What is SARIF, and when do you need it in a security scan?

SARIF, the Static Analysis Results Interchange Format, is a standard JSON format for the output of static analysis tools. You need it when you want findings from one or more scanners to appear in a shared dashboard or pull request view instead of a tool specific report.

What the standard says

The OASIS specification describes SARIF as a way to capture the range of data analysis tools produce, so tools can emit it directly or have output converted to it, and so the cost of aggregating results across tools is reduced. A file is UTF-8 JSON with a version and one or more runs.

The shape of a file

A minimal result looks like this:

{
  "version": "2.1.0",
  "runs": [{
    "tool": {"driver": {"name": "example-scanner"}},
    "results": [{
      "ruleId": "R001",
      "level": "error",
      "message": {"text": "Example finding"}
    }]
  }]
}

When you need it

• Uploading findings to a code scanning view in your source host.
• Combining several scanners into one list.
• Keeping a machine readable record of what was found on each build.

When you do not

If a single tool already reports in your ticketing system and nobody merges results, a native format is fine.

Practical limits

GitHub code scanning supports only SARIF 2.1.0. Per its documentation, a compressed file can be at most 10 MB, a file can hold 20 runs, and a run can hold 25,000 results, though only the top 5,000 by severity are included. If uploads fail, split by tool or filter low severity results.

Steps

1. Check that your scanner can write SARIF 2.1.0.
2. Write it to a file in CI.
3. Upload it with your platform's mechanism.
4. Keep the file as a build artifact.
5. Fail the build on exit code or on findings, since SARIF itself does not gate anything.

See also choosing between table, JSON and SARIF output.

How Safeguard helps

Safeguard offers dependency scanning and SBOMs, reachability analysis, and autonomous remediation with fix pull requests, which is off by default with every category on Manual. The free scan is the easiest first step.

Quick check

Sources

• OASIS, SARIF Version 2.1.0 specification (fetched 19 October 2026).
• GitHub Docs, SARIF support for code scanning (fetched 19 October 2026).

Last reviewed: 19 October 2026.