Sonar fixing and showing suggestions for code that is vulnerable
Article

The complete guide to SARIF: Standardizing static analysis results

TL;DR overview

  • SARIF (Static Analysis Results Interchange Format) is an open standard that defines a common JSON-based format for static analysis tool output.
  • By standardizing how findings are reported, SARIF enables interoperability between different security and code quality tools and platforms.
  • Platforms natively consume SARIF files to display analysis results in pull requests.
  • SonarQube supports SARIF import and export, making it easier to integrate Sonar findings into broader DevSecOps toolchains.

Introduction to SARIF

SARIF has emerged as the industry-standard file format for exchanging static analysis tool results. Designed to facilitate interoperability, SARIF enables teams to share, aggregate, and interpret findings from various static code analysis tools in a consistent, machine-readable manner. As the adoption of DevSecOps and continuous integration/continuous deployment (CI/CD) practices grows, the need for robust vulnerability and code quality reporting formats like SARIF is more critical than ever.

SARIF ensures that security findings, code quality issues, and other static analysis results can be easily processed by pipelines, IDEs, automated quality gates, and compliance reporting tools. By using SARIF, organizations streamline their workflows, minimize integration friction, and improve collaboration across developer, security, and DevOps teams. This guide covers the essentials and advanced usage of SARIF, helping practitioners leverage its potential for scalable, automated, and trustworthy application security and code quality reporting.

What is SARIF?

SARIF, or Static Analysis Results Interchange Format, is a standardized, open JSON-based format designed to represent the output of static analysis tools such as linters, security scanners, and code quality tools. SARIF was developed by the OASIS consortium with contributions from major industry players to address challenges around tool interoperability, analysis automation, and vulnerability reporting.

The main goals of SARIF include making static analysis results portable, enabling toolchain integrations, and facilitating consolidated reporting across various programming languages and environments. With SARIF, different tools can report findings in a unified structure, making it easier for organizations to automate code reviews, centralize security reporting, and bridge gaps in application security posture management.

The importance of SARIF in application security and DevSecOps

Adopting SARIF is vital for organizations striving for mature software development lifecycles and robust application security programs. SARIF serves a central role in DevSecOps workflows by enabling real-time, automated collection and aggregation of code analysis results throughout the CI/CD pipeline. Through a standardized output, SARIF empowers teams to correlate vulnerabilities, enforce security controls, and consistently monitor code health across large and diverse codebases.

In addition, SARIF supports regulatory compliance and audit requirements by making evidence collection and reporting standardized and repeatable. Whether focused on GDPR, SOC 2, PCI DSS, or other frameworks, using SARIF enables transparent, defensible records of static analysis activities. This is especially pertinent as regulatory and standards bodies increasingly expect automated, auditable security measures to be integrated into software supply chains and application delivery processes.

What are the key features and benefits of SARIF? 

Advanced SAST: How to Secure AI-Generated Code

Standardization and interoperability

SARIF replaces a fragmented landscape of proprietary and incompatible static analysis output formats with a widely-recognized, vendor-neutral standard. This interoperability allows seamless consolidation of findings from static application security testing tools (SAST), linters, code quality analyzers, and more. It also enables sophisticated integrations with developer workflows, code review tools, and security dashboards.

Enhanced automation and scalability

By adopting SARIF, teams can automate static analysis feedback in CI/CD pipelines, trigger automated remediations, and support event-driven development practices. The machine-readable structure of SARIF makes it ideal for automated parsing, reporting, and tracking of trends over time. This is critical for organizations aiming to scale secure coding practices without adding manual review overhead.

Improved visibility and actionable insights

SARIF provides a rich, extensible schema for recording contextual information about findings, such as location in the source code, severity, remediation guidance, and CWE/CVE identifiers. This comprehensive data enables improved triage, prioritization, and remediation of issues by both developers and security practitioners. As such, SARIF supports deeper analytics, trend visualization, and effective collaboration.

Compliance and traceability

With SARIF's standardized structure, organizations can demonstrate coverage, remediation progress, and historic trends to auditors and external stakeholders. SARIF supports mapping results to compliance frameworks and enables automated generation of compliance reports, helping teams maintain robust traceability and evidence for regulatory reviews.

