Report File Reference

A complete scan produces the files below. Use the review reports for security decisions and the supporting files when investigating scan scope, troubleshooting, or integrating with other tools.

manifest.json

Identifies the scan, its inputs, generated files, and available warnings. Start here when you need to confirm which source was scanned or why a report folder is incomplete.

The inputs.skipFolders entry records excluded project-relative folders. Keep the manifest with retained reports so reviewers can identify the scan scope.

opengrep-results/opengrep-results.json

Contains the scan engine's original matches and diagnostic evidence. This file can help support investigate an unexpected result.

It does not contain the complete PostQ assessment. Use the function, group, and assessment reports for routine review. Raw evidence can include source details and should follow your report-retention and access policies.

findings.json

Contains supporting findings, including detected calls, cryptographic coding signals, and parameter evidence. Use it for detailed investigation or an integration that specifically needs these records.

Not every record represents a separate cryptographic call. Use crypto-functions.json when you need the inventory of reported calls.

crypto-functions.json

Describes individual cryptographic API calls, source locations, libraries, algorithms, parameters, confidence, and available security assessments.

Use it to investigate the exact call behind a finding. Some conclusions use context from a related operation group. See Crypto Functions.

operation-groups.json

Combines related calls into logical operations, such as cipher creation, configuration, and encryption. Groups include available parameter evidence, conflicts, assessment, and remediation guidance.

Use it to plan a change that affects several calls. See Operation Groups.

crypto-finding-assessment.json

Summarizes repository readiness, detected cryptography, risks, weaknesses, recommendations, and manual-review workload. Current reports also provide experimental migration-analysis summaries for the standalone viewer.

Start here to understand the scale and priorities of a review, then open the function and group reports for details. The Assessment overview combines the loaded reports; the five dimension details are supplied with functions and groups. See Assessment Overview.

cbom.json

Provides a cryptography bill of materials in CycloneDX 1.7 format. Use it to exchange detected cryptographic assets and their application relationships with compatible inventory or governance tools.

This file describes cryptography found by the scan; it is not a complete dependency SBOM. A receiving tool might not display all PostQ assessment details, so retain the original reports for investigation. See Sharing Reports.

results.sarif

Provides source-linked findings in SARIF 2.1.0 format for compatible code-scanning and security tools.

Configure the receiving tool's import or pipeline upload step. Use the original PostQ reports when you need complete grouped-operation context.

Report identification

PostQ JSON reports contain schemaVersion, generatedAt, and scanSession. Check these when building integrations or joining reports. CBOM and SARIF use the identification and metadata locations defined by their respective formats.

For automated processing, account for the report version and preserve unknown or unresolved values. A filtered viewer export represents only the selected rows.

Retention recommendation

Retain the complete output directory for scans used in audit, comparison, exceptions, or a migration baseline. If your policy requires selective retention, keep the manifest with each retained report and record the source revision and any removed evidence.