A result's own security-severity score is banded like CVSS; without one,
the finding is graded by a hand-built CWE table; failing that, by its
SARIF level, one band lower than before. The scanners' levels said more
about the tool than about the risk: a container running as root came out
Critical and a hard-coded password Medium.
The summariser only reads security-severity off the rule, and Lynkeus
scores each result, so the runs are summarised here to keep that score.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The pipeline leaves repository_version empty, but tags the Dependency-Track
upload with the commit it scanned. Use that when no version is stated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Neither is recorded in the artifacts: the metadata's repository_name is
empty and nothing names a manufacturer. --project wins over the metadata.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The report now covers every finding from all tools, so "SAST/SCA Report"
undersold it. The report and artifact ids were never filled in.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
alexanderandClaude Opus 5.5