Checklist & reporting

ASVS-lite checklist

Checklist is a guided pass over a curated subset of OWASP ASVS (Application Security Verification Standard) items, scoped down to what's practical to check by hand from a desktop tool. Each item is tracked per project — mark it as pass, fail, or not applicable as you work through it — so you end up with a record of what was deliberately verified, not just what an automated rule happened to flag.

Use it alongside the automated findings list, not instead of it: the rule pack catches pattern-matchable issues fast; the checklist covers the judgment calls (session handling, business logic, access-control design) that need a human to actually decide pass/fail.

Exporting findings

Once you have a findings list you're happy with, Findings offers three export formats:

• SARIF — the standard format for feeding results into GitHub code scanning, most CI security dashboards, and IDE integrations.
• JUnit — for CI pipelines that already parse JUnit XML for pass/fail gating; findings are grouped by severity.
• Git-friendly directory export — a plain directory of files, one per finding, meant to be committed alongside the code it's about so the history of what was found and fixed lives in version control.

All three export what's already in the project's local findings list — nothing is re-scanned or sent anywhere as part of exporting.