Free SARIF viewer and comparator.
Inspect SARIF results, filter the noise, and compare two reports. See added, removed, and retained records with level changes kept visible.
SARIF 2.1.0 · Local processing · No email required
Files and pasted JSON stay in this browser tab. No report content is uploaded or saved by this tool. Reset clears its working data. The demos contain synthetic documentation suggestions.
Report
Up to 5 MiB and 10,000 embedded result records per file.
Or paste SARIF JSON
Turn report review into a fair security pilot.
Use a shared scorecard for scope, evidence, review effort, and verified fixes. Keep sensitive reports inside your approved workflow.
Review the evidence behind each record.
01What is SARIF?
SARIF is the Static Analysis Results Interchange Format, an OASIS standard for exchanging analysis results. This free viewer reads embedded result records in SARIF 2.1.0 files, including multiple runs, rule ids, locations, levels, suppressions, and producer-reported baseline states.
02Are my SARIF files uploaded?
No. Selected files and pasted JSON are processed in this browser tab. The viewer does not upload report content, save it to browser storage, retrieve locations or external property files, or run a security scanner. Downloaded CSV and text reports are generated locally. Reset clears the working data.
03How are two SARIF reports compared?
Results are matched within the same tool and rule using common full fingerprints, then file-scoped partial fingerprints, then file location and message. Full fingerprints use the latest algorithm version available in both records. Duplicate occurrences are preserved. Matching records with different SARIF levels are marked as level changes; suppression and kind changes are shown separately.
04Does a removed record prove a vulnerability was fixed?
No. A record can disappear because the scan scope, configuration, tool version, source location, or fingerprint changed. Compare consistent scans and independently verify the fix. Results marked absent by the SARIF producer are shown in single-report view and excluded from current-record comparison.
05What do error, warning, note, and none mean?
These are the original SARIF levels, not universal vulnerability severities. If a failing result omits its level, the viewer uses its invocation override or rule default when available, otherwise warning. Non-failing results without an explicit level use none. Accepted suppressions, pending review, and missing suppression data are distinguished.
06What are the file limits?
Each report must be SARIF 2.1.0 JSON, no larger than 5 MiB, with at most 10,000 embedded result records. Oversized files are rejected without silently dropping records. This focused viewer is not a complete schema validator and does not load externally stored SARIF properties.
Format reference: OASIS SARIF 2.1.0 with approved errata.