# Share a Burp Suite Report — Evidence Intact, Access Controlled

Canonical: https://commareports.com/share-burp-suite-report
Published: 2026-09-08

> Burp exports a self-contained HTML report with request and response evidence. Publish it to Comma for a revocable URL with a thread per issue instead of an emailed attachment.

# Share a Burp Suite report

Burp's HTML export is genuinely good. Issues grouped by severity and confidence,
the remediation guidance, and — the part that makes it useful rather than
merely alarming — the actual request and response that demonstrated the issue.

```
Target → Site map → right-click host → Report selected issues
  → Report format: HTML
  → Include request/response: as applicable
  → Issue detail: full
```

That evidence is why the report works, and also why sending it is a problem. A
Burp export with full request/response detail typically contains:

- Session cookies and bearer tokens captured during testing.
- API keys in headers or query strings.
- Real user data from whatever accounts were in scope.
- A step-by-step reproduction of every issue that was found.

And the default distribution channel is an email attachment, which is
permanent, uncontrolled and unauditable.

## Publish it

Burp's HTML export is self-contained, so it is a single file. Drag it into
[the app](https://commareports.com/), or POST it:

```bash
curl -fsS -X POST "https://commareports.com/api/v1/reports" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html burp-report.html \
        --arg t "Burp scan — checkout.example.com, 2026-09" \
        '{title: $t, html: $html}')"
```

Report HTML renders inside a sandboxed iframe (`allow-scripts`, no
`allow-same-origin`), so Burp's collapsible issue sections and severity
grouping behave as they do locally.

## Set access before you send the link

This is not optional for this report type. Reports are private by default —
keep it that way and choose deliberately:

- **Named reviewers** for a report with unremediated high or critical issues.
  An explicit list you can see and revoke.
- **Domain-gated** (anyone at `client.com`) once findings are remediated, or
  when the client's team is large enough that maintaining a list is friction
  without benefit.

Never public. See the [sharing model](/docs/sharing).

If the scope of the report is wider than the audience — a full site map export
where one team only needs their service — export the subset from Burp rather
than publishing everything and asking people to ignore the rest.

## Two reports, not one

A pattern worth adopting: export twice.

1. **The technical report** — full issue detail, requests and responses, named
   reviewers, for the engineers doing the fixing.
2. **The summary** — issue counts by severity, no evidence, domain-gated, for
   the people who need to know the state of the system without holding a
   working exploit guide.

Burp's report wizard supports both from the same scan by varying the issue
detail level, and it means the summary can circulate freely without the
evidence circulating with it.

## Retests

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html burp-retest.html \
        --arg t "Burp scan — checkout.example.com, retest" \
        '{title: $t, html: $html}')"
```

One URL for the engagement, one revision per scan. The client's bookmark keeps
working, and the difference between the initial scan and the retest is a diff
rather than two files with dates in the names.

## What review adds

- **Anchored threads** per issue — the fix, the PR, or the false-positive
  argument, on the finding. See [commenting on HTML](/comment-on-html).
- **Revisions**, so remediation is demonstrable rather than asserted.
- **Revocable access**, which is the property an email attachment can never
  have.

## Limits

- **Entry HTML: 5 MB.** A full-detail export of a large site map will exceed
  this — export by host or by severity band rather than the entire site map, and
  publish them as separate reports scoped to their audiences.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a report privately →](https://commareports.com/)**

### Related

- [Share a pentest report](/share-pentest-report) · [Share a ZAP report](/share-zap-report)
- [Share an OpenVAS report](/share-openvas-report) · [Share a security scan report](/share-security-scan-report)
- [Password-protect an HTML report](/password-protect-html-report) · [Share a SARIF report](/share-sarif-report)