# Share a gosec Report — Go Security Findings, Already HTML

Canonical: https://commareports.com/share-gosec-report
Published: 2026-09-15

> gosec has a built-in HTML writer: -fmt=html gives you the page directly. Publish it to Comma for a link with anchored threads and a revision per scan.

# Share a gosec report

gosec is unusual among security scanners: it will hand you a rendered page
without a converter in the middle. `-fmt=html` writes the findings, the rule
ids, the severity and confidence, and the offending source lines, all in one
file.

Which leaves exactly one problem — that file is on a CI runner that will be
deleted in ten minutes.

## One command

```bash
go install github.com/securego/gosec/v2/cmd/gosec@latest

gosec -fmt=html -out=gosec.html ./... || true
```

`|| true` because gosec exits non-zero when it finds something, and the run
with findings is the one worth publishing. Keep a separate unmuted gate step
with the severity threshold you enforce.

## Publish it

Drag `gosec.html` into [the app](https://commareports.com/), or from CI:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html gosec.html \
        --arg title "gosec — $GITHUB_REF_NAME" '{title: $title, html: $html}')"
```

**Restrict the access level** — the report includes your source lines. Private
or team-scoped; see the [sharing model](/docs/sharing).

## `#nosec` is where the reasoning goes to die

Every Go codebase running gosec ends up with a scatter of `#nosec G304`
comments. The annotation suppresses the finding; it almost never records why,
and the `-- reason` convention is honoured about half the time.

A published report gives that reasoning somewhere durable:

- **Anchored threads** on the finding: "G304 — the path comes from a fixed
  allowlist three frames up, not user input." Next to the code, readable by
  the next person and by the auditor. See
  [commenting on HTML](/comment-on-html).
- **Revisions**, so a suppression that was added under deadline pressure is
  still visible six months later.
- **A [routine](/features/routines/scheduled-html-reports)** re-scanning on a
  schedule, because new rules ship and old code does not change.

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
  A first scan on a large monorepo is the one that gets close — scan per module
  for the shareable view.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a security report →](https://commareports.com/)**

### Related

- [Share a Semgrep report](/share-semgrep-report) · [Share a golangci-lint report](/share-golangci-lint-report)
- [Share a Trivy report](/share-trivy-report) · [Share a SARIF report](/share-sarif-report)
- [Share a Go test report](/share-go-test-report) · [Share a security scan report](/share-security-scan-report)