Understanding output

Every check produces two things: a value (the text, e.g. Full RELRO) and a status that drives the color. The status is the quickest way to read a report at a glance.

Color legend

Swatch	Status (JSON/XML/YAML)	Meaning
green	green	Good. The mitigation is present and effective.
yellow	yellow	Warning. Partial protection, or checksec could not determine the state (see Unknown below).
red	red	Bad. The mitigation is missing/disabled, or an error occurred reading the binary.
plain	unset	Informational. Neutral facts that aren't good or bad — counts, DSO, the active sanitizer set.
italic	italic	Not applicable. The check doesn't apply to this kind of binary.

In the terminal these map to ANSI colors; in json/xml/yaml they appear as the literal status string shown above. Color can be forced or disabled with --color always|never.

Unknown vs N/A

These two look similar but mean different things — this is the most common point of confusion (see issue #346).

Unknown (yellow) — checksec couldn't tell

The check ran, but the binary didn't carry enough information to reach a verdict. The classic example is FORTIFY Lvl → Unknown: the FORTIFY level is read from annobin compiler notes, and this binary was built without annobin (common outside RHEL/Fedora toolchains). checksec can't prove the level either way, so it reports Unknown rather than guessing.

Unknown is not a failure — it means "indeterminate." Other checks that can report Unknown include CFI, Stack Clash, and GLIBCXX assertions.

N/A (italic) — the check doesn't apply

The mitigation is meaningless for this binary type. For example, W^X segment reports N/A for relocatable object files (.o) that have no loadable segments to check.

Status values

The machine-readable status field takes one of these literal values:

status	Color	Source constant
green	green	StatusGood
yellow	yellow	StatusWarn
red	red	StatusBad / StatusError
unset	plain	StatusInfo
italic	italic	StatusNA

Each check's report also has a stable key (the JSON/YAML map key, e.g. relro, fortify_level). Those keys are what you pass to --fail-if, and they're listed on every check reference page.

Reading a row

RELRO       Stack Canary  CFI      ...
Full RELRO  Canary Found  Unknown  ...
   ▲             ▲           ▲
 green         green       yellow  → "good, good, couldn't determine CFI"

A healthy modern binary is mostly green with a few neutral/plain columns. Yellow and red are the cells worth investigating — head to the relevant check reference page to learn what the value means and how to fix it.