SARIF 2.1.0 is the OASIS interchange format for static analysis results.
The copy read as though it existed to feed GitHub code scanning, which
undersells it for anyone on another platform. GitHub Actions stays as the
worked example; the format is described as vendor-neutral.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
v2.2.0 (feat(worker): record severity in analysis mode, #413) made every
finding carry a severity, and min_severity now applies in both modes
(prompt-manager.ts applies the severity filter unconditionally; only
min_confidence is gated to analysis-only runs).
configuration.md still described the pre-2.2.0 model: min_severity as
exploit-only, findings carrying one rating or the other but never both,
and analysis runs producing no severity at all.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Lead the prerequisites with provider breadth and BYOK instead of Claude.
Add a Continuous Integration section after Quick Start with a working
GitHub Actions example, plus docs/ci-cd.md covering headless execution,
artifact paths, SARIF upload, merge-gating options, and runtime/cost
guidance.
Add three Key Capabilities bullets (machine-readable output, headless
CI/CD execution, BYOK/provider-agnostic) and a question-shaped Common
Questions section before Safety.
Regenerate llms-full.txt, which had drifted from docs/ai-providers.md.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
