Can a report stay private and still be shared?

Yes — that's the default. Reports created over the API start private, and you widen deliberately: named invites, team visibility, or domain-gated viewing that checks the reader's verified email domain server-side. Public is a choice you make, never a state you land in.

How do I stop a CI token from making a report public?

Scope it. Publishing uses reports:write; changing access requires the separate sharing scope. A pipeline token that can publish a scan therefore cannot widen who sees it.

How are retests handled?

As a revision at the same URL. The remediation ticket keeps one link, and the history shows which findings closed between the original test and the retest — which is what an auditor asks for.

What about reports that must never touch a server in readable form?

Zero-knowledge encrypted reports encrypt in your browser; the server stores only ciphertext. The deliberate tradeoff is that they cannot be link-shared, scheduled, or sent to team destinations — the server can't read them, so it can't serve them to anyone but you.

Is there an audit trail of who opened a finding?

Audit log, IP allowlist, SSO/SAML and on-prem deployment are Enterprise features. Revision history and comment threads are on every plan.

Findings you can share and still control

Every generic answer to "how do I share an HTML report" ends in put it on a static host. For a security team that answer is disqualifying. The report names unpatched hosts, live CVEs, credential locations and, often, the exact request that worked. It is the one document where a public URL is not a convenience — it's the finding.

So the requirement isn't distribution. It's distribution with a floor under it.

Private is the default, not a setting you remember

Reports created through the API start private. That ordering matters more than any individual control: a nightly scan that publishes at 3am cannot expose anything, because nothing is reachable until a human decides it should be.

From there, access widens in named steps — invited individuals, team visibility, or domain-gated viewing that checks the reader's verified email domain server-side rather than trusting a forwarded link. Five visibility levels and per-person roles are documented in sharing & access control.

Scope the token that publishes

A scanner in CI needs to publish. It does not need to change who can read. Those are different scopes:

reports:write — create and revise reports.
sharing — change visibility and link permission.

Give the pipeline the first and not the second, and a compromised CI token cannot turn a pentest report public. Tokens are revocable, expirable and rate-limited per token — see API tokens and scoped tokens for AI agents.

The tools you're already running

Trivy · Semgrep · Snyk · SARIF · ZAP · Burp Suite · Nmap · Nikto · OpenVAS · Grype · OSV-Scanner · Bandit · Brakeman · Gitleaks · TruffleHog · Checkov · KICS · Kubescape · Prowler · ScoutSuite · InSpec · testssl.sh · Dependency-Check · npm audit · SBOM · pentest reports.

Interactive findings tables keep working — severity filters, expandable evidence, links between findings — because scripts run in a sandboxed iframe rather than being stripped.

Retest at the same address

Remediation is a loop, and the loop needs one URL. Publish the original assessment, then publish the retest as a revision of the same report. The Jira ticket keeps its link; the history answers "what closed, and when" without diffing two PDFs.

When a developer disputes a finding, they dispute it on the finding — an anchored comment on that row, not an email that says "the third one is a false positive." See commenting on HTML.

When even the server shouldn't read it

Zero-knowledge encrypted reports encrypt in the browser with a key derived from your passphrase; the server stores ciphertext only. The tradeoff is explicit and unavoidable: an encrypted report can't be link-shared, scheduled, or delivered to team destinations, because the server genuinely cannot read it. Use it for the material where that's the right trade. See Security.

Worth knowing

Enterprise controls: audit log, IP allowlist, SSO/SAML with SCIM, password-protected and expiring links, DPA, on-prem deployment.
Redact before publishing, not after. A scan report often embeds request and response bodies. Whatever your scanner's redaction flag is, set it — the hosting layer cannot know which header was a session token.
Limits. Entry HTML 5 MB; assets 25 MB per file, 250 MB and 500 files per report. Large scan outputs usually exceed the file count as per-finding JSON; use the scanner's merged HTML export.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history. Private by default.

Start free → · Read the security model →