SARIF Viewer Online
Open a .sarif log from CodeQL, Semgrep, ESLint, Bandit, Trivy, Checkov or Gitleaks to see every result grouped by rule or file, worst first. Filter by level, tool, baseline state and suppressions, and read the code flow, rule help and CWE of each result. No account and no upload.
SARIF Viewer for VS Code and Cursor, free
- Click a result to open its line. CI paths such as /home/runner/work/... and %SRCROOT% are matched to your workspace.
- Code flows step by step in the editor (Alt+Up and Alt+Down), and Show in Problems for the filtered results.
- Compare two logs: each result marked new, unchanged or fixed, matched by fingerprint. Logs of 150 MB open in seconds.
Optional Zovo Pro, USD 19 once: export results as CSV, Markdown or HTML, and summarize all SARIF logs in a folder. 3 free tries for each.
Drop a .sarif file here
or
SARIF 2.1.0 logs (.sarif, .sarif.json) up to 300 MB, from any scanner. SARIF 2.0 logs open with a note.
Open this in VS Code or Cursor
The free SARIF Viewer extension opens .sarif logs in VS Code and Cursor as a fast table: click a result to jump to its line, step through the code flow in the editor, match CI paths to your workspace, add the results to the Problems panel and compare a log with an older one.
Free, MIT license. About SARIF Viewer for VS Code.
Zovo Pro
Export results as CSV, Markdown or HTML, and one summary of all SARIF logs in a folder. Zovo Pro, USD 19 once.
In the SARIF Viewer extension, Zovo Pro saves every result as CSV for a spreadsheet or as a Markdown or static HTML report, and reads every .sarif file in a folder (for example the CI artifacts of CodeQL, Semgrep, ESLint and Trivy) into one report with results per log and per tool, the top rules and the top files. Each Pro tool works 3 times for free. One payment covers the Pro tools in 22 Zovo extensions. Everything that is free stays free.
After a card payment you get a key on the page. With GitHub Sponsors you sign in from the extension. Details on the Zovo Pro page.
Related tools
- Swagger Editor & OpenAPI Viewer. Lints and previews OpenAPI and Swagger specs in VS Code.
- HAR Viewer & HAR File Analyzer. Opens HAR files from browser DevTools with a timing waterfall.
- Load Testing & HTTP Load Tests. Load tests HTTP APIs from a small YAML file, with no account.
- JSON Tree Viewer Online, free in your browser.
- OpenAPI Viewer Online, free in your browser.
- Regex Tester Online, free in your browser.
Questions
Is my SARIF log uploaded anywhere?
No. The page reads the log inside this tab with JavaScript. Its Content Security Policy sets connect-src to none, so the page cannot send your results anywhere. Open the Network tab of your browser tools and you will see no request when a log opens.
Which scanners does it work with?
Any tool that writes SARIF 2.1.0: CodeQL, Semgrep, ESLint, Bandit, Trivy, Checkov, Gitleaks, Snyk, SpotBugs, Roslyn analyzers and more. A log with several runs shows a tool filter. SARIF 2.0 logs open with a note, because some fields have other names there.
What does it show for each result?
The level, rule id and name, message, file, line and column, the snippet, the rule help, the help link, CWE links, security severity, precision, tags, fingerprints, suppressions with their justification, related locations and every step of the code flow. Paths that use uriBaseId such as %SRCROOT% are joined with their base when the log names it.
What if the log has no results?
The page says so clearly, with the tool name and the number of rules it ran, so you know the scan ran and found nothing. If the log says the run did not finish, the page says that too, with the notes the tool wrote.
Can I jump to the code?
Not from a browser page, because it cannot open files on your computer. The free SARIF Viewer extension for VS Code opens each result at its line, maps CI paths to your workspace and steps through code flows in the editor.
Is a hostile log safe to open?
Messages, rule help and paths are shown as plain text, never as HTML, and nothing in the log runs. Only http and https help links are made clickable, and they open only when you click them. A log that is not valid JSON gets a message with the line and column of the error.
Does it work offline?
Yes. After the first visit the page keeps a copy of its own files, so it opens SARIF logs with no connection.
What is free and what is Zovo Pro?
Everything on this page is free. In the VS Code extension, viewing, filters, code flows, Compare Two SARIF Logs and the Problems panel are free too. Export as CSV, Markdown or HTML and the folder summary are Zovo Pro, with 3 free tries each. One USD 19 payment covers the Pro tools in every Zovo extension.