Type Alias SecurityOutput 

pub type SecurityOutput = SecurityOutput<SecurityOutputConfig, SecurityGate>;

Concrete full fallow security envelope.

Aliased Type

pub struct SecurityOutput {

    pub schema_version: SecuritySchemaVersion,
    pub version: ToolVersion,
    pub elapsed_ms: ElapsedMs,
    pub config: SecurityOutputConfig<Severity>,
    pub gate_outcomes: Option<GateOutcomes>,
    pub request_outcomes: Option<RequestOutcomes>,
    pub meta: Option<Meta>,
    pub gate: Option<SecurityGate<SecurityGateMode>>,
    pub workspace_diagnostics: Vec<WorkspaceDiagnostic>,
    pub security_findings: Vec<SecurityFinding>,
    pub attack_surface: Option<Vec<SecurityAttackSurfaceEntry>>,
    pub unresolved_edge_files: usize,
    pub unresolved_callee_sites: usize,
    pub unresolved_callee_diagnostics: Option<SecurityUnresolvedCalleeDiagnostics>,
}

Fields

schema_version: SecuritySchemaVersion

Schema version of this envelope.

version: ToolVersion

Fallow CLI version that produced this output.

elapsed_ms: ElapsedMs

Wall-clock milliseconds spent producing the report.

config: SecurityOutputConfig<Severity>

Privacy-safe config context relevant to security candidate generation.

gate_outcomes: Option<GateOutcomes>

Every gate this run ARMED, keyed by name, absent when it armed none. Each entry is the same rule that decides the exit code, so a CI integration reads the verdict instead of guessing from a process status it usually cannot see. A gate fails the build when status is fail AND enforced is true. Armed, not evaluated: fallow’s default severity rules fail a run with no flag at all, so an absent object means “no gate was asked for”, never “nothing failed”. See [crate::GateOutcomes].

request_outcomes: Option<RequestOutcomes>

Every narrowing or shaping request this run RECEIVED, keyed by name, absent when it was asked for nothing. An entry whose status is not applied means the run could not do what it was asked and reported something WIDER instead, so what follows is a valid report of a scope nobody requested. Honoured requests are published too, with status: "applied", so an absent object means “nothing was asked for”, never “nothing failed”. See [crate::RequestOutcomes].

meta: Option<Meta>

Security-specific rule and field metadata, emitted with --explain.

gate: Option<SecurityGate<SecurityGateMode>>

Gate verdict, present only when --gate <mode> was set (issue #886). Emitted on pass too (verdict: "pass", new_count: 0) so consumers distinguish “gate ran and passed” from “gate did not run” (absent).

workspace_diagnostics: Vec<WorkspaceDiagnostic>

Diagnostics owned by this security analysis run.

security_findings: Vec<SecurityFinding>

Security candidates. Paths are project-root-relative, forward-slash.

attack_surface: Option<Vec<SecurityAttackSurfaceEntry>>

Opt-in attack-surface inventory from untrusted entry points to reachable sinks. Present only when --surface was requested.

unresolved_edge_files: usize

In-band blind spot: number of "use client" files whose transitive import cone contains a dynamic import() the reachability BFS could not follow. A leak hidden behind such an edge would not be reported, so a zero finding count with a non-zero value here is NOT a clean bill.

unresolved_callee_sites: usize

In-band blind spot: number of sink-shaped nodes the catalogue detector could not flatten to a static callee path (dynamic dispatch, computed members, aliased bindings). A zero finding count with a non-zero value here is NOT a clean bill.

unresolved_callee_diagnostics: Option<SecurityUnresolvedCalleeDiagnostics>

Bounded diagnostics for unresolved callee blind spots.