Shannon: SARIF Reporting Now On By Default
A single merged pull request changes how Shannon reports exploit run results, turning on SARIF output by default instead of requiring an opt-in. Documentation and config schema were updated to match.
Duration: PT1M58S
Episode overview
This episode is a short developer briefing from Shannon.
It explains recent repository work in plain language.
- Show: Shannon
- Published: 2026-08-27T06:05:20Z
- Audio duration: PT1M58S
Transcript excerpt
This excerpt keeps the crawler page concise. Listen to the episode or use the RSS feed for the full update.
Good day. It's August 27th, and here's your Shannon briefing.
Today's activity centers on one meaningful change: exploit runs now emit SARIF output by default. Previously, this was likely an opt-in setting. Now, developers get standardized security results automatically, and have to explicitly turn it off if they don't want it.
That's the core of PR 431 from ezl-keygraph. The change touched the config schema, the example config, and the config parser, which tells us this wasn't just a documentation tweak. Making SARIF the default means the underlying config handling had to change too, so that setting "report dot sarif" to false is now the…
Worth noting: this is a behavior change with real workflow impact. SARIF, the Static Analysis Results Interchange Format, is what many security tools and CI pipelines expect for ingesting findings. If your pipeline wasn't expecting SARIF output before, it will start appearing now unless you explicitly disable it.…
The commit tied to this PR, e-d-5-6-5-9-e, also updated the README and CLAUDE documentation to describe SARIF as on by default, so the docs and behavior should now be in sync. That matters for anyone reading setup instructions fresh,…
What'…