Fendix v3.7.0 produces four stable report formats. JSON is the native machine contract, SARIF 2.1.0 carries results into compatible code-scanning systems, and HTML/PDF are reader formats.
JSONHTMLSARIFPDF
Stable report formats
| Format | Contract | Use |
|---|---|---|
| JSON | Schema 2 | Lossless Fendix report for automation, archival, and re-rendering. |
| SARIF | 2.1.0 | Code-scanning interchange; export and import have separate mappings. |
| HTML | Reader format | Interactive human review, including Arabic reports. |
| Reader format | Portable review artifact generated from a Fendix report. |
Machine-consumer guidance
- Check metadata.schema_version before interpreting JSON fields.
- Treat optional fields as absent knowledge. Do not convert absence into false.
- Never implement findings.length === 0 → safe. Inspect coverage and the release decision independently.
- Persist fingerprints, source identity, and provenance. Match machine identifiers rather than translated display text.
No finding is not complete coverage. A report can contain no blocking finding and still carry missing required evidence that makes the release INCOMPLETE.
Related reference
Evidence and provenance · Finding fingerprints · fendix report