Understanding outputs

Last updated: Oct 27, 2026

Fluid Attacks' standalone scanners give different levels of detail in their output, for each format. This page explains each field of the standalone scanner output.

Fluid Attacks recommends the CLI snippets and CSV files. These formats give short and actionable information to understand and decrease the risks in your code, ports or inputs. If you want to share vulnerability data with external parties or use it in other security tools, the SARIF format is possibly better.

The SARIF (Static Analysis Results Interchange Format) output has more data and is for integration with other security tools and workflows. It contains much data, but it is not as easy to read as the other formats. Thus, this guide does not explain the SARIF output in detail.

Scanner default output

For all output formats, the CLI vulnerability report includes information about the scan context at the start and a summary at the end.

Scan context

[INFO] Official Documentation: https://docs.fluidattacks.com/find-fix/use-cli/overview/fluid-attacks-scanners
[INFO] Namespace: namespace
[INFO] Startup work dir is: /any/universe
[INFO] Moving work dir to: /any/universe
[INFO] Files to be tested: 1
[INFO] Analyzing path 1 of 1: /test/data/lib_root/f052/java_cipher_jmqi.java

The CLI output starts with this information:

• A link to the official standalone scanner documentation for full guidance and troubleshooting
• Important information about the current scan:
  • Namespace
  • Commit
  • Start directory
  • Working directory
  • Total number of paths to scan
• For each target file or endpoint, a line that shows the start of the scan

Scan summary

[INFO] Summary: 2 vulnerabilities were found in your targets.

When the scan completes, the CLI shows a summary that includes the total number of identified vulnerabilities.

Vulnerability report on the CLI

This is the standalone scanner output when it finds a vulnerability in the target of evaluation (ToE):

┌──────────────────────┬─────────────────────────────────────────────────────────────────────┐
│ Title                │ 052. Insecure encryption algorithm                                  │
├──────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ Description          │ Use of insecure encryption algorithm                                │
├──────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ Path                 │ unsafe_java_insecure_cipher_mode.java                               │
├──────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ CWE                  │ CWE-327                                                             │
├──────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ CVSSv4               │ CVSS:4.0/AV:A/AT:N/AC:H/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U │
├──────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ CVSSv4 Score         │ 0.6                                                                 │
├──────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ CVSSv4 Severity      │ Low                                                                 │
├──────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ Rule Reference       │ https://db.fluidattacks.com/rul/java_insecure_cipher_mode           │
├──────────────────────┼─────────────────────────────────────────────────────────────────────┤
│ Weaknesses Reference │ https://db.fluidattacks.com/wek/052                                 │
├────────────────────────────────────────────────────────────────────────────────────────────┤
│                                                                                            │
│     5 |         Cipher c = Cipher.getInstance("DES");//                                    │
│     6 |         Cipher c = Cipher.getInstance("DESede");//                                 │
│     7 |         Cipher c = Cipher.getInstance("RSA");//                                    │
│     8 |         Cipher c = Cipher.getInstance("AES/CBC/PKCS5Padding");//                   │
│     9 |         Cipher c = Cipher.getInstance("AES/ECB/NoPadding");//                      │
│  > 10 |         Cipher c = Cipher.getInstance("AES/ECB/PKCS5Padding");//                   │
│    11 |         Cipher c = Cipher.getInstance("DES/CBC/NoPadding");//                      │
│       ^ Col 0                                                                              │
│                                                                                            │
└────────────────────────────────────────────────────────────────────────────────────────────┘

How to read the report

The CLI shows each finding as a table with labels, and then the related code snippet. These are the table rows:

• Title: The name of the weakness that best matches the detected security issue, in Fluid Attacks' classification
• Description: A short description of the finding. It includes the vulnerability location in the format <namespace_of_execution>/<path_to_file>
• Path: The file path relative to the working directory
• CWE: The Common Weakness Enumeration identifier
• CVSSv4: The Common Vulnerability Scoring System (CVSS v4.0) vector string
• CVSSv4 Score: The numeric CVSS v4.0 score

• CVSSv4 Severity: The qualitative severity level (Low, Medium, High, or Critical)
• Rule Reference: A link to the documentation of the scanner rule
• Weaknesses Reference: A link to the weakness entry in Fluid Attacks' database. The entry includes the possible impact of an exploit of the vulnerability, an estimated remediation time, and fix recommendations

Below the metadata rows, the table has a last full-width row that contains the code snippet. A pointer (>) shows the line where the scanner found the problem.

Output in CSV

The CLI output gives a short summary. The CSV format gives a more detailed breakdown of the identified vulnerabilities. This breakdown includes more context about each finding and the analysis techniques.

An important feature of the CSV output is the method column. This column shows the detection method of each vulnerability. With this information, you can give accurate feedback and reports, especially when you think that a finding is a false positive.

When you submit a false positive report, include the name of the detection method. This helps Fluid Attacks' team to examine the error and to improve the accuracy of the scanner.

Output in SARIF

SARIF (Static Analysis Results Interchange Format) is a standard output format that many security analysis tools can read. These are some important benefits of SARIF:

• Standardization: Consistent representation of vulnerability data across different tools and platforms
• Rich data: Full details about the analysis process, including the checks and the reason for each finding
• Integration: Easy integration with many security information and event management (SIEM) systems, vulnerability management platforms, and other development tools
• Automation: Makes automated processing and analysis of vulnerability data easier for efficient remediation and reporting

The SARIF results include repository information in versionControlProvenance. These are some of the properties:

• repositoryUri: The URI of the scanned repository. If the repository is private, the URI can contain a token value
• branch: The scanned branch
• revisionId: The hash of the last commit to the scanned repository