CalvinBackup/shannon
1
0
Fork 0
mirror of https://github.com/KeygraphHQ/shannon.git synced 2026-08-15 07:50:20 +02:00
Code Issues Packages Projects Releases Wiki Activity

docs: correct rating semantics stale since v2.2.0

Browse Source 
v2.2.0 (feat(worker): record severity in analysis mode, #413) made every
finding carry a severity, and min_severity now applies in both modes
(prompt-manager.ts applies the severity filter unconditionally; only
min_confidence is gated to analysis-only runs).

configuration.md still described the pre-2.2.0 model: min_severity as
exploit-only, findings carrying one rating or the other but never both,
and analysis runs producing no severity at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
george-keygraph
2026-08-13 15:27:19 -07:00
co-authored by Claude Opus 5
parent da3ea1570f
commit e7edef49d7
3 changed files with 8 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/ci-cd.md
+1 -1
View File
@@ -62,7 +62,7 @@ report:
sarif: "true"
```
SARIF requires an exploitative run, which is the default. An analysis-only run (`exploit: "false"`) rates findings by confidence rather than severity and produces no SARIF log.
SARIF requires an exploitative run, which is the default. Shannon does not write a SARIF log for analysis-only runs (`exploit: "false"`).
Each finding becomes one SARIF result, filed under a rule per vulnerability class (`shannon/injection`, `shannon/xss`, `shannon/auth`, `shannon/authz`, `shannon/ssrf`) and tagged with its OWASP Top Ten 2025 category. Severity maps onto SARIF's three levels: `critical` and `high` become `error`, `medium` becomes `warning`, everything else becomes `note`.