# Share a Brakeman Report — Rails Security Findings at a URL

Canonical: https://commareports.com/share-brakeman-report
Published: 2026-08-30

> brakeman -f html -o brakeman.html produces a single self-contained file that still ends up as a screenshot in a channel. Publish it to Comma so each finding gets a thread and a decision.

# Share a Brakeman report

Brakeman is the rare security tool whose output people actually read — when
they can get to it. The default path is:

```bash
brakeman -f html -o brakeman.html
```

One self-contained file, sitting in a CI workspace that expires in 30 days,
summarized in a channel as _"brakeman found 14 things, mostly noise"_.

Nobody triages "mostly noise". That is how a real finding stays open for a
quarter.

## Publish it

Drag `brakeman.html` into [the app](https://commareports.com/), or from CI:

```bash
brakeman -f html -o brakeman.html || true

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html brakeman.html \
        --arg title "Brakeman — $GITHUB_SHA" '{title: $title, html: $html}')"
```

Brakeman exits non-zero when it finds warnings. Either tolerate that exit code
on the scan step (as above) or run the publish step with `if: always()` —
otherwise the runs that publish are exactly the ones with nothing to read.

## Keep it private

A Brakeman report is a list of your application's soft spots with file paths
and line numbers attached. Reports are private by default and stay that way
until you change it. The options, in the [sharing model](/docs/sharing):
team-wide, gated to your email domain, opened to named reviewers, or — if you
must send it outside the company, to an auditor or a client —
[password-protected](/password-protect-html-report) rather than a bare link.

## Triage in place

The value of a published scan is that triage becomes a record:

- **Anchored threads** on the individual warning — "false positive, the param
  is an enum", "real, ticketed as SEC-114". See
  [commenting on HTML](/comment-on-html).
- **Revisions** — PATCH one report id per repo and each scan appends a
  revision, so a new warning is visibly new rather than lost in a list of 14.
- **Resolved threads** keep the decision attached to the finding, which is
  what you want the next time an auditor asks why it is still there.

## On a schedule

Security scans age badly. A [routine](/features/routines) can run the scan and
PATCH the report on a cron, so the URL you handed to the security reviewer
last quarter reflects this week's code — see
[monthly compliance digest](/features/routines/monthly-compliance-digest).

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a scan report →](https://commareports.com/)**

### Related

- [Share a security scan report](/share-security-scan-report) · [Share a RuboCop report](/share-rubocop-report)
- [Share a SimpleCov report](/share-simplecov-report) · [Share a Semgrep report](/share-semgrep-report)
- [Password-protect a report](/password-protect-html-report) · [Publish from CI](/docs/ci)