The exporter writes SARIF 2.1.0, identifies the driver as Fendix, groups runs under fendix/scan/<mode>, and carries fendix/v2 in partialFingerprints.
Decision, level, and severity
When a finding has a disposition, SARIF result.level follows the disposition. Intrinsic severity remains on the rule as security-severity; per-result effective risk uses rank. An unstamped archived finding falls back to severity for level.
| Fendix axis | Value | SARIF value |
|---|---|---|
| Finding disposition | BLOCK | result.level = error |
| Finding disposition | INFO | result.level = note |
| Finding disposition | WARN | result.level = warning |
| Intrinsic severity | CRITICAL | security-severity = 9.5 |
| Intrinsic severity | HIGH | security-severity = 8.0 |
| Intrinsic severity | INFO | security-severity = 1.0 |
| Intrinsic severity | LOW | security-severity = 3.0 |
| Intrinsic severity | MEDIUM | security-severity = 5.5 |
Exported contract
| SARIF surface | Fendix content |
|---|---|
| tool.driver.rules | Stable rule key, title/help, intrinsic severity, category, references, and confidence metadata. |
| results[] | Decision-aware level, message, physical/logical locations, code flows, rank, and properties. |
| partialFingerprints.fendix/v2 | The fingerprint of ONE occurrence. A grouped finding is exported as one result per occurrence, so a Code Scanning dismissal never covers a different occurrence; properties.finding_id names the group. Never invented when absent, and omitted on a legacy grouped finding that has no per-occurrence identities. |
| invocations[] | Execution success and analyzer failure/coverage notifications. |
| properties.fendix/coverage | Coverage and scanner_status. |
| properties.fendix/release | Hosted release decision, coverage state, policy version, and optional rationale. |
Result property keys
affected_endpoint_countaffected_endpointsconfidence_bandconfidence_breakdownconfidence_reasonsconfidence_scorecorroborating_toolsdecisioneffective_riskevidencefinding_idintrinsic_severitylocations_truncatedoccurrence_countreachableroute_handlerroute_methodroute_patternsource_tierstatus
Generated SARIF export
This example is rendered from the same approved HIGH → WARN and missing required SCA scenario as the JSON example.
fendix-results.sarif
{
"version": "2.1.0",
"$schema": "https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json",
"runs": [
{
"tool": {
"driver": {
"name": "Fendix",
"version": "v3.7.0",
"informationUri": "https://github.com/Fendix-app/Fendix",
"rules": [
{
"id": "fendix.auth.python-auth-missing",
"name": "Missing authentication on user data endpoint",
"shortDescription": {
"text": "Missing authentication on user data endpoint"
},
"help": {
"text": "Require authentication before returning user data."
},
"helpUri": "https://cwe.mitre.org/data/definitions/306.html",
"defaultConfiguration": {
"level": "error"
},
"properties": {
"category": "auth",
"tags": [
"CWE-306"
],
"confidence": "MEDIUM",
"security-severity": "8.0",
"severity_model": "intrinsic"
}
}
]
}
},
"automationDetails": {
"id": "fendix/scan/hybrid"
},
"results": [
{
"ruleId": "fendix.auth.python-auth-missing",
"ruleIndex": 0,
"level": "warning",
"message": {
"text": "Missing authentication on user data endpoint at app/users.py:42 — MEDIUM confidence (68/100): effective risk MEDIUM, below this rule's HIGH severity"
},
"locations": [
{
"logicalLocations": [
{
"name": "app/users.py:42",
"kind": "endpoint"
}
]
}
],
"partialFingerprints": {
"fendix/v1": "1dcbb4264cbed08eb4a54e6f509a724445801f92"
},
"rank": 56,
"properties": {
"source_tier": "tree_sitter_sidecar",
"status": "WARN",
"confidence_score": 68,
"confidence_band": "MEDIUM",
"intrinsic_severity": "HIGH",
"effective_risk": "MEDIUM",
"evidence": "GET /api/users/{id} reaches users.get without an authentication guard",
"decision": {
"status": "WARN",
"reason": "Evidence does not meet the enforced blocking requirement.",
"policy": "enforced",
"evidence": {
"auth_expectation": "required"
}
}
}
}
],
"invocations": [
{
"executionSuccessful": false,
"toolExecutionNotifications": [
{
"level": "warning",
"message": {
"text": "pip: unavailable (dependency_missing): required manifest was not delivered"
}
},
{
"level": "error",
"message": {
"text": "required analyzer pip not delivered: unavailable (dependency_missing)"
}
},
{
"level": "warning",
"message": {
"text": "Required coverage incomplete: pip"
}
}
]
}
],
"properties": {
"fendix/coverage": {
"coverage": {
"contract_version": 1,
"strict": true,
"configured_complete": false,
"gaps": [
"pip"
],
"limitations": [],
"required_analyzers": [
"semgrep",
"dast",
"pip"
],
"required_gaps": [
"pip"
],
"retried": []
},
"scanner_status": [
{
"name": "semgrep",
"state": "ok"
},
{
"name": "dast",
"state": "ok"
},
{
"name": "pip",
"state": "skipped",
"reason": "dependency_missing",
"detail": "required manifest was not delivered"
}
]
},
"fendix/release": {
"coverage_state": "incomplete",
"decision_policy_version": "v2",
"release_decision": "incomplete"
}
}
}
]
}Consumer boundary
Third-party consumers may ignore or drop Fendix-specific properties. Preserve the native JSON report when the complete coverage, decision, and provenance contract must remain auditable.