# Share a Scout Suite Report — Publish the Folder, Not the Zip

Canonical: https://commareports.com/share-scoutsuite-report
Published: 2026-08-30

> Scout Suite writes an HTML report that loads its results from a sibling JavaScript folder, so it can't be emailed as one file. Publish the whole output directory to Comma.

# Share a Scout Suite report

Scout Suite gives you the best free multi-cloud posture dashboard there is,
and then hands it over in a form designed to resist sharing:

```
scoutsuite-report/
  aws-123456789012.html        # the page
scoutsuite-results/
  scoutsuite_results_aws-….js  # every finding, as a JS assignment
  scoutsuite_exceptions_….js
```

The HTML is a shell. The findings live in a sibling folder as JavaScript. Send
the `.html` on its own — which is what everyone tries first — and the
recipient gets a chrome-only dashboard with nothing in it.

## Publish the whole output directory

Drag `scoutsuite-report/` **and** `scoutsuite-results/` (or a zip of the run's
output) into [the app](https://commareports.com/):

- The provider HTML becomes the report body.
- The results JavaScript uploads as assets, with references rewritten to the
  uploaded copies — the step that fails over `file://`.
- Scripts run inside a sandboxed iframe (`allow-scripts`, no
  `allow-same-origin`), so the dashboards and drill-downs work.

```bash
scout aws --report-dir ./out
zip -qr scoutsuite.zip out
# then drag scoutsuite.zip in, or POST it through the API
```

## Access is the whole point

An audit report is a targeting package if it leaks. Reports are private by
default; the [sharing model](/docs/sharing) gives you team, email-domain
gating, named reviewers, or a
[password-protected link](/password-protect-html-report) for an auditor who
should not get a login.

Unlike a zip on a share drive, access stays revocable and there is exactly
one copy.

## Findings need decisions attached

- **Anchored threads** on the finding — "known, this role is the CI deployer
  and the trust policy is scoped" — see
  [commenting on HTML](/comment-on-html).
- **Revisions** — one report id per account, one revision per audit.
- **Resolved threads** preserve the reasoning, which is the artifact your
  next compliance review actually wants.

## Limits

- **Entry HTML: 5 MB.** Assets: 25 MB per file, 250 MB and 500 files total.
  A large account's results JS is the file to watch — it is a single big file,
  so the 25 MB per-file cap is the one that bites first.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish an audit report →](https://commareports.com/)**

### Related

- [Share a Prowler report](/share-prowler-report) · [Share a security scan report](/share-security-scan-report)
- [Share a Checkov report](/share-checkov-report) · [Share a ZAP report](/share-zap-report)
- [Password-protect a report](/password-protect-html-report) · [Sharing model](/docs/sharing)