Output, exit codes and drift

Text output

By default untrust scan prints one line per check with its verdict, ID and a summary, then a count of each verdict:

[FAIL] KMS-01        2 of 2 Allow+Decrypt statement(s) do not enforce meaningful attestation: ...
[FAIL] IMDS-01       HttpTokens is 'optional' (should be 'required' for IMDSv2-only)
...
Recorded results: 0 PASS, 33 FAIL, 0 SKIP, 0 ERROR. Skipped checks and errors remain unassessed.

JSON output

--output report.json writes the report to a file; --json prints it to standard output. You can use both. The JSON report is what you upload to the console.

Field	Contents
schema_version	Report format version.
version	The scanner version that produced the report.
timestamp	When the scan ran (UTC, ISO 8601).
simulated	true for a --demo report.
scan_mode	active, passive (with --read-only) or demo.
target	The platform and the identifiers you scanned: bucket, key, instance, project, VM and so on.
summary	Counts: total, pass, fail, skip, error.
findings	One entry per check: check_id, title, status, severity, summary, remediation, evidence, and for some checks assurance and assurance_note.
coverage	Which of the platform's checks were reported, which are absent and which the scan mode excluded, so a partial scan is never read as a complete one.
inventory	The read-only inventory (see Inventory). Absent with --no-inventory.

Every field is described in Report and evidence formats.

The report contains the identifiers of the resources you scanned and the evidence each check recorded, such as policy statements and rule summaries. It never contains your cloud credentials. Review it before you share it outside your organization.

SARIF

untrust buildscan --sarif build.sarif writes SARIF 2.1 for code-scanning tools. untrust ci-feedback --code-scanning generates SARIF for IaC findings and uploads it to GitHub code scanning. See CI gates.

Exit codes

Command	0	1	2	Other
untrust scan (live)	No FAIL and no ERROR	At least one FAIL	At least one ERROR	--demo always exits 0
untrust buildscan, untrust iacscan	Gate passed	Gate blocked: a finding at or above --fail-on	Incomplete or error. Treat it as a failure.
untrust registry scan	Every artifact verified	A confirmed failure (unsigned, untrusted signature, moved tag, measurement mismatch)	Something could not be assessed (no access, cosign missing, no trust root)
untrust registry bind	Every deployment bound	A measurement unverified, stale or unknown	No deployment recorded a measurement
untrust diff	No check newly fails	A check newly fails	Bad input
untrust … verify	Verified	Not verified	A required input is missing	3: unsigned or unbound. See Verify evidence offline.

An ERROR result outranks FAIL: a scan that could not finish is never reported as a clean pass or a plain failure.

Drift between two scans

untrust diff compares two reports of the same target:

untrust diff last-week.json today.json
untrust diff last-week.json today.json --json

It lists checks that newly fail, were fixed, changed severity or still fail. A check that is missing from one report, or is SKIP or ERROR in either, is not comparable. It is never counted as fixed or new, so a narrower scan cannot look like an improvement. Use the exit code to fail a scheduled job on regressions.