Function security_rule_id 

pub fn security_rule_id(finding: &SecurityFinding) -> String

The stable rule identifier for a finding.

The secret-leak ClientServerLeak keeps its bespoke id; the server-only variant gets security/server-only-import so a SARIF consumer tells “reaches server-only code” apart from “reads a secret”. Each TaintedSink category gets security/<category> so candidates group per CWE class.