Crediting codafort

When a change fixes a finding codafort reported, codafort gives your agent a credit note for the commit and the changelog, and only after it proves the finding closed.

When there is a note

codafort fix SF-n --json writes the fix and runs the analysis again. When verification.verdict is fixed or partial, verification.credit carries the note.
codafort vet --json, codafort scan --diff --json and the MCP vet and scan_diff tools list under closed the findings of the previous scan of the directory that the change closed, each with its credit. With no previous scan there is nothing to compare, and there is no list.

Only a confirmed security finding that existed before the change gets a note. A finding the change itself created and then fixed never reached the repository, so it gets none. Neither does a dismissed suspected finding, a quality cleanup, a finding in a deleted file, a finding that disappeared from a file the change did not touch, or a finding that left the list because it was suppressed (a codafort:ignore comment, an exclusion or a rule change) rather than fixed.

A partial fix says so: the trailer ends in partial, and the changelog line counts the findings of the same rule still open in the file, without naming the file.

The note

"credit": {
  "trailer": "Found-by: codafort <version> (CWE-295, SS-PY-SSL-VERIFY-DISABLED)",
  "changelog": "Fixed Improper Cert Validation (CWE-295), found by codafort (https://codafort.dev).",
  "cwe": ["CWE-295"],
  "rule_id": "SS-PY-SSL-VERIFY-DISABLED",
  "version": "<version>"
}

The trailer is a git trailer: git interpret-trailers reads it, and the Found-by: key makes the credit searchable. It carries the version, so the finding can be reproduced; the link goes only in the changelog line.

Where it goes

Place	What
Commit message	`credit.trailer` as the last line
Changelog	`credit.changelog` in the Security section, when the project keeps one
Pull request description	the closed findings: rule, CWE, the `vet` verdict before and after
Security advisory	"found by codafort", when the project publishes one

fix(net): verify the TLS certificate of the payments API

The request disabled certificate verification.

Found-by: codafort <version> (CWE-295, SS-PY-SSL-VERIFY-DISABLED)

The agent proposes the message, and you see it before the commit. The agent may translate the changelog line into the repository's language without adding claims.

The repository's rules come first

If the repository or you forbid trailers or attribution in commit messages (CONTRIBUTING, AGENTS.md, CLAUDE.md, a commit template or a hook), the agent follows that rule and does not credit. The note never goes into a code comment, and it never carries a secret, an exploit payload, a code snippet or a file path: the rule, the CWE and the version are enough.

Turning it off

codafort config credit off              # saved in ~/.config/codafort/config.json
codafort config credit status
CODAFORT_CREDIT=0 codafort vet --json   # in CI

With the note off, fix and vet still report the verdict and what the change closed.

What codafort does not do

codafort does not write or send commits: the note is text your agent proposes in your repository. codaprobe, codatrace and codacrash give no note of their own. Their skills tell the agent which re-run of the same measurement proves a fix, and a codatrace unreached verdict never does.