Reports that land where reviewers already live

--report-output writes the file even when --fail-on gates the exit code, so a single CI step can both enforce a bar and publish findings. That was the single most common failure mode in early pilots: teams that gated hard but had nowhere for developers to see findings ended up disabling the gate.

securegit scan . --format sarif --report-output securegit.sarif
securegit scan . --format gitlab --report-output gl-sast-report.json
securegit scan . --write-baseline "Legacy findings accepted 2026-08-03" --expires 2026-11-03
securegit scan . --fail-on high --baseline .securegit/baseline.json

Baselines suppress known findings by a stable fingerprint that includes rule, file, snippet, and CWE — not by line number. Every suppression carries reason, created_at, created_by, and optionally expires. Expired entries automatically re-fire.

The tamper-evident audit log

A separate, always-on log — independent of the chain — captures every security-relevant event. Every entry is JSONL with a prev_hash and hash field. Break the chain and securegit audit verify fails with the exact index of the break. Two of its three consumers — SIEM ingest and internal review — work without any signing infrastructure at all.

securegit audit show --last 100
securegit audit verify
securegit audit export --format cef > /var/log/securegit.cef
securegit compliance report --format markdown --output compliance.md

A report with no gaps is not trustworthy. Every real system has gaps. Showing yours is what makes the rest of it believable.

Findings are grouped by OWASP Top 10 (2021) via CWE mapping, and by NIST SSDF v1.1 practice. It is not a substitute for an audit. It is a substitute for two engineer-days of copy-and-paste when the vendor questionnaire arrives.