details: for a flow, its category, route, method, source, steps and other sources; for a dependency, the package, version, advisory and fixed version.

SARIF

inkdex-vuln scan --format sarif -o inkdex.sarif

SARIF 2.1.0, for GitHub code scanning, GitLab and other SARIF-aware tools:

each rule carries its CWE tags and a security-severity;
a flow is a codeFlow you can step through;
the fingerprint is a partialFingerprints entry.

JSON from inkdex commands

Every inkdex command takes --json (one document) or --jsonl (one object per line):

inkdex routes --unauthenticated --json
inkdex sec flows --unsanitized --jsonl | jq -r '.sink.path'