Result format¶

The default format (-f sarif) is a SARIF 2.1.0 log. ts-sast does not invent its own findings format: SARIF is what TrustSource, GitHub code scanning, Azure DevOps, SonarQube and most IDEs read.

Runs¶

One run per scanned directory and backend. The run is the backend's own output, untouched: the DevSkim run keeps DevSkim as tool.driver, its rule metadata and its results. ts-sast adds two things:

• automationDetails.id - ts-sast/<module>
• properties["ts-sast"] - a header mirroring the header of a ts-scan dependency scan, so that findings can be correlated with the SBOM of the same module

{
  "$schema": "https://json.schemastore.org/sarif-2.1.0.json",
  "version": "2.1.0",
  "runs": [
    {
      "tool": { "driver": { "name": "devskim", "version": "1.0.90+fb2d676ce4", "rules": [ "..." ] } },
      "automationDetails": { "id": "ts-sast/OrderDesk" },
      "properties": {
        "ts-sast": {
          "module": "OrderDesk",
          "moduleId": "sast:OrderDesk",
          "source": "/work/orderdesk/OrderDesk",
          "backend": "devskim",
          "tag": "v2.4.17",
          "branch": "main",
          "tool": { "name": "ts-sast", "version": "0.1.0", "generatedAt": "2026-09-06T12:00:00+00:00" }
        }
      },
      "results": [
        {
          "ruleId": "TSVB6005",
          "level": "error",
          "message": { "text": "Hard-coded credential or secret" },
          "locations": [
            { "physicalLocation": { "artifactLocation": { "uri": "frmLogin.frm" }, "region": { "startLine": 58 } } }
          ]
        }
      ]
    }
  ]
}

File URIs in locations are relative to source because the backend is run with that directory as base path.

Levels and DevSkim severities¶

DevSkim maps its severities to SARIF levels: critical and important become error, moderate becomes warning, BestPractice and ManualReview become note. Filter on level in consumers, or on the DevSkim severity via --devskim:forward --severity,... at scan time.

Text (-f text)¶

-f text renders the same log for a terminal: per run the module, backend and finding count by level, a table by rule with its name, and the findings sorted by file and line. It is meant for a quick look and for CI logs, not for machine consumption.