Skip to main content
Code and dependency scanners report many findings. Squasher imports them and checks each one against your production traces from the last 7 days, so you can fix first what actually runs.

​
Formats

Send the export as JSON. One import takes at most 1000 findings and 5 MiB; split bigger reports.

​
The production check

For each route the result shows requests, distinct callers (client.address), requests with a 401 or 403 response, and requests with an error. If your spans do not carry code.* attributes, send a route_table that maps handler files to routes. Squasher checks the 50 most severe code locations of each import; the others are unknown.

​
Severity and paging

Squasher keeps the scanner’s severity. The check only adds reachability and a reachability_rank (3: running with auth failures or errors, 2: running, 1: unknown, 0: not seen) that you can sort by. Imported findings never open an incident or page anyone.

​
Imports run again

Each finding is identified by the scanner, the rule, and the file and line (or the package and version). A result with neither is identified by its route, title, and the scanner’s own evidence: SARIF fingerprints or partialFingerprints, else the location it names, else its message. Importing the same report again does not create duplicates. Use dry_run=true (or --dry-run) to see the result without storing it. Related: Findings API, Anomalies and findings.