> For the complete documentation index, see [llms.txt](https://docs.logilica.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.logilica.com/integration/connecting-tools/sarif.md).

# Security Findings (SARIF)

Logilica imports security scan results in SARIF format, so findings from your security scanners sit alongside the rest of your engineering data. Any scanner that emits standard SARIF is supported — Snyk, CodeQL, Coverity, and others.

## Authentication

Security findings are sent to Logilica's import API rather than pulled from a scanner. You push SARIF data from your CI/CD pipeline to the `/sarif` endpoint, authenticated with your Logilica API token and domain supplied as request headers (`X-lgca-token` and `X-lgca-domain`). See the [Import API](/advanced/import.md) for how to obtain a token and call the endpoint.

Each upload is a single SARIF document tied to one repository and one commit.

## What's Imported

From each SARIF document, Logilica imports:

* **Tool name** — the scanner that produced the run, used to attribute every rule and finding to a source
* **Rules** — each rule's ID, name, and severity level, plus any associated CWE identifiers
* **Results** — each finding, with the affected file, the rule it relates to, and the result message
* **Commit and time** — the commit the scan ran against, so findings line up with the rest of your repository history

## Good to Know

* **Findings update when you upload.** SARIF data is pushed from your pipeline, so results refresh each time your pipeline uploads a new scan — there is no automatic background sync.
* **Any SARIF-compliant scanner works.** Because Logilica reads standard SARIF fields, any tool that emits valid SARIF can be uploaded — Snyk, CodeQL, Coverity, and others — without per-scanner configuration. The scanner identifies itself through the run's tool name.
* **A document may contain multiple runs.** Each run in a SARIF document's `runs` array is imported in turn, so a single upload can carry findings from more than one scan.
* **Each upload is scoped to one commit.** An upload carries the repository and the commit the scan ran against. Push a SARIF document per scan from your pipeline so findings stay tied to the right commit.
* **The upload must be valid SARIF.** A document with no runs, or a run that does not identify its scanner, is rejected. See the [Import API](/advanced/import.md) for the exact request format.

{% hint style="info" %}
**Findings are imported via direct upload only.** SARIF data is brought in by pushing it to the import API from your pipeline. Automatic collection of GitHub Code Scanning results through the GitHub connector is not currently active — send your scan output to the upload endpoint instead.
{% endhint %}