Finding shape
| Field | Type | Description |
|---|---|---|
filePath Required | string | Repository-relative path from the submitted diff. |
lineNumber Required | integer | One-based line anchor for the finding. |
lineSide Required | NEW | OLD | Whether the anchor belongs to the new or old side of the diff. |
oldLineNumber Optional | integer | null | Optional one-based anchor on the old side of the diff; null when no corresponding original line is available. |
hunkHeader Optional | string | null | Optional unified-diff hunk header for the finding's location; null when unavailable. |
priority Required | P0 | P1 | P2 | Materiality level returned by the review policy. |
category Required | enum | LOGIC_BUG, RACE_CONDITION, SECURITY, PERFORMANCE, or RELIABILITY. |
summary Required | string | Concise explanation of the defect and its reachable impact. |
suggestedFix Required | string | Practical remediation direction that still requires engineering review. |
Priority rubric
- P0 — exploitable security flaw, credential exposure, irreversible data loss, or broad production outage.
- P1 — definite reachable bug causing data corruption, authorization bypass, severe reliability failure, or major performance collapse.
- P2 — concrete reachable defect with plausible user, security, correctness, or production impact.
Style, naming, formatting, minor cleanup, and low-confidence speculation are not returned as findings.
When no findings are returned
No qualifying finding is not proof of safety
An empty findings array means the review returned no issue meeting its configured threshold for the supplied evidence. Continue with tests, human review, and your normal release controls.