# Share an npm audit Report — Something Better Than a Terminal Dump

Canonical: https://commareports.com/share-npm-audit-report
Published: 2026-08-23

> npm audit output is 900 lines of terminal text nobody re-reads. Render it to HTML, publish it to Comma, and get a link where each advisory has a thread and each run is a revision.

# Share an npm audit report

`npm audit` is one of the few security tools every JavaScript team already
runs, and one of the least acted upon. The output is terminal text, it scrolls
past in CI, and its recommendation is frequently `npm audit fix --force`,
which nobody is going to run on a Friday. So the audit becomes noise that the
build prints and the team filters out.

The fix is not a different scanner. It is putting the results somewhere a
human decision can attach to them.

## Publish it

```bash
npm audit --json > audit.json || true
npx npm-audit-html --input audit.json --output audit.html

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html audit.html \
        --arg title "npm audit — web — $(date +%F)" \
        '{title: $title, html: $html}')"
```

`|| true` because a non-zero exit means findings, which is the case you care
about. PATCH keeps one URL per workspace with a revision per run.

## Or render your own digest

The full advisory list is not what a team discusses. What it discusses is:
what is new since last week, what is high severity and reachable, what is
blocked on a major bump. Three rows of HTML built from `audit.json` beats 900
lines of rendered advisories, and it gives reviewers something short enough
to actually read — and to comment on. See
[commenting on HTML](/comment-on-html).

## What the URL changes

- **Accepted advisories stay accepted**, with the reason attached.
- **Each run is a revision**, so "did that upgrade help" is a diff, not a
  memory test.
- **A weekly digest posts itself.** A [routine](/docs/routines) can run the
  audit on a cron and publish the refreshed report to the same URL.

## Limits

- **HTML body: 5 MB.** Deep dependency trees can render large — publish a
  digest and attach the raw JSON as an [asset](/docs/api).
- **Scripts run, sandboxed:** `allow-scripts`, no `allow-same-origin`.
- **60 requests/minute per token.** Use a
  [scoped token](/docs/api-tokens) with `reports:write` only.

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish an audit →](https://commareports.com/)**

### Related

- [Snyk reports](/share-snyk-report) · [Trivy reports](/share-trivy-report)
- [OWASP ZAP reports](/share-zap-report) · [Security scan reports](/share-security-scan-report)
- [Publish from CI](/docs/ci) · [GitHub Actions](/ci/github-actions-html-report)