Reports and Data

PostQ writes focused artifacts instead of one opaque report. Together they preserve source-engine evidence, normalized scanner facts, review-oriented views, and interoperability formats.

Start with the audience, not the filename

Audience	Start with	Main question
Security lead	crypto-finding-assessment.json	What is the repository posture and review workload?
Developer	operation-groups.json	Which calls form a logical crypto operation and what should change?
Detailed reviewer	crypto-functions.json	What exact call and parameter evidence was found?
Scanner investigator	findings.json and raw OpenGrep results	How was the normalized finding produced?
Inventory system	cbom.json	Which crypto assets can be exchanged as a bill of materials?
Code-scanning platform	results.sarif	Which source-linked results can be imported?
Automation owner	manifest.json	Which scan and artifacts does this folder represent?

Common contract fields

Scanner JSON reports include schemaVersion, generatedAt, and scanSession. Use these fields to confirm that files belong to a compatible report contract and scan session before combining them.

License content, customer identity, repository fingerprints, and ledger data are not written into scanner reports.

Continue with the Report Artifact Reference and Interpret Results.