I pushed a change draft for Issue #243 , “Consider making file.hashes a dictionary.” Documents/ChangeDrafts/Active/sarif-v2.0-issue-243-fileHashesDictionary.docx We will move its adoption at TC #24 on Wednesday 9/26. This is similar to what we did last time with run.graphs and result.graphs : it makes it easier to locate a particular hash value. A subtlety is that this time, there is nothing in the format that refers to file.hashes . Rather, it is clients who would want to look up hash values. If they are lucky, they have an SDK that translates object-valued properties like file.hashes into dictionaries for easy lookup. That’s what the .NET SDK does. Thanks, Larry