I opened these two issues: #157 : Clarify requirements on tool.semanticVersion It MAY be present, and it must conform to SemVer in both syntax and semantics. #158 : Introduce result.correlationId and clarify purpose of result.fingerprints We will have: 1. result.id , a GUID, unique across every result reported in every run. 2. result.correlationId , a GUID, common to a set of results that are logically identical. 3. result.fingerprints , an array of calculated values, each of which captures a stable identifier for a set of logically identical results. An array, so that a result management system can improve a fingerprint without losing the old value. This supports both Michael’s and Yekaterina’s/SCA’s usage scenarios. Larry