تصدير SARIF

{
  "version": "2.1.0",
  "$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "Fendix",
          "version": "v3.7.0",
          "informationUri": "https://github.com/Fendix-app/Fendix",
          "rules": [
            {
              "id": "fendix.auth.python-auth-missing",
              "name": "Missing authentication on user data endpoint",
              "shortDescription": {
                "text": "Missing authentication on user data endpoint"
              },
              "help": {
                "text": "Require authentication before returning user data."
              },
              "helpUri": "https://cwe.mitre.org/data/definitions/306.html",
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "category": "auth",
                "tags": [
                  "CWE-306"
                ],
                "confidence": "MEDIUM",
                "security-severity": "8.0",
                "severity_model": "intrinsic"
              }
            }
          ]
        }
      },
      "automationDetails": {
        "id": "fendix/scan/hybrid"
      },
      "results": [
        {
          "ruleId": "fendix.auth.python-auth-missing",
          "ruleIndex": 0,
          "level": "warning",
          "message": {
            "text": "Missing authentication on user data endpoint at app/users.py:42 — MEDIUM confidence (68/100): effective risk MEDIUM, below this rule's HIGH severity"
          },
          "locations": [
            {
              "logicalLocations": [
                {
                  "name": "app/users.py:42",
                  "kind": "endpoint"
                }
              ]
            }
          ],
          "partialFingerprints": {
            "fendix/v1": "1dcbb4264cbed08eb4a54e6f509a724445801f92"
          },
          "rank": 56,
          "properties": {
            "source_tier": "tree_sitter_sidecar",
            "status": "WARN",
            "confidence_score": 68,
            "confidence_band": "MEDIUM",
            "intrinsic_severity": "HIGH",
            "effective_risk": "MEDIUM",
            "evidence": "GET /api/users/{id} reaches users.get without an authentication guard",
            "decision": {
              "status": "WARN",
              "reason": "Evidence does not meet the enforced blocking requirement.",
              "policy": "enforced",
              "evidence": {
                "auth_expectation": "required"
              }
            }
          }
        }
      ],
      "invocations": [
        {
          "executionSuccessful": false,
          "toolExecutionNotifications": [
            {
              "level": "warning",
              "message": {
                "text": "pip: unavailable (dependency_missing): required manifest was not delivered"
              }
            },
            {
              "level": "error",
              "message": {
                "text": "required analyzer pip not delivered: unavailable (dependency_missing)"
              }
            },
            {
              "level": "warning",
              "message": {
                "text": "Required coverage incomplete: pip"
              }
            }
          ]
        }
      ],
      "properties": {
        "fendix/coverage": {
          "coverage": {
            "contract_version": 1,
            "strict": true,
            "configured_complete": false,
            "gaps": [
              "pip"
            ],
            "limitations": [],
            "required_analyzers": [
              "semgrep",
              "dast",
              "pip"
            ],
            "required_gaps": [
              "pip"
            ],
            "retried": []
          },
          "scanner_status": [
            {
              "name": "semgrep",
              "state": "ok"
            },
            {
              "name": "dast",
              "state": "ok"
            },
            {
              "name": "pip",
              "state": "skipped",
              "reason": "dependency_missing",
              "detail": "required manifest was not delivered"
            }
          ]
        },
        "fendix/release": {
          "coverage_state": "incomplete",
          "decision_policy_version": "v2",
          "release_decision": "incomplete"
        }
      }
    }
  ]
}