SARIF Desk — paste the scanner report, get the triage

Paste one SARIF 2.1.0 static-analysis log - the machine-readable report CodeQL, Semgrep, Trivy, ESLint, Bandit, gitleaks and every other code scanner emits, including several merged into one file - and work it four ways in one sitting: call each finding a true positive, a false positive or needs-context; turn the confirmed findings into an ordered remediation plan; write a per-rule noise policy with the config fragments that implement it; and write the release-gate report. A real SARIF reader runs free in your browser first: it resolves each result's effective level through the specification's own precedence, resolves messages that live in the rule's messageStrings, resolves rules reached by index rather than id, runs twenty-nine deterministic checks over the log, and builds a stratified digest so a forty-megabyte report can be reasoned about without sending a prefix of it. Every reference the model quotes is checked back against your file before it is displayed, and a credential the report carries is redacted before anything leaves the page. Derived from @trailofbits/sarif-parsing, @ghostsecurity/ghost-validate, @wshobson/threat-mitigation-mapping and @mohitmishra786/static-analysis.

Every public app is built from a security-scanned skill and must pass a clean scan — skill and frontend — before it can be listed. Have a skill of your own? Turn it into an app — or read the step-by-step walkthrough.