Advisory is a known security advisory from advisories.ecosyste.ms.

AuditMetrics is the aggregate breakdown the audit page surfaces. AgreementRate is the share of reviews where the human verdict matches the automation'

AuditQueueOptions filters the audit queue. Limit caps result count (the queue is for spot-checking, not exhaustive review). Since is a freshness cutof

Broker fans SSE events from the worker to connected HTTP clients.

CNA is a CVE Numbering Authority from the public cve.org partner list. Stored so the disclosure workflow can route a finding to the CNA whose scope co

CWE is one entry from the MITRE catalogue. The JSON is generated from the CWE XML download; see development.md. Category is the View-1400 ("Comprehens

ClaudeAccountError is returned for account-level Claude failures. The worker pauses the batch instead of failing every scan; Detail preserves Claude's

ClaudeHarness is the default and (for now) only harness: it wraps the existing buildClaudeArgs and ParseStream so behaviour is byte-for-byte unchanged

Config mirrors the supported YAML keys. Every field is optional; missing fields leave the corresponding flag at its built-in default.

ContainerRunner launches claude inside an ephemeral container with the scan workspace (clone + staged skill + output file) mounted at /work. It drives

ContainerRuntime identifies the OCI engine scrutineer shells out to and the main trait that changes the generated `run` flags: rootless podman maps --

DayUsage is one row of the /usage?view=day table: total cost and token spend for all skill scans that finished on a given calendar day.

DepGroup is a dependency deduplicated by name+ecosystem, with all manifest paths and the best version (lockfile wins over manifest).

Dependency is one package dependency discovered by the git-pkgs job. Rows are replaced wholesale each time the job runs for a repository.

DependencyFinding is one finding on a library that the given application depends on. Returned by DependencyFindings; consumed by the reachability skil

Dependent is a package that depends on one of this repo's packages. Populated by the ecosystems dependents prefetch from packages.ecosyste.ms.

Effort is a display label paired with the claude `--effort` level it selects. The settings page renders these as a row of buttons in order, fastest to

EgressProxy is a small forward proxy the container runner points HTTPS_PROXY/HTTP_PROXY at. It only tunnels to hosts on Allow. Clients must present To

EgressSidecarConfig carries what setupHardenedNetwork needs to launch the egress proxy as a sidecar container under rootless --hardened. The zero valu

Event is one line of activity from a claude -p stream-json run, flattened into something a human can read in a log view.

Event is one SSE message. Name maps to the htmx sse-swap attribute; Data is the HTML fragment (or plain text) to swap in.

FailOnThresholdError is returned when a scan's findings include at least one at or above the skill's fail_on severity. wrap() treats it as a completed

Finding is the format-neutral subset of an external report entry. Field names mirror db.Finding; the web layer copies them across.

Finding is one vulnerability reported by a scan. The Finding row holds the current value of every mutable field; FindingHistory records who changed ea

FindingCommunication is one external interaction about a finding: an email to the maintainer, an inbound reply, a GHSA submission, etc. Kept distinct

FindingDependent records, per (finding, dependent), whether that downstream consumer of the vulnerable library reaches the sink. Status mirrors the CS

FindingHistory records every change to a mutable field on a Finding. Together with the Finding row's current columns it gives you "what is the current

FindingLabel is a tag independent of the lifecycle status. A finding can carry multiple labels (wontfix, needs-info, regression, etc.).

FindingNote is one timestamped internal analyst note about a finding. Replaces the old single Notes column so the comment trail is preserved.

FindingReference is an external URL related to a finding: the upstream issue/PR, a CVE or GHSA record, a fix commit, a blog post.

FindingResolution says how a finding got resolved. Set by the analyst once disclosure runs its course.

FindingReview is a structured human verdict against an automation outcome. Verdict mirrors the revalidate skill's enum so reviewer agreement with the

FindingSource is the provenance of a field value: produced by a deterministic tool, suggested by a model-backed skill, or set by the analyst. Analyst

Flash is a one-shot message carried across a redirect via the "flash" cookie and rendered server-side into #toaster on the next page load.

Format names the detected input encoding. Exposed so callers can log what was parsed.

