# Share a Kubescape Report — Cluster Posture on a Link

Canonical: https://commareports.com/share-kubescape-report
Published: 2026-09-01

> Kubescape scans a cluster or manifests against NSA, MITRE and CIS controls and writes an HTML report. Publish it to Comma for one URL per cluster, threads per control, and a revision per scan.

# Share a Kubescape report

A Kubernetes posture score is a number that only means something over
time, and against a set of decisions. Control 1.2.3 is failing because a
DaemonSet legitimately needs `hostPID`. Control 4.5.6 is failing because
nobody has got to it. Same red row, completely different follow-up.

Kubescape writes the rows. Where the follow-up lives is up to you, and
in most setups it lives in a Slack thread that is gone by the next scan.

## Publish it

```bash
kubescape scan framework nsa \
  --format html --output kubescape.html || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html kubescape.html \
        --arg title "Kubescape — $CLUSTER — $(date +%F)" \
        '{title: $title, html: $html}')"
```

`|| true` because a failing threshold is the run you want at a URL. One
report id per cluster or per environment; `PATCH` appends a revision each
scan, so `prod` has a posture history rather than a current snapshot.

Use a [scoped token](/docs/api-tokens) with `reports:write` only. Keep it
**private or team-visible** — see the [sharing model](/docs/sharing).

## What the URL changes

- **Exemptions are documented where they apply.** "hostPID required by
  the CNI, accepted 2026-07" pinned to the control. See
  [commenting on HTML](/comment-on-html).
- **The score has a shape.** Revision over revision shows whether the
  hardening work is landing. See [revisions and diffs](/share-html-report).
- **Compliance reviewers get a link**, not a cluster credential.
- **Scheduled scans.** A [routine](/docs/routines) rescans nightly, so
  drift from a `kubectl edit` surfaces on its own — see
  [monthly compliance digests](/features/routines/monthly-compliance-digest).

## Limits

- **HTML body: 5 MB.** A large multi-tenant cluster report can approach
  it; scan per namespace or per framework and keep a report for each.
- **Scripts run, sandboxed**: `allow-scripts`, no `allow-same-origin`.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Create your first report →](https://commareports.com/)**

### Related

- [KICS](/share-kics-report) — the manifests before they are applied
- [Trivy](/share-trivy-report) · [Security scan reports](/share-security-scan-report)
- [Compliance digests](/features/routines/monthly-compliance-digest) · [Publish from CI](/docs/ci)