# Share an OWASP Dependency-Check Report — Triage It, Don't Archive It

Canonical: https://commareports.com/share-dependency-check-report
Published: 2026-08-24

> dependency-check-report.html lands in a CI artifact and expires unread. Publish it to Comma for a URL with anchored comments, so 'this CVE isn't reachable' is recorded once instead of re-argued every scan.

# Share an OWASP Dependency-Check report

Dependency-Check does the hard part well: it walks your dependency tree,
matches artifacts against the NVD, and writes an HTML report with the evidence
that led to each match. Then the report goes where every scanner report goes —
a CI artifact, unread, expiring on a retention schedule — and the security
conversation reverts to a ticket that says "fix the criticals."

The report is not the problem. **Triage** is the problem, and triage is a
conversation that needs somewhere to live.

## Publish the report

```bash
dependency-check --scan ./ --format HTML --out reports/
```

```bash
curl -fsS -X POST "https://commareports.com/api/v1/reports" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html reports/dependency-check-report.html \
        --arg title "Dependency-Check — $(date +%Y-%m-%d)" \
        '{title: $title, html: $html, visibility: "private"}')"
```

The report is one self-contained file — inline CSS, inline script — so there
is nothing else to upload, and the collapsible evidence panes still work
inside the sandboxed iframe.

Set visibility deliberately. A list of unpatched CVEs in your own dependency
tree is a map for an attacker, so create it `private` and widen from there —
team, email-domain, or named reviewers. See the [sharing model](/docs/sharing).

## Triage that survives the next scan

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html reports/dependency-check-report.html '{html: $html}')"
```

One report id per repository. Each scan appends a revision at the same URL,
and the comment threads stay attached to what they were about. That is the
whole trick:

- **"Not reachable — the vulnerable parser is never called."** Recorded on
  the finding, visible to whoever reads the next scan.
- **"Waiting on upstream, tracked in SEC-412."** Attached, not remembered.
- **"This one is real, patching this sprint."** With a date on it.

Without that, every scan restarts the same argument with the same three
people. See [commenting on HTML](/comment-on-html).

## What changed since last week

The diff between two revisions is the answer to the only question that
matters in a recurring scan: which findings are new. A weekly
[routine](/features/routines/scheduled-html-reports) can run the scan and publish it on
a schedule, so the report arrives without anyone remembering to produce it.

## Limits

- **HTML body: 5 MB.** A monorepo scan with full evidence can exceed it —
  scan per module, or use `--format HTML --format JSON` and publish the HTML
  per project.
- **Scripts run, sandboxed:** `allow-scripts`, no `allow-same-origin`.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a scan report →](https://commareports.com/)**

### Related

- [Share a Trivy report](/share-trivy-report) · [Share a Snyk report](/share-snyk-report)
- [Share an npm audit report](/share-npm-audit-report) · [Share a ZAP report](/share-zap-report)
- [Share a security scan report](/share-security-scan-report) · [Security at Comma](/security)