How SARIF works: File format and structure

SARIF uses a JSON schema to represent analysis outputs in a structured, extensible way. A SARIF file typically contains the following key components:

  • Version: Specifies the SARIF version; this supports forward compatibility.
  • Runs: An array describing each analysis run, which includes tool metadata, invocation details, files scanned, and results.
  • Results: Each result represents an issue, vulnerability, or recommendation, including its severity, location, rule identifier, descriptive message, and any suggested fixes.
  • Rules: Definitions for the checks or rules implemented by the tool; each rule includes metadata like name, category, severity, and remediation info.
  • Artifacts: Information about files that were scanned or referenced.

The SARIF format is detailed, supporting deep nesting of artifacts, tool-provided metadata, and explicit links between issues and remediation resources. Tools that support SARIF can produce, consume, and aggregate these files across workflows.

Comparing SARIF to other static analysis result formats

Historically, the lack of a common output standard for static analysis tools has led to siloed data formats, making integrations burdensome. Earlier approaches ranged from simple text logs to proprietary XML or HTML reports, each requiring custom parsing and manual aggregation.

SARIF addresses key deficiencies in these legacy formats by offering:

  • A unified, open JSON schema suitable for automation
  • Support for rich metadata, context, and severity classifications
  • Clear mappings to security standards (e.g., CWE, CVE, OWASP)
  • Easy extensibility for new fields as tool capabilities evolve

Compared to XML-based standards like JUnit reports or Checkstyle, SARIF is more expressive, easier to process programmatically, and better aligned with the needs of modern DevOps toolchains and security compliance automation.

SARIF adoption: Ecosystem and tool support

The SARIF standard is supported by many leading static analysis and application security tooling vendors, as well as open-source communities. Popular code scanners, linters, SAST platforms, and even build servers now offer built-in SARIF export and import capabilities.

Cloud and IDE integrations increasingly leverage SARIF for aggregating findings, triaging issues, and providing contextual security feedback during code review and merge request processes. The format’s widespread adoption and community-driven enhancements ensure that SARIF will remain central to secure development practices.

Best practices for implementing SARIF in your workflows

Enable SARIF export in your static analysis tools

Start by configuring your SAST, SCA, linter, or QA tools to generate SARIF output. Most modern products provide CLI, API, or build-step options for SARIF-formatted reports. When possible, automate this as part of your CI/CD pipelines to ensure continuous, up-to-date analysis.

Aggregate and normalize SARIF reports

When using multiple tools, aggregate SARIF files to provide a consolidated view of findings across languages and projects. Adopt tools or scripts that parse, normalize, and deduplicate SARIF data, enabling consistent analytics and streamlined remediation flows.

Integrate SARIF with developer and security dashboards

Feed SARIF output into issue trackers, dashboards, and security information platforms to enhance collaboration and incident response. Many DevOps tools offer SARIF plug-ins or built-in support for visualizing and managing static analysis results at scale.

Automate compliance using SARIF

Use SARIF metadata to map findings to compliance frameworks or internal risk scoring. Automate reporting for audits, regulatory reviews, or internal governance by generating compliance evidence from SARIF data.

Build custom workflows leveraging SARIF’s extensibility

Leverage SARIF’s schema extensibility to support custom fields, organization-specific tags, or advanced triage workflows. Advanced users can link SARIF outputs with code ownership, pull request gating, or automated messaging to foster a proactive secure coding culture.

Common SARIF use cases

  • Security vulnerability management in DevSecOps pipelines
  • Code quality enforcement for pull requests and merges
  • Cross-tool aggregation of static analysis and open source risk data
  • Automated compliance evidence collection and reporting
  • Developer feedback in IDEs and build systems
  • Security analytics, dashboarding, and remediation trending

Organizations adopting SARIF can expect accelerated CI/CD feedback, improved code quality, and a more unified approach to application security risk management.

SARIF and the future of scalable code quality

As secure development, AI-assisted code generation, and software supply chain security become mainstream, standardized formats like SARIF will underpin automated, evidence-driven quality and risk management. The extensible structure of SARIF ensures future-proofing, accommodating new types of static analysis, domain-specific rules, and evolving compliance needs.

SARIF’s alignment with modern developer workflows, including GitOps, shift-left security, and AI code review, positions it as a cornerstone technology for organizations striving for continuous improvement in code quality and security posture.

