Back to All Tools
OASIS SARIF v2.1.0 Standard

SARIF Security Report Visualizer & Inspector

Ingest and inspect Static Analysis Results Interchange Format (SARIF) reports from CodeQL, Semgrep, Trivy, Snyk, and ESLint. Filter findings, inspect code snippet contexts, trace taint dataflow execution paths, and export executive markdown audits.

Samples:
Total Findings

4

CodeQL 2.17.3

Errors (High)

2

Requires Urgent Remediation

Warnings

1

Security Best Practice

Notes / Info

1

Informational / Hygiene

Artifacts

4

Affected Source Files

Rules

4

Active Rule Definitions

Group:

Vulnerability Findings (4 of 4)

Tool: CodeQL v2.17.3
CRITICAL / ERRORjs/sql-injection(SqlInjection)

User-provided request query parameter 'username' flows directly into raw SQL string concatenation in db.query().

app/api/auth/login/route.ts:42
#security#external/cwe/cwe-089#OWASP-A03:2021CWE / Documentation
Rule Explanation:

Building a SQL query from untrusted user input without sanitization makes the database vulnerable to SQL injection attacks.

Source Code Context (app/api/auth/login/route.ts:42:18):
const user = await db.query(`SELECT * FROM users WHERE username = '${req.query.username}' AND pass = '${req.query.password}'`);
CRITICAL / ERRORjs/xss-through-dom(DomBasedXss)

Unsanitized user comment text assigned to element.innerHTML allows stored Cross-Site Scripting.

components/blog/CommentBox.tsx:88
WARNINGjs/hardcoded-credentials(HardcodedSecret)

High-entropy JWT signing key hardcoded in source repository instead of environment variable.

lib/jwt/config.ts:12
NOTE / INFOjs/insecure-randomness(InsecureRandomness)

Password reset token generation uses Math.random(). Use crypto.randomUUID() or crypto.getRandomValues().

lib/auth/token-generator.ts:19

Multi-Engine Compatibility

Standardized parser adhering to the official OASIS SARIF v2.1.0 JSON schema, fully compatible with GitHub Advanced Security scans.

Taint Step & Context Flow

Visualize multi-step data flow execution traces from untrusted user-controlled sources down to vulnerable execution sinks.

100% Client-Side Privacy

Your sensitive source code snippets, internal file paths, and security vulnerability logs never leave your browser.