How do I open a SARIF file?

Drop the .sarif or .sarif.json file onto this page or paste its contents. It becomes a findings report in your browser: totals by severity, every rule that fired with its description and docs link, each finding's file, line, message and code snippet, and the files with the most findings. Nothing is uploaded.

Which tools produce SARIF?

CodeQL, Semgrep, Trivy, Grype, Checkov, KICS, tfsec, Snyk, Bandit, ESLint (with @microsoft/eslint-formatter-sarif), gosec, Gitleaks, Brakeman, Bearer, Hadolint and most scanners that support GitHub code scanning — usually behind a --format sarif or --sarif-output flag. Several runs in one file, one per tool, are read together.

How is severity decided?

The same way GitHub code scanning does it. If the rule has a security-severity score (0–10), the finding is Critical (9.0+), High (7.0–8.9), Medium (4.0–6.9) or Low. Otherwise the SARIF level stands: Error, Warning or Note, taken from the result or, if absent, the rule's defaultConfiguration.

What happens to suppressed findings?

Results with a suppression (an inline // nosemgrep, a CodeQL alert dismissed in the baseline, a justification in the file) are counted in the summary but kept out of the findings list, as are results whose kind is pass or notApplicable. A suppression with status rejected counts as open.

Why does a CodeQL message say “user-provided value” without a link?

CodeQL messages embed related locations as [text](1). In SARIF those point at the source of the tainted data elsewhere in the file; the viewer keeps the text and drops the reference so the message reads as a sentence.

Can I post the findings on a pull request?

Yes. “Copy Markdown” gives a GitHub-flavored table — severity, rule, file:line and message for each finding — that pastes into a PR comment or appends to $GITHUB_STEP_SUMMARY. For the snippets and rule descriptions, publish the report and put the link in the comment.

No. The SARIF is parsed and the report is built in your browser. It only leaves your machine if you click “Get a shareable link” and publish the report to Comma — and then you choose who can open it.

Free tool

SARIF, as findings people can read.

Drop the .sarif file CodeQL, Semgrep, Trivy or Checkov wrote. Get severity counts, every rule that fired and each finding’s file, line and snippet — then copy a Markdown table for the pull request or send the whole report to someone who can’t open your code scanning tab.

results.sarif

{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": {
        "driver": {
          "name": "CodeQL",
          "semanticVersion": "2.19.3",
          "rules": [
            {
              "id": "js/sql-injection",
              "name": "js/sql-injection",
              "shortDescription": {
                "text": "Database query built from user-controlled sources"
              },
              "helpUri": "https://codeql.github.com/codeql-query-help/javascript/js-sql-injection/",
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "tags": [
                  "security",
                  "external/cwe/cwe-089"
                ],
                "security-severity": "8.8"
              }
            },
            {
              "id": "js/reflected-xss",
              "name": "js/reflected-xss",
              "shortDescription": {
                "text": "Reflected cross-site scripting"
              },
              "helpUri": "https://codeql.github.com/codeql-query-help/javascript/js-reflected-xss/",
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "tags": [
                  "security",
                  "external/cwe/cwe-079"
                ],
                "security-severity": "6.1"
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "js/sql-injection",
          "ruleIndex": 0,
          "message": {
            "text": "This query string depends on a [user-provided value](1)."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/routes/orders.js"
                },
                "region": {
                  "startLine": 41,
                  "startColumn": 22,
                  "snippet": {
                    "text": "  const rows = await db.query(`SELECT * FROM orders WHERE id = ${req.query.id}`);"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "js/sql-injection",
          "ruleIndex": 0,
          "message": {
            "text": "This query string depends on a [user-provided value](1)."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/routes/search.js"
                },
                "region": {
                  "startLine": 17,
                  "startColumn": 9
                }
              }
            }
          ]
        },
        {
          "ruleId": "js/reflected-xss",
          "ruleIndex": 1,
          "message": {
            "text": "Cross-site scripting vulnerability due to a [user-provided value](1)."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/routes/search.js"
                },
                "region": {
                  "startLine": 29,
                  "snippet": {
                    "text": "  res.send(`<h1>Results for ${req.query.q}</h1>`);"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "js/reflected-xss",
          "ruleIndex": 1,
          "message": {
            "text": "Cross-site scripting vulnerability due to a user-provided value."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "test/fixtures/echo.js"
                },
                "region": {
                  "startLine": 6
                }
              }
            }
          ],
          "suppressions": [
            {
              "kind": "inSource",
              "justification": "test fixture"
            }
          ]
        }
      ]
    },
    {
      "tool": {
        "driver": {
          "name": "Semgrep OSS",
          "version": "1.97.0",
          "rules": [
            {
              "id": "generic.secrets.security.detected-stripe-api-key",
              "name": "generic.secrets.security.detected-stripe-api-key",
              "shortDescription": {
                "text": "Stripe API key committed to the repository"
              },
              "helpUri": "https://semgrep.dev/r/generic.secrets.security.detected-stripe-api-key",
              "defaultConfiguration": {
                "level": "error"
              },
              "properties": {
                "tags": [
                  "security",
                  "CWE-798: Use of Hard-coded Credentials"
                ]
              }
            },
            {
              "id": "javascript.express.security.audit.express-cookie-session-no-httponly",
              "name": "express-cookie-session-no-httponly",
              "shortDescription": {
                "text": "Session cookie set without httpOnly — readable from page scripts"
              },
              "defaultConfiguration": {
                "level": "warning"
              },
              "properties": {
                "tags": [
                  "security",
                  "CWE-1004"
                ]
              }
            }
          ]
        }
      },
      "results": [
        {
          "ruleId": "generic.secrets.security.detected-stripe-api-key",
          "level": "error",
          "message": {
            "text": "Stripe API key detected in {0}",
            "arguments": [
              "config/payments.js"
            ]
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "config/payments.js"
                },
                "region": {
                  "startLine": 3,
                  "snippet": {
                    "text": "const STRIPE_KEY = \"sk_live_••••••••••••••••\";"
                  }
                }
              }
            }
          ]
        },
        {
          "ruleId": "javascript.express.security.audit.express-cookie-session-no-httponly",
          "level": "warning",
          "message": {
            "text": "Session middleware sets cookies without httpOnly: true."
          },
          "locations": [
            {
              "physicalLocation": {
                "artifactLocation": {
                  "uri": "src/app.js"
                },
                "region": {
                  "startLine": 22,
                  "snippet": {
                    "text": "app.use(session({ secret, cookie: { secure: true } }));"
                  }
                }
              }
            }
          ]
        }
      ]
    }
  ]
}

