MAGDOX Code Security documentation
Reports and exports
What each output contains and which format to use for which audience.
Status: Preview
One run, several representations. The human-readable report is for release owners and auditors. Machine-readable exports feed code-scanning views, inventories and downstream tooling. All are produced from the same run, so they never disagree.
| Output | Format | Contains | Typical audience |
|---|---|---|---|
| Review report | PDF, HTML, Markdown | Summary, scope and coverage, findings grouped by severity with evidence and dispositions, inventories summary, run metadata | Release owners, auditors, customers |
| Findings export | SARIF 2.1 | Every finding with rule, level, locations, evidence properties and current disposition | Code-scanning views, ticketing, dashboards |
| Software inventory | CycloneDX, SPDX | Components, versions, relationships, licences where available, with stated inventory scope | Procurement, compliance, downstream SBOM tooling |
| Cryptographic inventory | CycloneDX CBOM | Algorithms, libraries and usage relationships found in code and configuration, with unknowns kept visible | Crypto governance, migration planning |
| Run manifest | JSON | Checks run, coverage, CLI and rule versions, timing | Reproducibility, audit trail |
Inventory scope
A source inventory, a resolved-dependency inventory and a built-artefact inventory describe different things. Every inventory export states which one it is in its metadata, and the report repeats it in plain language.
Disposition in exports
Reviewer decisions are included in SARIF and in the report so that a downstream consumer sees the same picture as the review UI. A finding marked as accepted risk is still present, with its reason, not silently removed.