Call each finding real or not
One call per finding the digest carries: true positive, false positive or needs context, with the reasoning, the confidence and what evidence would settle it.
Nothing to paste? — a merged CodeQL and gitleaks log with a real injection, a rule id that resolves to nothing, a suppression with no justification, forty hits of one lint rule and a password sitting in a snippet. Or see a finished result with no run and no charge: , , or .
The browser reads it first
A hand-written SARIF 2.1.0 reader resolves every result the way the specification says to: the level from result.level, then the rule's default, then a fallback that depends on kind; the message from message.text or from the rule's messageStrings with its arguments filled in; the rule from ruleId, ruleIndex or an index into a tool extension. Twenty-nine checks then run over the log. That is free, needs no account, and nothing leaves the page.
A digest is sent, never a prefix
Real reports are megabytes and mostly one rule repeated. Every total the model gets is computed over all of your results; the findings it can quote are a worst-severity-first sample, capped per rule so a nine-hundred-hit lint rule cannot crowd out one critical injection, with every rule represented at least once. You can read the exact digest before you spend anything.
The answer is held to your file
Every check the browser raised comes back confirmed, cleared with a reason, or explicitly not assessed — and every reference the reply quotes is resolved back against your log. A reference that is not in your report is labelled fabricated rather than drawn as a finding. Disagreements are shown, not hidden.