# Share Scan and Pentest Findings Without Making Them Public

Canonical: https://commareports.com/for/security-teams
Published: 2026-09-11

> A Trivy, Semgrep or Burp report is exactly the document you can't drop on a public host. Private-by-default reports, scoped tokens, and a retest revision at the same URL.

# Findings you can share and still control

Every generic answer to "how do I share an HTML report" ends in _put it on a
static host_. For a security team that answer is disqualifying. The report
names unpatched hosts, live CVEs, credential locations and, often, the exact
request that worked. It is the one document where a public URL is not a
convenience — it's the finding.

So the requirement isn't distribution. It's **distribution with a floor under
it**.

## Private is the default, not a setting you remember

Reports created through the API start `private`. That ordering matters more
than any individual control: a nightly scan that publishes at 3am cannot
expose anything, because nothing is reachable until a human decides it should
be.

From there, access widens in named steps — invited individuals, team
visibility, or domain-gated viewing that checks the reader's verified email
domain server-side rather than trusting a forwarded link. Five visibility
levels and per-person roles are documented in
[sharing & access control](/docs/sharing).

## Scope the token that publishes

A scanner in CI needs to publish. It does not need to change who can read.
Those are different scopes:

- `reports:write` — create and revise reports.
- `sharing` — change visibility and link permission.

Give the pipeline the first and not the second, and a compromised CI token
cannot turn a pentest report public. Tokens are revocable, expirable and
rate-limited per token — see [API tokens](/docs/api-tokens) and
[scoped tokens for AI agents](/agents/scoped-tokens-for-ai-agents).

## The tools you're already running

[Trivy](/share-trivy-report) · [Semgrep](/share-semgrep-report) ·
[Snyk](/share-snyk-report) · [SARIF](/share-sarif-report) ·
[ZAP](/share-zap-report) · [Burp Suite](/share-burp-suite-report) ·
[Nmap](/share-nmap-report) · [Nikto](/share-nikto-report) ·
[OpenVAS](/share-openvas-report) · [Grype](/share-grype-report) ·
[OSV-Scanner](/share-osv-scanner-report) · [Bandit](/share-bandit-report) ·
[Brakeman](/share-brakeman-report) · [Gitleaks](/share-gitleaks-report) ·
[TruffleHog](/share-trufflehog-report) · [Checkov](/share-checkov-report) ·
[KICS](/share-kics-report) · [Kubescape](/share-kubescape-report) ·
[Prowler](/share-prowler-report) · [ScoutSuite](/share-scoutsuite-report) ·
[InSpec](/share-inspec-report) · [testssl.sh](/share-testssl-report) ·
[Dependency-Check](/share-dependency-check-report) ·
[npm audit](/share-npm-audit-report) · [SBOM](/share-sbom-report) ·
[pentest reports](/share-pentest-report).

Interactive findings tables keep working — severity filters, expandable
evidence, links between findings — because scripts run in a sandboxed iframe
rather than being stripped.

## Retest at the same address

Remediation is a loop, and the loop needs one URL. Publish the original
assessment, then publish the retest as a **revision of the same report**. The
Jira ticket keeps its link; the history answers "what closed, and when"
without diffing two PDFs.

When a developer disputes a finding, they dispute it **on the finding** — an
anchored comment on that row, not an email that says "the third one is a false
positive." See [commenting on HTML](/comment-on-html).

## When even the server shouldn't read it

Zero-knowledge encrypted reports encrypt in the browser with a key derived
from your passphrase; the server stores ciphertext only. The tradeoff is
explicit and unavoidable: an encrypted report can't be link-shared, scheduled,
or delivered to team destinations, because the server genuinely cannot read
it. Use it for the material where that's the right trade. See
[Security](/security).

## Worth knowing

- **Enterprise controls:** audit log, IP allowlist, SSO/SAML with SCIM,
  password-protected and expiring links, DPA, on-prem deployment.
- **Redact before publishing, not after.** A scan report often embeds request
  and response bodies. Whatever your scanner's redaction flag is, set it — the
  hosting layer cannot know which header was a session token.
- **Limits.** Entry HTML 5 MB; assets 25 MB per file, 250 MB and 500 files per
  report. Large scan outputs usually exceed the file count as per-finding
  JSON; use the scanner's merged HTML export.

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history. Private by default.

**[Start free →](/login)** · **[Read the security model →](/security)**

### Related

- [For consultants](/for/consultants) · [For SRE teams](/for/sre-teams)
- [Password-protect an HTML report](/password-protect-html-report) ·
  [Share a security scan report](/share-security-scan-report)
- [Sharing & access control](/docs/sharing) · [API tokens](/docs/api-tokens)