# Share a Nuclei Report — Findings at a URL, Not in a Terminal Scrollback

Canonical: https://commareports.com/share-nuclei-report
Published: 2026-09-12

> nuclei -me writes a markdown export and -j gives you JSONL. Render either to HTML and publish it to Comma so findings get a link, a triage thread, and a run history.

# Share a Nuclei report

Nuclei's output is a stream of lines in a terminal, and the terminal belongs
to whoever ran the scan. Triage requires the opposite: one artifact, one
ordering, one place where "we accepted this risk in March" is written down.

## Render the findings to HTML

From JSONL, sorted by severity:

```bash
nuclei -l targets.txt -j -o results.jsonl -silent

jq -sr '
  def rank: {critical:0, high:1, medium:2, low:3, info:4}[.info.severity] // 5;
  sort_by(rank)
  | "<table><tr><th>Severity</th><th>Template</th><th>Host</th><th>Matched</th></tr>"
    + (map("<tr><td>" + .info.severity + "</td><td>" + .info.name
           + "</td><td>" + .host + "</td><td>" + (."matched-at" // "") + "</td></tr>") | add)
    + "</table>"
' results.jsonl > nuclei.html
```

Or from the markdown export:

```bash
nuclei -l targets.txt -me nuclei-md -silent
pandoc nuclei-md/*.md -o nuclei.html --standalone --embed-resources
```

Then publish:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html nuclei.html \
        --arg title "Nuclei — prod edge, $(date +%F)" '{title: $title, html: $html}')"
```

Keep the report **private or team-only**. A scan report is a map of what is
exploitable; see the [sharing model](/docs/sharing) for the visibility options.

## Why triage needs the review layer

- **Anchored threads** — "accepted, WAF rule 42 covers this" sits on the
  finding, so the same finding does not get re-triaged next month. See
  [commenting on HTML](/comment-on-html).
- **Revisions** — one report id per target; a new row between two revisions is
  a new finding.
- **Access per report** — private, team-only, or domain-gated, decided per
  scan.

## Limits

- **Entry HTML: 5 MB.** A broad template run against many hosts can exceed it;
  filter to `-severity critical,high,medium` for the review copy.
- **Assets: 25 MB per file, 250 MB and 500 files per report.**
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a scan report →](https://commareports.com/)**

### Related

- [Share a security scan report](/share-security-scan-report) · [Share a ZAP report](/share-zap-report)
- [Share a Trivy report](/share-trivy-report) · [Share CodeQL results](/share-codeql-results)
- [Share a pentest report](/share-pentest-report) · [For security teams](/for/security-teams)