CODYGIENE

Understanding Results

Terminal output structure

The default terminal output follows this hierarchy:

  1. CODYGIENE identity · scanner name and version
  2. Repository · scanned path
  3. Frameworks · detected technologies
  4. Capabilities · analysis features used
  5. Findings count and duration
  6. Analysis Coverage · files discovered, eligible, analyzed, skipped
  7. PARTIAL warning (if applicable) · shown before scores
  8. Scores · overall and per-category
  9. Findings · prioritized by severity and category

Coverage

Analysis Coverage
  Files discovered:  452
  Files eligible:   360
  Files analyzed:   360
  SQL files:         26
  Files skipped:     0
  Coverage:          100%
  Status:            COMPLETE
  • Files discovered · all files found in the project
  • Files eligible · discovered files that are supported source files
  • Files analyzed · eligible files that were actually parsed
  • SQL files · SQL migration files analyzed
  • Files skipped · eligible files that could not be analyzed
  • Coverage · percentage of eligible files analyzed
  • Status · COMPLETE or PARTIAL

COMPLETE vs PARTIAL

  • COMPLETE · all eligible files were analyzed. Scores are representative.
  • PARTIAL · some files were skipped. A prominent warning appears:
⚠  PARTIAL SCAN · SCORES ARE NOT REPRESENTATIVE
  Scores below derive from partial file coverage.
  Do not treat these scores as a complete repository assessment.

Scores

Scores range from 0 to 100. Higher is better.

Score
  Overall: 20
  security       10  (96 findings)
  performance    61   (29 findings)
  code-health    10   (483 findings)
  ai-quality     45   (36 findings)

The overall score is derived from category scores and finding penalties. See Scoring for the formula.

Findings

Findings are grouped by priority tier:

Priority 1: Critical/High Security, High Performance

Shown individually with full details:

CRITICAL [0.95 SAFE] CAND-007  Browser-role EXECUTE on SECURITY DEFINER function
at supabase/migrations/000004_security_hardening.sql:102:1
description: Function "has_org_membership" is declared SECURITY DEFINER...
impact: Browser clients can invoke privileged functions...
recommendation: Revoke EXECUTE from browser-facing roles...
fixability: AGENT_GUIDED  id: CAND-007#4F92

Priority 2: Medium Security & AI Safeguard Divergence

Shown individually.

Priority 3: Medium Performance & Structural Code Health

Shown individually, capped at 50 findings.

Priority 4 & 5: Low-priority findings

Clustered by rule to avoid flooding the terminal:

Low-priority Code Health
  27 × CH-HEALTH-002 · Oversized file (many effective lines)
    12 in src/components/
    8 in src/lib/
    7 in src/api/

Use --format json to see all findings individually.

Finding fields

Each finding includes:

Field Description
Severity critical, high, medium, low
Confidence 0.0–1.0, how certain the rule is
Tier SAFE, LIKELY, INVESTIGATE
Rule ID e.g. CH-SEC-010 or CAND-025
Title Short description
File:line:column Location in the source
Description What was detected
Impact Why it matters
Recommendation How to fix it
Fixability AUTO_FIXABLE, AGENT_GUIDED, MANUAL
Fingerprint Stable hash for tracking across scans
Finding class issue or insight (see below)

Issues vs insights

Every finding has a findingClass of either issue or insight.

  • Issues are ordinary findings: they count toward category scores, participate in --fail-on thresholds, and appear as regressions in baseline diffs.
  • Insights are informational observations · currently the architecture signals (CAND-029 change blast radius, CAND-032 workspace dependency cycles, CAND-033 cross-workspace dependency risk). They provide context for engineering review, not verdicts.

Insights:

  • appear in every report format · terminal (marked [INSIGHT]), JSON (findingClass: "insight"), SARIF (level: "note", kind: "informational" · never error), and Markdown (listed under an informational heading)
  • do not reduce scores
  • do not trigger --fail-on
  • do not count as release-gate or baseline-regression failures

Rule IDs

Rules have two families:

  • CH-* · frozen Ruleset 1.0.0 rules (44 rules)
  • CAND-* · candidate rules (26 rules, including architecture insights)

Most rules are enabled by default. 6 rules are disabled by default to reduce noise. See Rules and Scope for the full catalog and default profile.

Machine-readable reports

The terminal shows a prioritized subset. Machine-readable reports contain ALL findings:

codygiene scan --format json -o report.json
codygiene scan --format sarif -o report.sarif
codygiene scan --format markdown -o report.md

See Report Formats for details.