# Share a KICS Scan Report — IaC Findings on a Reviewable Link

Canonical: https://commareports.com/share-kics-report
Published: 2026-09-01

> KICS writes an HTML report of your Terraform, Kubernetes and CloudFormation findings. Publish it to Comma for a stable URL per stack, threads on individual queries, and a revision per scan.

# Share a KICS scan report

KICS finds the misconfiguration. It cannot find out whether you meant it.

That second part is the whole job — a public S3 bucket that is a static
site, a privileged container that is a CNI plugin, an open security group
someone accepted last quarter with a reason. The scanner produces the
list; a person produces the verdict; and the verdict, in most pipelines,
is stored nowhere.

## Publish it

```bash
kics scan -p . --report-formats html -o ./kics-out || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html ./kics-out/results.html \
        --arg title "KICS — $STACK — $(date +%F)" \
        '{title: $title, html: $html}')"
```

`|| true` because KICS exits non-zero on HIGH severity results, and that
is the run you most want published rather than swallowed by a failed job.

`PATCH` on a per-stack report id gives you one URL with a revision per
scan. Use a [scoped token](/docs/api-tokens) with `reports:write` only,
and keep the report **private or team-visible** — see the
[sharing model](/docs/sharing).

## What the URL changes

- **Verdicts stick to findings.** "Accepted — this bucket is the docs
  site, tracked in INFRA-88" pinned to the query result, still there next
  scan. See [commenting on HTML](/comment-on-html).
- **Scan-over-scan diffs.** Which queries are new since the last apply,
  which the hardening PR actually cleared.
- **Auditors read a link.** No CI access, no pipeline permissions.
- **Scheduled rescans.** A [routine](/docs/routines) re-scans on a cron,
  so drift from a console change shows up without anyone pushing code.

## Limits

- **HTML body: 5 MB.** A large monorepo scan can exceed it; scan per
  stack, or filter with `--severity HIGH,MEDIUM` for the published view
  and attach the full JSON as an [asset](/docs/api).
- **Scripts run, sandboxed**: `allow-scripts`, no `allow-same-origin`.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Create your first report →](https://commareports.com/)**

### Related

- [Terraform plans](/share-terraform-plan) — the change, not the config
- [Checkov](/share-checkov-report) · [Trivy](/share-trivy-report) — neighbouring scanners
- [Compliance digests](/features/routines/monthly-compliance-digest) · [Publish from CI](/docs/ci)