Documentation Reports and formats · Menu
Guardian reports: JSON, SARIF, GitLab and HTML
A report is a file Guardian writes where you tell it to. It is also how everyone who does not run the CLI — a QA lead, a security reviewer, a release manager — actually sees the result.
The five formats
All five appear in the bundled CLI’s help output forguardian scan --format.
| Format | Who it is for | Human or machine |
|---|---|---|
| Text | Whoever ran the command, reading the terminal | Human |
| HTML | A reviewer who will not open a pipeline log — opens in any browser with no tooling | Human |
| JSON | Your own scripts and tooling | Machine |
| SARIF | Code-scanning systems that ingest the standard directly | Machine |
| GitLab | GitLab-compatible automation | Machine |
Generating one
guardian scan . --format html --output guardian-report.html
guardian scan . --format json --output guardian-report.json
guardian scan . --format sarif --output guardian-report.sarif--output writes to the path you give it, relative to the working directory the command actually runs in. In CI that is not always the directory you assumed, so an absolute path is worth using while you are getting a pipeline working.
What a report contains
Two halves, and reading only the first is the usual mistake.
Findings
Severity, location, the evidence behind the finding, and a remediation step. Severity describes the finding, not the release.
Coverage
What completed, what was incomplete and what did not run. A check that could not run is reported, never counted as a pass.
The decision
Findings plus coverage plus your configured policy — with the reasons attached, so it can be handed to someone who was not there.
The example report shows this structure filled with sample data.
Sharing and retention
A report describes your project. It can contain file paths, module names and configuration detail — which is exactly what makes it useful, and exactly why it deserves the same care as a build log.
- Read a report before sending it outside your team.
- Share the specific findings a reviewer needs rather than forwarding the whole file.
- Store reports under your organisation’s own retention policy. Guardian writes the file and then has nothing further to do with it.
- Nothing is uploaded to produce a report, and nothing is sent anywhere afterwards unless you send it.