SARIF 2.1.0

SARIF — the Static Analysis Results Interchange Format — is an OASIS standard, currently at version 2.1.0. It is a JSON schema for representing the output of static-analysis and other code-scanning tools: the rules that ran, the results they produced, the exact file, line, and region each result points to, and the severity and metadata attached to it. SARIF is not a scanner and not a rule language; it is the common wire format that lets any producing tool hand its findings to any consuming tool without a bespoke integration.

Why it matters

SARIF is ubiquitous. GitHub code scanning, Azure DevOps, and a long list of SAST and security tools produce or ingest it, so a finding expressed in SARIF surfaces automatically in the dashboards, pull-request annotations, and CI gates your team already uses. For a post-quantum migration that matters because the hard part is not detecting one instance of vulnerable cryptography — it is tracking thousands of them across many repositories, deduplicating, and holding the line as code changes. SARIF turns crypto findings into standard, trackable results in the pipeline you already operate, instead of a spreadsheet that goes stale the day after it is written.

How PQC crypto-finding scanners use it

A scanner that locates quantum-vulnerable cryptography — uses of RSA or ECDH, weak or hardcoded primitives, deprecated protocol versions — can emit its findings as SARIF. Each result carries the rule that matched, the precise location, and a severity, so "find the vulnerable crypto" becomes the same kind of gated, deduplicated, reviewable signal as any other code-scanning result. In a full inventory workflow, SARIF sits alongside two complementary artifacts:

• The machine-readable cryptographic bill of materials — CBOM — which records *what* cryptography exists and where, as durable inventory rather than transient scan output.
• Exploitability signalling — OpenVEX — which states whether a given finding is actually reachable and affected, so triage can suppress the noise.
• The consolidated cryptographic inventory that these feeds roll up into — the single source of truth a migration plans against.

How quantakrypto helps

We treat SARIF as one input, not the answer. Our audit combines SARIF-emitting static scanners with runtime and network discovery, so the findings that land in your GitHub or Azure DevOps pipeline are reconciled against what your systems actually negotiate — and rolled into a single cryptographic inventory with a CBOM you can act on. From there, migration turns that inventory into a prioritized, exploitability-aware plan to replace quantum-vulnerable cryptography with post-quantum algorithms, and wires the crypto-scanning rules into CI so regressions are caught as results, not surprises.