# Share a pip-audit Report — Python Advisories as a Page

Canonical: https://commareports.com/share-pip-audit-report
Published: 2026-09-15

> pip-audit writes markdown, JSON and CycloneDX. Render the markdown, publish it to Comma, and the dependency advisories become a link with a revision per scan.

# Share a pip-audit report

`pip-audit` checks your installed packages or your requirements file against
the Python advisory database. The output is a table in a terminal, which works
fine until the finding needs an owner — and dependency findings almost always
need an owner who is not the person who ran the scan.

## Markdown → HTML

```bash
pip install pip-audit pandoc

pip-audit -r requirements.txt -f markdown > audit.md || true
pandoc audit.md -s -o audit.html
```

`|| true` because `pip-audit` exits non-zero when it finds anything, and the
scan with findings is the one worth publishing. Keep a separate unmuted
`pip-audit` step if you want the build to fail.

## Or CycloneDX, if you are tracking an SBOM

```bash
pip-audit -r requirements.txt -f cyclonedx-json -o sbom.json
```

That is a different artifact with a different audience — see
[sharing an SBOM](/share-sbom-report).

## Publish it

Drag `audit.html` into [the app](https://commareports.com/), or from CI:

```bash
curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html audit.html \
        --arg title "pip-audit — $GITHUB_REF_NAME" '{title: $title, html: $html}')"
```

**Restrict the access level.** This report lists the precise versions you are
running and the advisories against them. Private or team-scoped, not public —
see the [sharing model](/docs/sharing).

## The triage that actually happens

Most advisories in a Python project are transitive, and the useful question is
never "is this CVE real" but "does our code path reach it". That is a judgment
call somebody makes once and then forgets, and three weeks later the same
advisory comes back and somebody makes it again.

- **Anchored threads** on the advisory — "we don't call the affected parser;
  upgrade blocked on the numpy pin, tracked in PLAT-88." Written once, next to
  the finding. See [commenting on HTML](/comment-on-html).
- **A [routine](/features/routines/scheduled-html-reports)** re-scanning weekly
  and PATCHing the same id, so new advisories appear as a diff rather than as
  a CI log nobody opened.

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a security report →](https://commareports.com/)**

### Related

- [Share an npm audit report](/share-npm-audit-report) · [Share a Snyk report](/share-snyk-report)
- [Share an OSV-Scanner report](/share-osv-scanner-report) · [Share a Trivy report](/share-trivy-report)
- [Share a Bandit report](/share-bandit-report) · [Share an SBOM](/share-sbom-report)