ValidateYAML

Reports and local history

Open a report to inspect it, re-run a saved snapshot to check that it reproduces, or compare two snapshots.

Local history

Stored only in this browser (IndexedDB). Not a backup: clearing site data or browser eviction removes it. Save snapshots from the Report tab of any validator.

No snapshots yet.

Open a report

Reports are read as data and displayed escaped. Nothing in them is executed or fetched.

What a report contains

Input name and SHA-256, YAML profile and effective versions, schema name/version/hash and dialect, unsupported keywords, rule versions and policy overrides, suppressions with state, per-layer statuses and every finding — including muted and suppressed ones. Raw source is excluded unless you opt in; evidence can be redacted.

Questions

Is the SARIF output official?

It follows the SARIF 2.1.0 structure (rules, results, regions in UTF-16 columns, partial fingerprints, external suppressions) so code-scanning tools can ingest it, but this site does not validate it against the official SARIF schema. It is labelled as an adapter with its own version.

Is my YAML uploaded anywhere?

No. Parsing, schema validation, rules, fixes and reports all run in your browser (validation runs in a Web Worker). There is no backend, no account and no content analytics. Drafts and history are stored only in this browser’s IndexedDB, and you can clear them or switch to memory-only mode.