praetorian-inc / noseyparker

Nosey Parker is a command-line program that finds secrets and sensitive information in textual data and Git history.
Apache License 2.0
1.66k stars 79 forks source link

Mark SARIF support as experimental #155

Closed bradlarsen closed 6 months ago

bradlarsen commented 6 months ago

SARIF reporting capabilities have been present in Nosey Parker for a while (#33). However, it is not an output format that has been tested very thoroughly. Its current implementation has some known deficiencies (#34).

Additionally, it seems like the SARIF format has troubles representing findings from tools like Nosey Parker, which look deep in Git history.

This change explicitly notes that SARIF format is "experimental" in Nosey Parker.