schemas/findings.schema.json

18.7 KB · Oct 2, 2026 · 00:04 UTC
{
  "$schema": "https://json-schema.org/draft/2020-12/schema",
  "$id": "https://openai.com/codex-security/schemas/findings.schema.json",
  "title": "Codex Security findings",
  "type": "object",
  "required": [
    "documentType",
    "schemaVersion",
    "scanId",
    "findings"
  ],
  "properties": {
    "documentType": {
      "const": "codex-security.findings"
    },
    "schemaVersion": {
      "const": "1.0"
    },
    "scanId": {
      "type": "string",
      "minLength": 1
    },
    "findings": {
      "type": "array",
      "items": {
        "type": "object",
        "required": [
          "findingId",
          "occurrenceId",
          "ruleId",
          "identity",
          "fingerprints",
          "title",
          "summary",
          "severity",
          "confidence",
          "taxonomy",
          "locations",
          "remediation",
          "provenance"
        ],
        "properties": {
          "findingId": {
            "type": "string",
            "pattern": "^csf_[a-f0-9]{24}$"
          },
          "occurrenceId": {
            "type": "string",
            "pattern": "^occ_[a-f0-9]{24}$"
          },
          "ruleId": {
            "type": "string",
            "pattern": "^[a-z0-9][a-z0-9._/-]*$"
          },
          "identity": {
            "type": "object",
            "required": [
              "anchor"
            ],
            "properties": {
              "anchor": {
                "type": "string",
                "pattern": "^[a-z0-9][a-z0-9._/-]*$"
              },
              "instance": {
                "type": "string",
                "pattern": "^[a-z0-9][a-z0-9._/-]*$"
              }
            }
          },
          "fingerprints": {
            "type": "object",
            "required": [
              "algorithm",
              "primary"
            ],
            "properties": {
              "algorithm": {
                "const": "codex-security/v1"
              },
              "primary": {
                "type": "string",
                "pattern": "^codex-security/v1:sha256:[a-f0-9]{64}$"
              }
            }
          },
          "title": {
            "type": "string",
            "minLength": 1
          },
          "summary": {
            "type": "string",
            "minLength": 1
          },
          "severity": {
            "type": "object",
            "required": [
              "level"
            ],
            "properties": {
              "level": {
                "enum": [
                  "critical",
                  "high",
                  "medium",
                  "low",
                  "informational"
                ]
              },
              "score": {
                "type": "number",
                "minimum": 0,
                "maximum": 10
              },
              "scoringSystem": {
                "type": "string",
                "minLength": 1
              },
              "vector": {
                "type": "string",
                "minLength": 1
              },
              "rationale": {
                "type": "string",
                "minLength": 1
              },
              "changeConditions": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "confidence": {
            "type": "object",
            "required": [
              "level",
              "rationale"
            ],
            "properties": {
              "level": {
                "enum": [
                  "high",
                  "medium",
                  "low"
                ]
              },
              "rationale": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "taxonomy": {
            "type": "object",
            "required": [
              "category",
              "cwe"
            ],
            "properties": {
              "category": {
                "type": "string",
                "minLength": 1
              },
              "cwe": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              }
            }
          },
          "locations": {
            "type": "array",
            "minItems": 1,
            "items": {
              "type": "object",
              "required": [
                "path",
                "startLine"
              ],
              "properties": {
                "path": {
                  "type": "string",
                  "minLength": 1
                },
                "startLine": {
                  "type": "integer",
                  "minimum": 1
                },
                "endLine": {
                  "type": "integer",
                  "minimum": 1
                },
                "role": {
                  "type": "string",
                  "minLength": 1
                }
              }
            }
          },
          "writeup": {
            "type": "object",
            "required": [
              "reportPath"
            ],
            "properties": {
              "reportPath": {
                "type": "string",
                "pattern": "^findings/([a-z0-9][a-z0-9._-]*)/\\1\\.md$"
              }
            }
          },
          "codeEvidence": {
            "type": "array",
            "items": {
              "type": "object",
              "required": [
                "id",
                "label",
                "path",
                "startLine",
                "code",
                "explanation"
              ],
              "properties": {
                "id": {
                  "type": "string",
                  "pattern": "^[a-z0-9][a-z0-9._/-]*$"
                },
                "label": {
                  "type": "string",
                  "minLength": 1
                },
                "path": {
                  "type": "string",
                  "minLength": 1
                },
                "startLine": {
                  "type": "integer",
                  "minimum": 1
                },
                "endLine": {
                  "type": "integer",
                  "minimum": 1
                },
                "language": {
                  "type": "string",
                  "minLength": 1
                },
                "role": {
                  "type": "string",
                  "minLength": 1
                },
                "code": {
                  "type": "string",
                  "minLength": 1
                },
                "explanation": {
                  "type": "string",
                  "minLength": 1
                }
              }
            }
          },
          "code_evidence": {
            "type": [
              "array",
              "null"
            ],
            "items": {
              "type": "object",
              "required": [
                "id",
                "code"
              ],
              "properties": {
                "id": {
                  "type": "string",
                  "minLength": 1
                },
                "code": {
                  "type": "string",
                  "minLength": 1
                }
              }
            }
          },
          "rootCause": {
            "type": [
              "object",
              "string"
            ],
            "required": [
              "summary"
            ],
            "properties": {
              "summary": {
                "type": "string",
                "minLength": 1
              },
              "evidenceRefs": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "code": {
                "type": "string",
                "minLength": 1
              },
              "language": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "root_cause": {
            "type": [
              "object",
              "string",
              "null"
            ],
            "properties": {
              "summary": {
                "type": "string",
                "minLength": 1
              },
