Note: this is an API change (a single `finding` dict -> a `findings` list)