{"id":49889290,"url":"https://github.com/santhsecurity/secfinding","last_synced_at":"2026-05-15T20:09:15.277Z","repository":{"id":346917634,"uuid":"1192195100","full_name":"santhsecurity/secfinding","owner":"santhsecurity","description":"Universal security finding types — Severity, Evidence, Finding, Reportable trait","archived":false,"fork":false,"pushed_at":"2026-04-25T23:04:41.000Z","size":53,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-04-26T01:12:20.203Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"https://santh.dev","language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/santhsecurity.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-03-26T01:28:38.000Z","updated_at":"2026-04-25T23:04:46.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/santhsecurity/secfinding","commit_stats":null,"previous_names":["santhsecurity/secfinding"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/santhsecurity/secfinding","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fsecfinding","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fsecfinding/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fsecfinding/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fsecfinding/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/santhsecurity","download_url":"https://codeload.github.com/santhsecurity/secfinding/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/santhsecurity%2Fsecfinding/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":33078189,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-15T20:05:40.333Z","status":"ssl_error","status_checked_at":"2026-05-15T20:05:38.672Z","response_time":103,"last_error":"SSL_read: unexpected eof while reading","robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":false,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-05-15T20:09:14.131Z","updated_at":"2026-05-15T20:09:15.269Z","avatar_url":"https://github.com/santhsecurity.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# secfinding\n\nA typed security finding. Instead of passing around JSON blobs with maybe-there-maybe-not fields, you get a struct with a builder, proper severity levels, evidence types, and a trait that lets any scanner's output type plug into the reporting pipeline.\n\n```rust\nuse secfinding::{Finding, Severity};\n\nlet f = Finding::builder(\"my-scanner\", \"https://example.com\", Severity::High)\n    .title(\"SQL Injection\")\n    .detail(\"User input reaches database query unsanitized\")\n    .cve(\"CVE-2024-12345\")\n    .tag(\"sqli\")\n    .build()\n    .unwrap();\n\nassert_eq!(f.title, \"SQL Injection\");\n```\n\n## The Reportable trait\n\nYou probably already have your own finding type. You don't need to switch to ours. Implement `Reportable` and your type works with `secreport` for SARIF/JSON/Markdown output:\n\n```rust\nuse secfinding::{Reportable, Severity};\n\nstruct MyFinding {\n    name: String,\n    sev: u8,\n}\n\nimpl Reportable for MyFinding {\n    fn scanner(\u0026self) -\u003e \u0026str { \"my-tool\" }\n    fn target(\u0026self) -\u003e \u0026str { \"target\" }\n    fn severity(\u0026self) -\u003e Severity { Severity::from(self.sev) }\n    fn title(\u0026self) -\u003e \u0026str { \u0026self.name }\n}\n```\n\nFour required methods. Everything else has defaults. Your type now gets free SARIF output, JSON serialization, Markdown reports.\n\n## Severity\n\nFive levels: Info, Low, Medium, High, Critical. Ordered, comparable, serializable. Parse from strings:\n\n```rust\nuse secfinding::Severity;\n\nlet s = Severity::from(\"high\");    // from \u0026str\nlet s = Severity::from(3u8);       // from number (0=Info, 4=Critical)\nlet s: Severity = \"critical\".into();\n```\n\n## Evidence\n\nTyped proof attached to findings. HTTP responses, code snippets, DNS records, banners:\n\n```rust\nuse secfinding::Evidence;\n\nlet ev = Evidence::HttpResponse {\n    status: 500,\n    headers: vec![],\n    body_excerpt: Some(\"SQL syntax error near\".into()),\n};\n```\n\n## Serialization\n\nSerialize findings directly to JSON for pipelines or report sinks:\n\n```rust\nuse secfinding::{Finding, Severity};\n\nlet finding = Finding::builder(\"my-scanner\", \"https://example.com\", Severity::Medium)\n    .title(\"Verbose error page\")\n    .build()\n    .unwrap();\n\nlet json = serde_json::to_string_pretty(\u0026finding).unwrap();\nassert!(json.contains(\"\\\"title\\\": \\\"Verbose error page\\\"\"));\n```\n\n## Filtering\n\nFilter findings by severity, scanner, tags:\n\n```rust\nuse secfinding::{filter, FindingFilter};\n\nlet config = FindingFilter {\n    min_severity: Some(Severity::Medium),\n    ..Default::default()\n};\nlet filtered = filter(\u0026findings, \u0026config);\n```\n\n## Contributing\n\nPull requests are welcome. There is no such thing as a perfect crate. If you find a bug, a better API, or just a rough edge, open a PR. We review quickly.\n\n## License\n\nMIT. Copyright 2026 CORUM COLLECTIVE LLC.\n\n[![crates.io](https://img.shields.io/crates/v/secfinding.svg)](https://crates.io/crates/secfinding)\n[![docs.rs](https://docs.rs/secfinding/badge.svg)](https://docs.rs/secfinding)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsanthsecurity%2Fsecfinding","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsanthsecurity%2Fsecfinding","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsanthsecurity%2Fsecfinding/lists"}