@@ -5,6 +5,7 @@ All notable changes will be documented in this file.
 ## [Unreleased]
 
 ### Added
+- `--report=<path>` writes the JSON report somewhere other than `./ai-slop-report.json`, and `--no-report` skips it, so a scan no longer has to leave a file in the working tree.
 - `swallowed_error` (medium): a `catch` block whose only statements are `console` calls. The error is logged and the code carries on as if the operation succeeded. A comment in the block explaining why that is safe, a rethrow, or any other statement (such as `setError(e)`) means it is not reported, and so does a fallback after the `try`, as for `empty_catch`.
 
 ### Changed
 
@@ -62,7 +62,7 @@ npx karpeslop@latest -- -dash-file.ts # paths that start with "-"
 npx karpeslop@latest --help           # list every rule
 ```
 
-A JSON report is written to `./ai-slop-report.json`.
+A JSON report is written to `./ai-slop-report.json`. `--report=<path>` writes it elsewhere, and `--no-report` skips it.
 
 ### Exit codes
 
 
@@ -270,11 +270,20 @@ export class ConfigError extends Error {}
 /** A command-line flag with a value KarpeSlop does not accept. */
 export class UsageError extends Error {}
 
-const KNOWN_FLAGS = new Set(['--help', '-h', '/?', '--version', '-v', '--quiet', '-q', '--strict', '-s']);
+const KNOWN_FLAGS = new Set(['--help', '-h', '/?', '--version', '-v', '--quiet', '-q', '--strict', '-s', '--no-report']);
 
 /** Flags KarpeSlop does not know. A typo such as `--stirct` would otherwise run without the option. */
 export function unknownFlags(flagArgs: readonly string[]): string[] {
-  return flagArgs.filter(arg => !KNOWN_FLAGS.has(arg) && !arg.startsWith('--fail-on='));
+  return flagArgs.filter(arg => !KNOWN_FLAGS.has(arg) && !arg.startsWith('--fail-on=') && !arg.startsWith('--report='));
+}
+
+/** Where to write the JSON report: `--report=<path>`, nowhere with `--no-report`, else ./ai-slop-report.json. */
+export function reportPathFrom(flagArgs: readonly string[], rootDir: string): string | undefined {
+  const flag = flagArgs.filter(arg => arg.startsWith('--report=')).at(-1);
+  const value = flag?.slice('--report='.length);
+  if (value === '') throw new UsageError('--report needs a file path, e.g. --report=reports/karpeslop.json');
+  if (flagArgs.includes('--no-report')) return undefined;
+  return path.resolve(rootDir, value ?? 'ai-slop-report.json');
 }
 
 /** The severity named by `--fail-on=<severity>`, high when absent. Throws on an unknown value. */
@@ -1054,6 +1063,7 @@ class AISlopDetector {
       issues: consolidatedIssues
     };
 
+    fs.mkdirSync(path.dirname(outputPath), { recursive: true });
     fs.writeFileSync(outputPath, JSON.stringify(results, null, 2));
     console.log(`\nReport written to ${outputPath}`);
   }
@@ -1082,6 +1092,8 @@ Options:
   --strict, -s   Exit with code 2 if critical findings (wrong imports, nonexistent packages) are present
   --fail-on=<severity>
                  Lowest severity that fails the run with exit 1: critical, high (default), medium or low
+  --report=<path> Write the JSON report to <path> (default ./ai-slop-report.json)
+  --no-report    Do not write the JSON report
   --version, -v  Show version information
   --             End of flags; treat remaining args as paths (even if they start with -)
 
@@ -1133,8 +1145,10 @@ async function runIfMain() {
     process.exit(1);
   }
   let failOn: Severity;
+  let reportPath: string | undefined;
   try {
     failOn = failOnFrom(flagArgs);
+    reportPath = reportPathFrom(flagArgs, rootDir);
   } catch (error) {
     if (!(error instanceof UsageError)) throw error;
     console.error(`KarpeSlop: ${error.message}`);
@@ -1145,8 +1159,7 @@ async function runIfMain() {
 
   try {
     const issues = await detector.detect(quiet);
-    const outputPath = path.join(rootDir, 'ai-slop-report.json');
-    detector.exportResults(outputPath);
+    if (reportPath !== undefined) detector.exportResults(reportPath);
 
     const criticalIssues = issues.filter(i => i.severity === 'critical');
     if (strict && criticalIssues.length > 0) {
 
@@ -16,6 +16,7 @@ import {
   isRegistryBackedLockfileEntry,
   parseVersionRange,
   pLimit,
+  reportPathFrom,
   shouldAnalyzePathInQuietMode,
   splitCliArgs,
   uniqueRealFiles,
@@ -637,6 +638,29 @@ test('a path that cannot be scanned gives a one-line error, not a stack trace',
   assert.equal(/\n\s+at /.test(result.stderr), false, result.stderr);
 });
 
+test('the report path comes from --report=<path>, and --no-report writes none', () => {
+  assert.equal(reportPathFrom([], '/repo'), path.resolve('/repo', 'ai-slop-report.json'));
+  assert.equal(reportPathFrom(['--report=out/k.json'], '/repo'), path.resolve('/repo', 'out/k.json'));
+  assert.equal(reportPathFrom(['--report=a.json', '--no-report'], '/repo'), undefined);
+  assert.throws(() => reportPathFrom(['--report='], '/repo'), /--report needs a file path/);
+  assert.throws(() => reportPathFrom(['--report=', '--no-report'], '/repo'), /--report needs a file path/);
+  const projectDir = fs.mkdtempSync(path.join(os.tmpdir(), 'karpeslop-report-'));
+  fs.writeFileSync(path.join(projectDir, 'index.ts'), 'export const a = 1;\n', 'utf-8');
+  const run = (...flags: string[]) => spawnSync(
+    process.execPath,
+    ['--import', import.meta.resolve('tsx'), path.resolve(process.cwd(), 'ai-slop-detector.ts'), ...flags],
+    { encoding: 'utf-8', cwd: projectDir, env: { ...process.env, KARPESLOP_OFFLINE: '1' } }
+  );
+  try {
+    assert.equal(run('--no-report').status, 0);
+    assert.equal(fs.existsSync(path.join(projectDir, 'ai-slop-report.json')), false);
+    assert.equal(run('--report=reports/karpeslop.json').status, 0);
+    assert.equal(fs.existsSync(path.join(projectDir, 'reports', 'karpeslop.json')), true);
+  } finally {
+    fs.rmSync(projectDir, { recursive: true, force: true });
+  }
+});
+
 test('unknown flags are rejected instead of silently ignored', () => {
   assert.deepEqual(unknownFlags(['--quiet', '-s', '--fail-on=low']), []);
   assert.deepEqual(unknownFlags(['--stirct', '--json', '-dash-file.ts']), ['--stirct', '--json', '-dash-file.ts']);