Topics / Engineering practice
SARIF carries analyzer findings. It does not settle them.
Use the report to preserve where a tool found a potential problem, then connect that signal to a requirement, an investigation and a defensible outcome.
Keep the producer and the scope.
OASIS defines SARIF as a standard format for static-analysis results. Preserve tool and rule identity, source locations and the relevant revision when importing a report. A normalized format makes results easier to exchange; it does not make every result a confirmed defect.
Source: OASIS: SARIF 2.1.0. Scope and edition reviewed 3 October 2026.
Move from a signal to an evidence-backed disposition.
Illustrative example
A narrowing cast may lose a deadline.
An analyzer reports a cast in a timeout path. Determine whether reachable values exceed the target range, which timing promise would be violated and how to exercise the condition. If it is unreachable under an enforced input constraint, retain that rationale and its basis. If it reproduces, keep the witness with the issue.
- Map the finding to the relevant code and obligation.
- Distinguish reproduced, not reproduced and not affected.
- Attach a fixing change or a justified suppression.
- Revisit the disposition when its assumptions change.
Import the report into Proof’s signal workflow.
Proof can normalize supported SARIF input for a configured analyzer provider. Preview the import before writing records.
proof signals import --provider analyzer --input results.sarif --signal-format sarif --dry-runHere analyzer is an illustrative provider ID; use the provider configured for your project. Review the source locations and bindings. A cached signal is not a test execution or a verified closure.
Try it on your software
Bring a small queue of unresolved analyzer findings.
We can connect each signal to a requirement and the evidence needed to resolve it.