Type Alias SecurityOutput 

pub type SecurityOutput = SecurityOutput<SecurityOutputConfig, SecurityGate>;

Concrete full fallow security envelope.

Aliased Type

pub struct SecurityOutput {

    pub schema_version: SecuritySchemaVersion,
    pub version: ToolVersion,
    pub elapsed_ms: ElapsedMs,
    pub config: SecurityOutputConfig<Severity>,
    pub gate_outcomes: Option<GateOutcomes>,
    pub meta: Option<Meta>,
    pub gate: Option<SecurityGate<SecurityGateMode>>,
    pub workspace_diagnostics: Vec<WorkspaceDiagnostic>,
    pub security_findings: Vec<SecurityFinding>,
    pub attack_surface: Option<Vec<SecurityAttackSurfaceEntry>>,
    pub unresolved_edge_files: usize,
    pub unresolved_callee_sites: usize,
    pub unresolved_callee_diagnostics: Option<SecurityUnresolvedCalleeDiagnostics>,
}

Fields

schema_version: SecuritySchemaVersion

Schema version of this envelope.

version: ToolVersion

Fallow CLI version that produced this output.

elapsed_ms: ElapsedMs

Wall-clock milliseconds spent producing the report.

config: SecurityOutputConfig<Severity>

Privacy-safe config context relevant to security candidate generation.

gate_outcomes: Option<GateOutcomes>

Every gate this run ARMED, keyed by name, absent when it armed none. Each entry is the same rule that decides the exit code, so a CI integration reads the verdict instead of guessing from a process status it usually cannot see. A gate fails the build when status is fail AND enforced is true. Armed, not evaluated: fallow’s default severity rules fail a run with no flag at all, so an absent object means “no gate was asked for”, never “nothing failed”. See [crate::GateOutcomes].

meta: Option<Meta>

Security-specific rule and field metadata, emitted with --explain.

gate: Option<SecurityGate<SecurityGateMode>>

Gate verdict, present only when --gate <mode> was set (issue #886). Emitted on pass too (verdict: "pass", new_count: 0) so consumers distinguish “gate ran and passed” from “gate did not run” (absent).

workspace_diagnostics: Vec<WorkspaceDiagnostic>

Diagnostics owned by this security analysis run.

security_findings: Vec<SecurityFinding>

Security candidates. Paths are project-root-relative, forward-slash.

attack_surface: Option<Vec<SecurityAttackSurfaceEntry>>

Opt-in attack-surface inventory from untrusted entry points to reachable sinks. Present only when --surface was requested.

unresolved_edge_files: usize

In-band blind spot: number of "use client" files whose transitive import cone contains a dynamic import() the reachability BFS could not follow. A leak hidden behind such an edge would not be reported, so a zero finding count with a non-zero value here is NOT a clean bill.

unresolved_callee_sites: usize

In-band blind spot: number of sink-shaped nodes the catalogue detector could not flatten to a static callee path (dynamic dispatch, computed members, aliased bindings). A zero finding count with a non-zero value here is NOT a clean bill.

unresolved_callee_diagnostics: Option<SecurityUnresolvedCalleeDiagnostics>

Bounded diagnostics for unresolved callee blind spots.