6.8 KBSARIF 2.1.0 · CodeQL, Semgrep OSS

Code scanning results.html

5 open findings (2 high, 1 error, 1 medium, 1 warning) · 4 rules · 1 suppressed

Publishes this report on Comma: one URL for the scan that opens without repo access, restricted to named people or your company’s email domain if you like, comments pinned to the exact finding, and the next scan kept as a revision you can diff. Free, no card.

How the file is read

Rules are looked up the way the spec allows them to be referenced — rule.index with its toolComponent, ruleIndex, or ruleId — in tool.driver.rules and in tool.extensions, where CodeQL keeps its query packs.
Severity uses the rule’s security-severity score when there is one, as GitHub does, and the SARIF level otherwise.
Messages have their {0} placeholders filled from arguments, a message.id resolved through the rule’s messageStrings, and CodeQL’s [text](1) links reduced to text.
Locations come from the first physicalLocation — the artifactLocation URI (or the artifacts entry it indexes), start line, column and region snippet.
Suppressed results and results with a kind other than fail are counted, not listed.

Getting the SARIF

Tool	Writes SARIF with
CodeQL	codeql database analyze db --format=sarif-latest --output=results.sarif
Semgrep	semgrep scan --sarif --output=results.sarif
Trivy	trivy fs --format sarif --output results.sarif .
Checkov	checkov -d . --output sarif --output-file-path .
Snyk	snyk code test --sarif-file-output=results.sarif
Bandit	bandit -r . -f sarif -o results.sarif
ESLint	eslint . -f @microsoft/eslint-formatter-sarif -o results.sarif
gosec	gosec -fmt sarif -out results.sarif ./...
Gitleaks	gitleaks detect --report-format sarif --report-path results.sarif
GitHub	Security → Code scanning alerts are exported per analysis via the REST API (Accept: application/sarif+json)

When the scan has to leave the repository

Code scanning shows alerts one at a time to people with access to the repository. The auditor collecting evidence, the client who asked for the pentest, the vendor who owns the vulnerable module and the security lead reviewing on a phone usually have none of that — and a SARIF attachment is unreadable to all of them. Published to Comma, the report is one document they can open, read end to end and comment on finding by finding, and an agent can publish it from the pipeline after every scan. More on the format in what SARIF is, and on sharing a scanner’s own output in how to share CodeQL results and how to share a Semgrep report.

Questions

How do I open a SARIF file?: Drop the .sarif or .sarif.json file onto this page or paste its contents. It becomes a findings report in your browser: totals by severity, every rule that fired with its description and docs link, each finding's file, line, message and code snippet, and the files with the most findings. Nothing is uploaded.
Which tools produce SARIF?: CodeQL, Semgrep, Trivy, Grype, Checkov, KICS, tfsec, Snyk, Bandit, ESLint (with @microsoft/eslint-formatter-sarif), gosec, Gitleaks, Brakeman, Bearer, Hadolint and most scanners that support GitHub code scanning — usually behind a --format sarif or --sarif-output flag. Several runs in one file, one per tool, are read together.
How is severity decided?: The same way GitHub code scanning does it. If the rule has a security-severity score (0–10), the finding is Critical (9.0+), High (7.0–8.9), Medium (4.0–6.9) or Low. Otherwise the SARIF level stands: Error, Warning or Note, taken from the result or, if absent, the rule's defaultConfiguration.
What happens to suppressed findings?: Results with a suppression (an inline // nosemgrep, a CodeQL alert dismissed in the baseline, a justification in the file) are counted in the summary but kept out of the findings list, as are results whose kind is pass or notApplicable. A suppression with status rejected counts as open.
Why does a CodeQL message say “user-provided value” without a link?: CodeQL messages embed related locations as [text](1). In SARIF those point at the source of the tainted data elsewhere in the file; the viewer keeps the text and drops the reference so the message reads as a sentence.
Can I post the findings on a pull request?: Yes. “Copy Markdown” gives a GitHub-flavored table — severity, rule, file:line and message for each finding — that pastes into a PR comment or appends to $GITHUB_STEP_SUMMARY. For the snippets and rule descriptions, publish the report and put the link in the comment.
Is my scan uploaded?: No. The SARIF is parsed and the report is built in your browser. It only leaves your machine if you click “Get a shareable link” and publish the report to Comma — and then you choose who can open it.