# Share a Snyk Report — Vulnerabilities Your Team Can Actually Discuss

Canonical: https://commareports.com/share-snyk-report
Published: 2026-08-23

> snyk-to-html turns Snyk JSON into one readable file. Publish it to Comma for a URL per project, threads on individual advisories, and a revision per scan — no Snyk seat required to read it.

# Share a Snyk report

Snyk finds the advisory. The expensive part is what comes after: deciding
whether the vulnerable path is reachable, whether the major-version bump is
worth it this sprint, and who owns it. That decision is made once and lost
immediately, because CI keeps the finding and throws away the reasoning.

`snyk-to-html` already renders a readable artifact. The missing piece is a
place where the artifact and the reasoning live together.

## Publish it

```bash
snyk test --json > snyk.json || true
npx snyk-to-html -i snyk.json -o snyk.html

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html snyk.html \
        --arg title "Snyk — api — $(date +%F)" \
        '{title: $title, html: $html}')"
```

`|| true` because `snyk test` exits non-zero when it finds something, which
is the run you want published. One report id per project, PATCHed on every
scan, gives you a stable URL and a revision history.

## What the URL changes

- **Advisories get owners and reasons.** Highlight the finding, pin
  "transitive via `foo@2`, not reachable from our entrypoint, upgrade queued".
  See [commenting on HTML](/comment-on-html).
- **Trend instead of snapshot.** Revision diffs show what the dependency bump
  actually fixed.
- **Readable without a seat.** Auditors, contractors and the security
  reviewer who does not use your CI can open the link.
- **Scheduled rescans.** A [routine](/docs/routines) re-runs the scan weekly
  so new advisories against unchanged code still surface.

## Limits

- **HTML body: 5 MB.** A monorepo scan with `--all-projects` can exceed it —
  publish per project.
- **Scripts run, sandboxed:** `allow-scripts`, no `allow-same-origin`.
- **60 requests/minute per token.** Use a
  [scoped token](/docs/api-tokens) with `reports:write` only.

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a scan →](https://commareports.com/)**

### Related

- [npm audit reports](/share-npm-audit-report) · [Trivy reports](/share-trivy-report)
- [OWASP ZAP reports](/share-zap-report) · [Security scan reports](/share-security-scan-report)
- [Publish from CI](/docs/ci) · [Compliance digests](/features/routines/monthly-compliance-digest)