Skip to content

v0.1.0 Release Notes

Release Date: October 4, 2026

The initial release of findingspec — a domain-neutral model that normalizes findings across multiple problem domains into one canonical representation.

Highlights

  • A canonical Finding with a two-level Domain + Type taxonomy and a typed, per-type Detail subsection, so one IR spans security, accessibility (a11y), internationalization (i18n), and quality engineering (qe).
  • Ingest adapters for open-source scanners: gitleaks, axe-core, and govulncheck ship in-repo; Grype, Trivy, and AWS Inspector convert from their own tool libraries into the same shape.
  • Call-graph reachability (via govulncheck) as a first-class prioritization signal, plus a canonical container/SCA package-vulnerability shape shared by Grype, Trivy, and Inspector.

Core model

  • Finding and FindingSet with domain/severity/open filtering, counting, severity ordering, and a Summary analytics rollup.
  • Shared vocabulary: Severity (delegated to the priority-frameworks Severity framework), Status, Confidence, Domain, Source, Location (code, runtime, or RFC 6901 JSON Pointer for OpenAPI/Postman/YAML), Evidence, Remediation (with an AgentPrompt), and Reference.
  • Typed per-type detail: Finding.Type, SetDetail, and generic DetailAs[T].

Domains

  • security — Vulnerability (inherent vs. residual severity, compensating controls, exception-driven effective severity), Secret, CVSS, the Package/Fix/Artifact container/SCA shape, and call-graph Reachability.
  • a11y — WCAG Issue with conformance level and impact→severity mapping.
  • i18n — localization Issue types.
  • qe — Failure for end-to-end and user-journey findings.

Adapters

  • gitleaks (adapters/gitleaks) — secret scanning → security/secret.
  • axe-core (adapters/axe) — accessibility results → a11y/wcag.
  • govulncheck (adapters/govulncheck) — Go SCA with reachability → security/sca.

See Interchange & Adapters for the full picture, including the Grype, Trivy, and Inspector converters in their tool libraries.

Notes

  • Severity serializes as canonical lower-case level IDs (critical, high, medium, low, informational); use Severity.Name() for display.
  • The core package's only dependency is grokify/priority-frameworks.