              "evidenceRefs": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "evidence_refs": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "code": {
                "type": "string",
                "minLength": 1
              },
              "language": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "remediation": {
            "type": "string",
            "minLength": 1
          },
          "validation": {
            "type": [
              "object",
              "null"
            ],
            "properties": {
              "assertions": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "counterEvidence": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "evidence": {
                "type": [
                  "string",
                  "array"
                ],
                "minLength": 1,
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "evidenceRefs": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "evidence_refs": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "limitations": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "method": {
                "type": "string",
                "minLength": 1
              },
              "status": {
                "type": [
                  "string",
                  "null"
                ],
                "minLength": 1
              },
              "summary": {
                "type": "string",
                "minLength": 1
              },
              "disposition": {
                "type": [
                  "string",
                  "null"
                ],
                "minLength": 1
              },
              "result": {
                "type": [
                  "string",
                  "null"
                ],
                "minLength": 1
              }
            }
          },
          "attackPath": {
            "type": [
              "object",
              "null"
            ],
            "properties": {
              "assumptions": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "blindspots": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "controls": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "dataFlow": {
                "type": [
                  "string",
                  "object"
                ],
                "minLength": 1,
                "properties": {
                  "summary": { "type": "string", "minLength": 1 },
                  "source": { "type": "string", "minLength": 1 },
                  "sink": { "type": "string", "minLength": 1 },
                  "outcome": { "type": "string", "minLength": 1 },
                  "transformations": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  },
                  "evidenceRefs": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  },
                  "evidence_refs": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  }
                }
              },
              "data_flow": {
                "type": [
                  "string",
                  "object"
                ],
                "minLength": 1,
                "properties": {
                  "summary": { "type": "string", "minLength": 1 },
                  "source": { "type": "string", "minLength": 1 },
                  "sink": { "type": "string", "minLength": 1 },
                  "outcome": { "type": "string", "minLength": 1 },
                  "transformations": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  },
                  "evidenceRefs": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  },
                  "evidence_refs": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  }
                }
              },
              "dataflow": {
                "type": [
                  "string",
                  "object"
                ],
                "minLength": 1,
                "properties": {
                  "summary": { "type": "string", "minLength": 1 },
                  "source": { "type": "string", "minLength": 1 },
                  "sink": { "type": "string", "minLength": 1 },
                  "outcome": { "type": "string", "minLength": 1 },
                  "transformations": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  },
                  "evidenceRefs": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  },
                  "evidence_refs": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  }
                }
              },
              "evidenceRefs": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "evidence_refs": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "impact": {
                "type": [
                  "string",
                  "object",
                  "null"
                ],
                "minLength": 1,
                "properties": {
                  "level": { "type": "string", "minLength": 1 },
                  "rationale": { "type": "string", "minLength": 1 },
                  "why": { "type": "string", "minLength": 1 }
                }
              },
              "likelihood": {
                "type": [
                  "string",
                  "object",
                  "null"
                ],
                "minLength": 1,
                "properties": {
                  "level": { "type": "string", "minLength": 1 },
                  "rationale": { "type": "string", "minLength": 1 },
                  "why": { "type": "string", "minLength": 1 }
                }
              },
              "limitations": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "preconditions": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "reachability": {
                "type": [
                  "string",
                  "object"
                ],
                "minLength": 1,
                "properties": {
                  "summary": { "type": "string", "minLength": 1 },
                  "attacker": { "type": "string", "minLength": 1 },
                  "entrypoint": { "type": "string", "minLength": 1 },
                  "source": { "type": "string", "minLength": 1 },
                  "sink": { "type": "string", "minLength": 1 },
                  "outcome": { "type": "string", "minLength": 1 },
                  "preconditions": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  },
                  "evidenceRefs": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  },
                  "evidence_refs": {
                    "type": "array",
                    "items": { "type": "string", "minLength": 1 }
                  }
                }
              },
              "steps": {
                "type": "array",
                "items": {
                  "type": "string",
                  "minLength": 1
                }
              },
              "summary": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "remediationTests": {
            "type": "array",
            "items": {
              "type": "string",
              "minLength": 1
            }
          },
          "preventiveControls": {
            "type": "array",
            "items": {
              "type": "string",
              "minLength": 1
            }
          },
          "provenance": {
            "type": "object",
            "required": [
              "source"
            ],
            "properties": {
              "source": {
                "type": "string",
                "minLength": 1
              }
            }
          },
          "extensions": {
            "type": "object",
            "properties": {
              "candidateId": {
                "type": "string",
                "minLength": 1
              },
              "ledgerRowId": {
                "type": "string",
                "minLength": 1
              },
              "reportId": {
                "type": "string",
                "minLength": 1
              }
            }
          }
        }
      }
    }
  }
}
SHA-256: a480337cc0fa4c48c44fc7be17c6c4348767815570775cda80f2aaf797b8e56c