# Share an InSpec Report — Compliance Controls on a Link

Canonical: https://commareports.com/share-inspec-report
Published: 2026-09-01

> inspec exec --reporter html2 writes a browsable control report. Publish it to Comma so auditors read a URL, exceptions are recorded on the control, and every run appends a revision.

# Share an InSpec report

A compliance run produces two categories of failing control: the ones
that are being fixed and the ones that have been accepted, with a reason,
by someone with the authority to accept them. Both are red. The
difference between them lives in a spreadsheet, a ticket system, or
nowhere at all.

Which is why every audit begins by reconstructing decisions that were
already made.

## Publish it

```bash
inspec exec "$PROFILE" -t "$TARGET" \
  --reporter "html2:report.html" || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html report.html \
        --arg title "InSpec — $PROFILE — $TARGET — $(date +%F)" \
        '{title: $title, html: $html}')"
```

`|| true` because InSpec exits non-zero when controls fail, which is
every run worth publishing.

One report id per profile-and-target pair. `PATCH` appends a revision per
run, so the target has a compliance history rather than a snapshot.

Use a [scoped token](/docs/api-tokens) with `reports:write` only, and
keep the report **private or team-visible** — see the
[sharing model](/docs/sharing).

## What the URL changes

- **Exceptions live on the control.** "Accepted until the image rebuild,
  RISK-42" pinned where the next reviewer will find it. See
  [commenting on HTML](/comment-on-html).
- **Auditors read a link.** No Chef install, no target credentials, no
  screen-share.
- **A pass-rate trend.** Revision per run at one URL. See
  [revisions and diffs](/share-html-report).
- **Scheduled runs.** A [routine](/docs/routines) re-runs the profile
  monthly — see
  [monthly compliance digests](/features/routines/monthly-compliance-digest).

## Limits

- **HTML body: 5 MB.** A large profile against many targets can exceed
  it; publish per target, which is the more useful shape anyway.
- **Scripts run, sandboxed**: `allow-scripts`, no `allow-same-origin`.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Create your first report →](https://commareports.com/)**

### Related

- [Kubescape](/share-kubescape-report) · [KICS](/share-kics-report)
- [Security scan reports](/share-security-scan-report) · [Trivy](/share-trivy-report)
- [Monthly digests](/features/routines/monthly-compliance-digest) · [Publish from CI](/docs/ci)