Report format

Markdown: lintsure-report.md

Written on every run. It has six parts:

1. A header with the frameworks checked and the rules version, plus the reminder that it’s a readiness check, not an audit.
2. Findings, each with status, file:line, title, severity, the rules it breaks, the fix and the auditor note.
3. Met, the rules that ran and found nothing, with their controls.
4. Outside code, what code can’t prove, with the evidence to collect.
5. What to do next: gaps to review, partial findings to confirm, outside-code work, and a reminder to have a qualified person review the results.
6. What this report is not: it doesn’t mean you are compliant, certified or ready for an audit.

JSON: lintsure-report.json

Written with --json, and always by the GitHub Action. The MCP scan tool returns the same object. Its shape:

{
  "rulesVersion": "0.1.0",
  "frameworks": ["gdpr", "soc2"],
  "findings": [
    {
      "ruleId": "pii.logged",
      "file": "src/users.ts",
      "line": 5,
      "status": "gap",
      "severity": "high",
      "title": "Personal data written to logs",
      "controls": [{ "framework": "gdpr", "id": "Art. 32", "title": "Security of processing" }],
      "fix": "Mask or remove the personal field before logging, for example mask(user.email).",
      "note": "Logs are copied to many places and kept for a long time. ..."
    }
  ],
  "met": [{ "ruleId": "secret.in-source", "title": "...", "controls": [] }],
  "outside": [{ "framework": "gdpr", "control": "Art. 30", "title": "Records of processing", "evidence": "..." }],
  "disclaimer": "Lintsure is a readiness tool, not an audit, a certification or legal advice. ..."
}

Stable and repeatable

• Findings are sorted by file, then line, then rule id.
• File paths are relative to the scanned folder and always use /.
• The report has no timestamps or machine names, so running twice on the same code gives byte-identical JSON. You can diff reports between commits.
• rulesVersion changes when rules or output change. Keep it with any report you hand to an auditor.