MAGDOX Code Security documentation

Results and delivery

Three ways to consume a run: the local report, the dashboard, or downloads through the CLI and CI.

Status: Preview

Every scan produces results in two places at once: a local report on the machine that ran it, and a run in the dashboard. Teams choose how to consume them. Developers read the local report or the pull-request annotations; security teams triage in the dashboard; regulated programmes archive the downloaded report.

1. Local report (always available)

Written to ./magdox-report/ after every scan, including --local-only scans. It contains the full findings with code context, because it never leaves the machine. Open index.html in a browser or read report.json.

2. Dashboard

  • Portfolio view: every repository, open findings by severity, trends, stale projects.
  • Run view: findings with severity, confidence, location and fingerprint; coverage; comparison with the baseline.
  • Triage: assign, record a decision with a reason, set accepted-risk expiry dates.
  • Inventories: SBOM and CBOM components across repositories, searchable by component and version.
  • Download buttons for the report and every export.

3. Download through the CLI

bashplaceholder
magdox report 8f3c-21 --format pdf  > review-8f3c-21.pdf
magdox report 8f3c-21 --format html > review-8f3c-21.html
magdox export 8f3c-21 --format sarif     > findings.sarif
magdox export 8f3c-21 --format cyclonedx > sbom.cdx.json
magdox export 8f3c-21 --format spdx      > sbom.spdx.json
magdox runs fetch 8f3c-21 --all --out ./review/   # report and every export

Reports without code

Dashboard reports are built from findings metadata, so by default they show file paths and line numbers, not code. If your organisation enables snippets, reports include them. The local report always includes code context.

Reading a finding

Reading a finding
FieldWhat it tells you
SeverityImpact class from the rule, adjustable by a reviewer with a recorded reason.
ConfidenceHow certain the check is, stated separately from severity.
LocationFile path, line range, component or configuration key.
FingerprintStable hash of rule, path and normalised code. Tracks the same finding across runs without storing code.
EvidenceMatched dependency and version, dataflow step list, configuration key. Code only if snippets are enabled.
DecisionOpen, accepted risk, false positive, fixed, not applicable; with reason, author and optional expiry.
Run a scanCLI reference