https://github.com/santhsecurity/secfinding
Universal security finding types — Severity, Evidence, Finding, Reportable trait
https://github.com/santhsecurity/secfinding
Last synced: 2 months ago
JSON representation
Universal security finding types — Severity, Evidence, Finding, Reportable trait
- Host: GitHub
- URL: https://github.com/santhsecurity/secfinding
- Owner: santhsecurity
- License: mit
- Created: 2026-03-26T01:28:38.000Z (4 months ago)
- Default Branch: main
- Last Pushed: 2026-04-25T23:04:41.000Z (3 months ago)
- Last Synced: 2026-04-26T01:12:20.203Z (3 months ago)
- Language: Rust
- Homepage: https://santh.dev
- Size: 51.8 KB
- Stars: 0
- Watchers: 0
- Forks: 0
- Open Issues: 0
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# secfinding
A typed security finding. Instead of passing around JSON blobs with maybe-there-maybe-not fields, you get a struct with a builder, proper severity levels, evidence types, and a trait that lets any scanner's output type plug into the reporting pipeline.
```rust
use secfinding::{Finding, Severity};
let f = Finding::builder("my-scanner", "https://example.com", Severity::High)
.title("SQL Injection")
.detail("User input reaches database query unsanitized")
.cve("CVE-2024-12345")
.tag("sqli")
.build()
.unwrap();
assert_eq!(f.title, "SQL Injection");
```
## The Reportable trait
You probably already have your own finding type. You don't need to switch to ours. Implement `Reportable` and your type works with `secreport` for SARIF/JSON/Markdown output:
```rust
use secfinding::{Reportable, Severity};
struct MyFinding {
name: String,
sev: u8,
}
impl Reportable for MyFinding {
fn scanner(&self) -> &str { "my-tool" }
fn target(&self) -> &str { "target" }
fn severity(&self) -> Severity { Severity::from(self.sev) }
fn title(&self) -> &str { &self.name }
}
```
Four required methods. Everything else has defaults. Your type now gets free SARIF output, JSON serialization, Markdown reports.
## Severity
Five levels: Info, Low, Medium, High, Critical. Ordered, comparable, serializable. Parse from strings:
```rust
use secfinding::Severity;
let s = Severity::from("high"); // from &str
let s = Severity::from(3u8); // from number (0=Info, 4=Critical)
let s: Severity = "critical".into();
```
## Evidence
Typed proof attached to findings. HTTP responses, code snippets, DNS records, banners:
```rust
use secfinding::Evidence;
let ev = Evidence::HttpResponse {
status: 500,
headers: vec![],
body_excerpt: Some("SQL syntax error near".into()),
};
```
## Serialization
Serialize findings directly to JSON for pipelines or report sinks:
```rust
use secfinding::{Finding, Severity};
let finding = Finding::builder("my-scanner", "https://example.com", Severity::Medium)
.title("Verbose error page")
.build()
.unwrap();
let json = serde_json::to_string_pretty(&finding).unwrap();
assert!(json.contains("\"title\": \"Verbose error page\""));
```
## Filtering
Filter findings by severity, scanner, tags:
```rust
use secfinding::{filter, FindingFilter};
let config = FindingFilter {
min_severity: Some(Severity::Medium),
..Default::default()
};
let filtered = filter(&findings, &config);
```
## Contributing
Pull requests are welcome. There is no such thing as a perfect crate. If you find a bug, a better API, or just a rough edge, open a PR. We review quickly.
## License
MIT. Copyright 2026 CORUM COLLECTIVE LLC.
[](https://crates.io/crates/secfinding)
[](https://docs.rs/secfinding)