I pushed a change draft for Issue #108 : Represent VCS properties: Documents/ChangeDrafts/Active/sarif-v2.0-issue-108-version-control.docx This allows SARIF to specify exactly where in a version control system the scanned files came from. Note the re-use of the term “provenance”, which we first introduced in the context of traceability from a tool’s native output format to the SARIF format. I’ll move to adopt this at Wednesday’s meeting. Thanks, Larry