The project page takes the size from cloc's sum and names the three to
five largest languages, leaving out prose and data files such as Markdown,
text, CSV and JSON, and anything under 1% of the code beyond the third.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A result's own security-severity score is banded like CVSS; without one,
the finding is graded by a hand-built CWE table; failing that, by its
SARIF level, one band lower than before. The scanners' levels said more
about the tool than about the risk: a container running as root came out
Critical and a hard-coded password Medium.
The summariser only reads security-severity off the rule, and Lynkeus
scores each result, so the runs are summarised here to keep that score.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pipeline leaves repository_version empty, but tags the Dependency-Track
upload with the commit it scanned. Use that when no version is stated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Neither is recorded in the artifacts: the metadata's repository_name is
empty and nothing names a manufacturer. --project wins over the metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The report now covers every finding from all tools, so "SAST/SCA Report"
undersold it. The report and artifact ids were never filled in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
alexanderandClaude Opus 5.5