Scanner ingestion
Redline consumes the scanners a repository already runs rather than competing with them — one severity contract across every producer, and one measure of whether anyone acted.
The argument this ends
Redline produces findings, and so do CodeQL, Snyk, Semgrep and whatever else an organisation already licenses. Each has its own severity vocabulary, its own dashboard, and its own answer to “did anyone act on this”. Nobody can see the estate.
Redline's own diff secret scan and dependency review are weaker than a real scanner stack and always will be. Consuming those tools turns that weakness into the product: one severity contract and one acted-on measure across LLM review and static analysis together. Redline never runs a scanner, and no repository is asked to change which ones it runs.
Ingested findings are always distinguishable
This is the one way ingestion could make things worse than not doing it. Rule tuning reads the finding stream, so a view that could not tell a CodeQL finding from a Redline one would tune Redline's rules on another tool's noise. Every ingested finding carries its source and its tool, keeps the producer's own rule id, and aggregates in its own bucket.
An ingested rule id is never rewritten into a Redline id. A scanner's finding is that scanner's claim; relabelling it would make every rule aggregate in the estate fiction. Acted-on rate is computed within each source and never across — Redline's is a resolved review thread, a scanner's is a closed alert, and averaging two definitions describes neither.
They are measured, never gating
An ingested finding does not block a merge, at any rung. Gating on another tool's output makes Redline responsible for that tool's false positives, and the bundle self-check fails the build if the gate ever starts reading code scanning.
Severity mapping is configurable and visible
Mapping a foreign vocabulary onto three levels is a judgement call that will be wrong somewhere. So the default table is overridable per repository, and every finding carries both the mapped severity and the producer's own word — a disagreement about the mapping is arguable from the record rather than requiring a re-ingest.
| Their word | Redline severity |
|---|---|
| error, critical, high | BLOCKER |
| warning, medium, moderate | HIGH |
| note, none, low, info | SUGGESTION |
| anything unrecognised | SUGGESTION, and reported |
An unrecognised severity falls back to SUGGESTION, never BLOCKER, and says so. The asymmetry is deliberate: a wrong BLOCKER blocks a merge and teaches people the gate is noise; a wrong SUGGESTION is a line in a report.
Where it shows up
The dashboard's Finding sources view shows both catalogues side by side without merging them. When it is empty, that is itself the answer to whether ingestion was worth building for your estate — and the signal that the effort belongs elsewhere.