# Share an OSV-Scanner HTML Report — Vulnerability Findings at a URL

Canonical: https://commareports.com/share-osv-scanner-report
Published: 2026-08-31

> osv-scanner --format html writes a self-contained vulnerability report. Publish it to Comma for a link security and engineering can triage on together.

# Share an OSV-Scanner HTML report

OSV-Scanner reads your lockfiles, matches them against the OSV database and
tells you which of your transitive dependencies has a published advisory. It
writes HTML directly, which puts it ahead of most scanners — the missing piece
is somewhere to put the file that is not a CI artifact bucket.

## Run the scan

```bash
osv-scanner scan source -r . --format html --output osv.html || true
```

Container images and SBOMs work the same way:

```bash
osv-scanner scan image my-app:latest --format html --output osv.html || true
osv-scanner scan source --sbom=sbom.spdx.json --format html --output osv.html || true
```

`|| true` because a non-empty result is a non-zero exit, and a non-empty
result is exactly when you want the report.

## Publish it

Drag `osv.html` into [the app](https://commareports.com/), or from CI:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html osv.html \
        --arg title "OSV scan — $GITHUB_REF_NAME" '{title: $title, html: $html}')"
```

The page is self-contained; nothing else to upload.

## Keep it restricted

Scan output is a list of things that are currently exploitable in your
software. Reports are private by default and access is set per report —
private, team, domain-gated, or a named reviewer list. Use one of those; see
the [sharing model](/docs/sharing). For an external auditor, a
[password-protected link](/password-protect-html-report) with an expiry is the
usual shape.

## Triage on the report

- **Anchored threads** on the advisory: owner, decision, deadline — recorded
  next to the CVE instead of in a parallel tracker that drifts. See
  [commenting on HTML](/comment-on-html).
- **Revisions**, so the difference between "new this week" and "we've been
  carrying this since March" is visible.
- **A [routine](/features/routines/scheduled-html-reports)** re-scanning nightly
  — new advisories land against unchanged dependencies, so a scan that only
  runs on push misses them by definition.

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a scan report →](https://commareports.com/)**

### Related

- [Share a Trivy report](/share-trivy-report) · [Share a Snyk report](/share-snyk-report)
- [Share a Dependency-Check report](/share-dependency-check-report) · [Share an npm audit report](/share-npm-audit-report)
- [Password-protect a report](/password-protect-html-report) · [Share a security scan report](/share-security-scan-report)