Understanding Scan Results

Scan results are saved to results.json by default.

Results Structure

{
  "file_path": [
    {
      "id": "string",
      "server": { /* server info */ }
    },

    {
      "id": "string",
      "lines": "string",
      "oss_lines": "string",
      "matched": "string",
      "file_hash": "string",
      "source_hash": "string",
      "file_url": "string",
      "quality": [
        {
          "score": "string",
          "source": "string"
        }
      ],
      "cryptography": [],
      "purl": ["string"],
      "vendor": "string",
      "component": "string",
      "version": "string",
      "latest": "string",
      "url": "string",
      "status": "string",
      "download_url": "string",
      "release_date": "string",
      "file": "string",
      "url_hash": "string",
      "licenses": [
        {
          "name": "string",
          "patent_hints": "string",
          "copyleft": "string",
          "checklist_url": "string",
          "osadl_updated": "string",
          "incompatible_with": "string",
          "source": "string",
          "url": "string"
        }
      ],
      "health": {
        "creation_date": "string",
        "last_update": "string",
        "last_push": "string",
        "stars": number,
        "issues": number,
        "forks": number
      },
      "provenance": "string",
      "url_stats": {
        "total_files": number,
        "indexed_files": number,
        "source_files": number,
        "ignored_files": number,
        "package_size": number
      },
      "dependencies": [],
      "copyrights": [
        {
          "name": "string",
          "source": "string"
        }
      ],
      "vulnerabilities": [
        {
          "ID": "string",
          "CVE": "string",
          "severity": "string",
          "reported": "string",
          "introduced": "string",
          "patched": "string",
          "summary": "string",
          "source": "string"
        }
      ],
      "server": {
        "version": "string",
        "kb_version": {
          "monthly": "string",
          "daily": "string"
        },
        "hostname": "string",
        "flags": "string",
        "elapsed": "string"
      }
    }
  ]
}

Key Fields

Match Information

• component - Name of detected component
• matched - Similarity percentage (e.g., “95%”)
• lines - Line range in your file
• oss_lines - Line range in the original component
• id - Match type (“snippet”, “file”, or “none”)
• status - Detection status (“pending”, “identified”, etc.)

Component Details

• vendor - Component maintainer
• version - Detected version
• latest - Most recent available version
• url - Repository URL
• purl - Package URL identifiers
• release_date - Version release date

License Information

• name - License identifier (e.g., “MIT”, “GPL-2.0-only”)
• copyleft - Whether derivative works must use same license
• patent_hints - Whether license contains patent clauses
• source - Where license was detected (e.g., “component_declared”, “file_spdx_tag”)
• incompatible_with - Conflicting licenses