SonarQube and Sarif

SonarQube solves the core pain points of SARIF in static analysis and application security by seamlessly ingesting SARIF reports from third-party tools, centralizing vulnerability and code quality findings into a unified dashboard across Server, Cloud, and IDE environments. This powerful integration enables true interoperability among DevSecOps toolchains, automates CI/CD feedback, and streamlines compliance evidence collection for frameworks like SOC 2, PCI DSS, and GDPR. By mapping SARIF data to SonarQube’s advanced rule taxonomy, risk scoring, and Code Quality principles, organizations benefit from reduced manual aggregation, enhanced triage, intelligent deduplication, and actionable insights that bridge developer and security workflows. Developers gain immediate, contextual feedback through IDE plugins, supporting shift-left remediation and continuous improvement without disrupting pipelines. SonarQube’s robust SARIF support ensures audit-ready reporting, scalable governance, and future-ready security analytics, making it a cornerstone for effective vulnerability management, regulatory alignment, and software supply chain assurance in modern, high-velocity software development.

SARIF FAQs

How do you open or read a SARIF file?

A SARIF file is plain JSON text, so you can open it in any text or JSON editor, but a viewer built for SARIF is much easier to read. Common options include the SARIF Viewer extension for Visual Studio Code, which lists findings and jumps to the affected code, and the GitHub code scanning interface after upload, which shows results in a repository’s Security tab and in pull requests. Many scanning platforms can also import SARIF and display it in their dashboards.

How do you upload SARIF results to GitHub code scanning?

You generate a SARIF file with your scanner, then upload it with a GitHub Actions upload step, the GitHub API, or a supported command line tool. GitHub then shows alerts in the repository’s Security tab and annotates pull requests with findings tied to specific lines. Uploads must use a supported SARIF version and stay within size limits, so check GitHub’s documentation for the current requirements.

Which SARIF version should you use?

SARIF 2.1.0 is the current version most tools use, and it was approved as an OASIS standard in 2020. Files that declare version 2.1.0 are the most widely compatible with scanners, viewers, and code hosting platforms. Earlier drafts differ in structure, so consumers may reject them or require a conversion step. Check the “version” and “$schema” fields in a file to confirm which one it follows.

How do you merge multiple SARIF files?

A SARIF file holds an array of runs, so merging usually means collecting the runs from several files into one file’s runs array while keeping each tool’s metadata with its run. Make sure file paths are consistent, ideally relative to the repository root, so the same file does not appear under different paths. Fingerprints help remove duplicate results. Many platforms also accept several SARIF files uploaded separately, which avoids manual merging.

How does SARIF represent the path of a vulnerability through code?

SARIF represents the path of a vulnerability with code flows and thread flows, which are ordered lists of locations showing how data or execution moves from a source to a sink. This matters for taint-style vulnerabilities, where an issue only makes sense when you follow the path across several lines or files. Viewers can step through each location. Not every tool fills in code flows, so some results carry only a single location.

How does SARIF track the same issue across scans?

SARIF tracks issues across scans with fingerprints, which are stable identifiers computed from characteristics of a result such as its rule, file, and surrounding code. Because they do not depend on line numbers, an issue can still be recognized after code shifts. The baseline state property can also mark results as new, unchanged, updated, or absent compared with a previous run. Together these let teams focus on new issues in pull requests and measure progress over time.

Can SARIF carry suggested fixes?

Yes, SARIF has a fixes property where a tool can describe suggested changes, including the file, the region to replace, and the replacement text. IDEs and review tools can present these suggestions so a developer can apply them. Because the fixes are structured, they also give automation and AI coding agents a machine-readable way to receive remediation guidance. Support varies by tool, and a person should review any fix before it merges.

How do you validate a SARIF file?

You validate a SARIF file against the JSON schema published with the standard, using any JSON schema validator. Community tools, such as the multitool in Microsoft’s SARIF SDK, also check conformance rules beyond the schema. Running validation in your CI pipeline before uploading helps malformed files fail early. Common problems include missing required properties, invalid file paths, and an incorrect version value.

Can SARIF hold results other than code scanning findings?

Yes, although SARIF was designed for code scanning results, many tools use it for other findings, including dependency vulnerabilities, secrets detection, infrastructure as code checks, and container scans. Anything that can be expressed as a rule, a message, and a location can be represented. Results from runtime testing may fit less well because they often lack a source location. Support for these uses differs between the tools that consume SARIF.

What are the limitations of SARIF?

SARIF standardizes structure, not meaning. Tools may populate fields differently, define severity differently, or leave out optional data such as code flows, so findings from different tools still need normalization. Files can grow large for big codebases, and some consumers support only part of the specification. SARIF also does not decide whether a finding is a true positive, so it works best as a transport format, with triage still requiring context from the team.