MAGDOX Code Security documentation
Findings payload
The exact structure the CLI uploads, field by field, and how snippet policy changes it.
Status: Preview
The findings payload is the only data a scan sends to MAGDOX. It is versioned JSON, validated on arrival, and printable before sending with --show-payload. It never contains source files.
Example (snippets: off)
{
"schema": "magdox.findings/v1",
"run": {
"project": "example-service",
"commit": "9c1e4b7",
"branch": "main",
"cli_version": "0.1.0",
"rules_version": "2026.09.18-3",
"os": "linux/amd64",
"started_at": "2026-09-18T10:12:03Z",
"duration_ms": 41210
},
"coverage": {
"files_scanned": 1284,
"files_skipped": 12,
"languages": ["typescript", "python"],
"checks": { "sast": "complete", "dependencies": "complete", "secrets": "complete" }
},
"findings": [
{
"rule": "ts.sqli.string-concat",
"severity": "high",
"confidence": "medium",
"path": "src/auth/login.ts",
"lines": [42, 44],
"fingerprint": "sha256:5f0c...e19a",
"message": "Query built from request input without parameterisation",
"dataflow": ["src/routes/auth.ts:18", "src/auth/login.ts:42"]
}
],
"components": [
{ "purl": "pkg:npm/express@4.19.2", "licence": "MIT", "direct": true }
]
}Snippet policy
| Setting | Effect | Who sets it |
|---|---|---|
| off (default) | No code in the payload. Dashboard shows path and lines. | Organisation owner |
| redacted | Matched lines only, with string literals and detected secrets masked. | Organisation owner |
| full | Matched lines plus up to 3 lines of context either side, secrets masked. | Organisation owner |
Fingerprints
A fingerprint is a SHA-256 over the rule identifier, the file path and a normalised form of the matched code (whitespace and comments removed). It lets the dashboard recognise the same finding across runs and carry reviewer decisions forward, without the dashboard ever holding the code.
Detected secret values are never included in any payload under any setting. Only the rule, location and a fingerprint are sent.