Skip to content

feat: verified SARIF export for completed scans - #5

Draft
yashaskn8 wants to merge 52 commits into
mainfrom
feature/verified-sarif-export-2026
Draft

feat: verified SARIF export for completed scans#5
yashaskn8 wants to merge 52 commits into
mainfrom
feature/verified-sarif-export-2026

Conversation

@yashaskn8

@yashaskn8 yashaskn8 commented Oct 31, 2026

Copy link
Copy Markdown
Owner

Summary

  • Add a read-only SARIF 2.1.0 export for tenant-owned completed scans, including only canonical open verified findings.
  • Bound output, redact secrets, reject malformed paths, and exclude source snippets.
  • Add scan UI download and API client.
  • Record 100 researched feature candidates and simulated architecture review in docs/FEATURE_SELECTION_2026_SARIF.md.

Verification

  • Unit and API regression tests added. CI required; remote runtime checks have not yet been observed.
  • Do not merge until tests pass and a human reviews security/production concerns.

Safety

  • No default-branch writes, deployments, external publication, or permission escalation. Existing production acquisition blockers remain intact.

@yashaskn8
feat: add deterministic verified SARIF 2.1 export builder
6f6e51f
@yashaskn8
feat(api): expose authenticated bounded SARIF scan export
3342a56
@yashaskn8
test: cover SARIF grounding, ownership, redaction, and limits
8317d19
@yashaskn8
feat(frontend): add typed SARIF download API client
cb77766
@yashaskn8
feat(ui): offer verified SARIF download beside scan PDF
ee0ab54
@yashaskn8
docs: research 100 feature candidates and record simulated architectu…
9fee90c 
…re tournament
@yashaskn8
fix: include GitHub-compatible primary location fingerprint
6dbf529
@yashaskn8
test: assert SARIF interoperability fingerprint
2cea445
@yashaskn8
docs: correct weighted senior-review comparison scores
139b638
@yashaskn8
fix(sarif): avoid mislabeling location digest as GitHub line hash
803b392
@yashaskn8
test(sarif): cover rule identifier collisions from lossy normalization
d40e65d
@yashaskn8
fix(sarif): distinguish sanitized and truncated rule identifiers
31cc05b
@yashaskn8
test(sarif): assert existing safe rule IDs remain stable
ccfd6a3
@yashaskn8
fix(sarif): redact credentials in exported rule identifiers
75f9d38
@yashaskn8 yashaskn8 mentioned this pull request Oct 31, 2026
Draft
@yashaskn8
fix(sarif): omit credential-bearing artifact paths
cf98cd6
@yashaskn8
test(sarif): guard against credential leaks in artifact URIs
426e478
@yashaskn8
fix(sarif): disambiguate separator and hash-suffix rule IDs
ee5af8d
@yashaskn8
test(sarif): cover crafted rule ID collisions
e095437
@yashaskn8
fix(sarif): redact GitHub tokens embedded after underscores
08e69e9
@yashaskn8
test(sarif): cover embedded GitHub token leaks across export fields
e10053d
@yashaskn8
fix(sarif): redact embedded GitHub App tokens in exported fields
c2d3a42
@yashaskn8
test(sarif): cover embedded GitHub App token redaction and path omission
af60c15
@yashaskn8
fix(sarif): redact embedded non-GitHub credentials in export fields
4d0f4d1
@yashaskn8
test(sarif): cover embedded credentials and secret-bearing paths
9db621a
@yashaskn8
fix(sarif): redact structured secrets concatenated to identifiers
b64ed9b
@yashaskn8
test(sarif): cover secrets concatenated to metadata and artifact paths
ffdfc5f
@yashaskn8
fix(sarif): redact unquoted credential assignments in export fields
bca2f77
@yashaskn8
test(sarif): cover unquoted credentials in verified exports
7f81db1
@yashaskn8
fix(sarif): redact unquoted credentials containing punctuation
7cc8910
@yashaskn8 yashaskn8 mentioned this pull request Nov 1, 2026
Draft
@yashaskn8
fix(sarif): repair quoted-credential regex syntax blocking CI
89c89c8
@yashaskn8
test(sarif): cover colon-delimited quoted credential redaction
eb99ad3
@yashaskn8
fix(sarif): redact complete bearer values in credential assignments
0e692f6
@yashaskn8
test(sarif): guard against bearer credential suffix exposure
d0297b6
@yashaskn8
test(sarif): cover bearer tokens with RFC 6750 punctuation
48f4a20
@yashaskn8
fix(sarif): redact complete RFC 6750 bearer token values
cc7bfcb
@yashaskn8
test(sarif): cover HTTP Basic authorization credential leakage
96e8705
@yashaskn8
fix(sarif): redact HTTP Basic authorization credentials
e796171
@yashaskn8
fix(sarif): scope Basic redaction to authorization assignments
4493d13
@yashaskn8
test(sarif): cover Basic auth case variants without prose false posit…
e16a0e6 
…ives
@yashaskn8
test(sarif): cover short HTTP Basic authorization credentials
7491604
@yashaskn8
fix(sarif): redact short HTTP Basic credentials in exports
bd57b7a
@yashaskn8
fix(sarif): redact short explicit credential assignments
d05cfd1
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@yashaskn8