Report schema and versioning

Top-level result

• url or target and the completion date.
• score, grade, total penalty, and exclusion detail where available.
• engine_version, ruleset_version, and scoring_version.
• Selected modules, coverage, errors, and metrics when the surface provides them.
• The findings array.

Finding fields

• rule_id and fingerprint.
• severity, classification, and confidence.
• module, title, detail, evidence, and recommendation.
• Source location when mapping is available.
• Engine and ruleset versions attached by the normalized result model.

Minimal JSON shape

1{
2  "url": "project",
3  "date": "2026-07-16T10:00:00.000Z",
4  "score": 92,
5  "grade": "A",
6  "engine_version": "3.x",
7  "ruleset_version": "2026.x",
8  "scoring_version": "3.x",
9  "findings": []
10}

Track versions independently

• Engine version identifies the VICE implementation that ran the checks.
• Ruleset version identifies detection policy and rule behavior.
• Scoring version identifies penalties, exclusions, and grade behavior.
• CLI package version identifies the installed vice-security release.
• GitHub Action version identifies the public Action release used by the workflow.

Compare with context

A score delta after a ruleset or scoring update can reflect better detection rather than an application change. Keep version, selected module, baseline, and coverage metadata beside every stored result.