A Harness is the agent CLI the container runner execs to drive a skill. It owns everything that varies between claude-code and an alternative agent (c

Maintainer is a person who maintains one or more repositories. The centre of the disclosure CRM: findings batch into conversations per maintainer, not

MaxTurnsReachedError is returned when claude-code exits after hitting the --max-turns cap. The caller should treat this as a soft completion.

Model is a display-name → claude model id pair offered in the UI.

Model is a display-name plus the claude model id it resolves to. The shape matches web.Model so main.go can pipe one into the other without the two pa

ModelTier is an operator-facing role whose concrete model can be swapped in Settings without editing every skill that uses that role.

OrgImportPreview carries the confirmation-step data: how many repos a given org/filters combination would queue, plus the inputs needed to re-submit t

OrgRepo is the slim view of a forge repository the org-import path needs: enough to build a clone URL and apply the fork/archived filters.

Package is one registry entry from packages.ecosyste.ms linked to this repo.

Parsed is a SKILL.md-plus-neighbours as extracted from disk. It mirrors the Skill model shape so the caller can persist it without further work.

Payload is what travels on the queue. The job handler looks up the Scan row by ID; everything else (repo URL, kind) hangs off that record so the queue

Profile selects a per-ecosystem runner image. The default profile (empty name) uses the runner image configured globally; named profiles build a Docke

ProfileMarker refines profile selection beyond what brief reports.

RateLimitInfo is the subscription limit status claude-code reports in a rate_limit_event line; it feeds auto-resume and the usage page panel.

RepoInput is the parsed form of a user-supplied repository reference. CloneURL is what scrutineer passes to `git clone`; SubPath is the sub-folder wit

RepoUnreachableError is returned when git clone/fetch fails because the remote is unreachable (deleted, private, wrong URL, network error).

Result is one batch of findings against one repository from one tool. A single uploaded file can yield several Results when it contains multiple SARIF

RunnerImageStatus is the result of the boot-time runner-image staleness check, surfaced in the boot log and as a banner on the Settings page. The zero

RunnerToolVersions holds the versions of the analysis tools baked into the runner image. Any field is "" when its tool could not be queried.

SBOMPackage is one component listed in an upload. RepositoryID is set asynchronously once the PURL has been resolved to a source repo and the triage s

SBOMUpload is one CycloneDX or SPDX document a user uploaded. Packages are replaced wholesale on re-upload (cascade delete) but the resolved Repositor

Scan is one execution of a job against a repository. Kind names the job ("claude", later "semgrep", "brief", "git-pkgs"). Report holds whatever the jo

ScanOpts carries the optional inputs to an enqueue call. Keeps the enqueue signature from drifting into an unreadable positional list as new options (

SchemaValidationError carries the formatted validator output for a report that did not match its skill's schema. wrap() treats it like FailOnThreshold

Setting is a persisted operator-tunable key/value. It backs the runtime knobs the Settings page exposes (concurrency, default turn cap) so a change su

Skill is one scan recipe expressed as a claude-code skill. It maps 1:1 to the agentskills.io SKILL.md format: Body is the markdown that sits after the

SkillJob is a scan driven by an on-disk claude-code skill. The runner clones the repo, stages the skill under .claude/skills/{Name}/ next to the clone

SkillRunner executes one skill scan. Tests and the container-backed runner substitute the process launch without touching the queue plumbing.

SkillUsage is one row of the /usage page: aggregate cost and turn statistics for every completed scan of a given skill across the corpus. Percentiles

Subproject is a scannable unit the subprojects skill discovered inside a repository. One Repository has many Subprojects; each Scan may refer to one o

Usage is the token breakdown from a result event.

Workbench is the template payload for the workbench tab.

WorkbenchDiff buckets sinks by how their outcome changed between two deep-dive runs. A sink is keyed by its inventory location (file:line) since the p

SQLite returns MAX() over a datetime column as a string; scan into a string and parse to *time.Time ourselves rather than fight GORM.

bundleEntry is one file written into the archive: path inside the tar plus its raw contents.

bundleManifest is the small header file the disclosure bundle carries alongside the per-format documents. It names the finding, fixes the generator ve

captureRunner records the SkillJob it was handed so a test can assert how the worker resolved per-scan inputs.