Reference

Output Formats

Terminal output is always shown. Optionally save structured reports for archiving, diffing, or sharing with --format.

Risk score bands:

0 - 3.9 Low

4 - 6.9 Medium

7 - 10 High

Terminal

always on

Rich table with colour-coded severity rows. Risk score printed in green / yellow / red based on band. Always shown, even when other formats are requested.

.md

Markdown

--format md

Clean table with attack ID, category, name, severity, result, and recommendation. Ideal for pasting into GitHub issues or Notion. Each finding now also lists its CWE ID and CVSS 3.1 score.

{}

JSON

--format json

Full ScanReport structure including judge_reasoning per finding. Best for programmatic processing, diffing results over time, or feeding into CI pipelines. Findings include cwe_ids and a full cvss_vector/cvss_score.

.html

HTML

--format html

Self-contained file. Rows colour-coded by severity. Jinja2 autoescape=True ensures attack payloads containing <script> render as escaped text - XSS-safe by design. Each finding displays its mapped CWE ID and CVSS score.

.sarif

SARIF

--format sarif

SARIF 2.1.0 output consumed by the GitHub Security tab and VS Code's SARIF Viewer. Includes CWE taxonomy mappings per rule and a security-severity property GitHub uses to rank findings.