# Share a tfsec Report — Terraform Misconfigurations at a Link

Canonical: https://commareports.com/share-tfsec-report
Published: 2026-09-12

> tfsec ships an HTML formatter, so `tfsec --format html` gives you a file. Publish it to Comma so the findings get a URL, a triage thread per rule, and a revision per run.

# Share a tfsec report

Terraform review is where security findings arrive at the worst possible
moment: in a CI log, under a red X, on a PR that someone wants merged today.
The finding needs a URL and a thread, not a 400-line log expando.

## Produce the HTML

```bash
tfsec --format html --out tfsec.html .
```

tfsec exits non-zero when it finds anything, which will kill the job before the
publish step unless you plan for it:

```bash
tfsec --format html --out tfsec.html . || true

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html tfsec.html \
        --arg title "tfsec — $GIT_SHA" '{title: $title, html: $html}')"
```

Keep the gate: fail the job on the scan's exit code _after_ publishing, so the
build still goes red and the reviewer still has something to read. See
[publishing from CI](/docs/ci).

## Why the link changes the review

- **Anchored threads** — "accepted: this bucket is fronted by CloudFront with
  OAC" sits on the rule, so it is not re-litigated next sprint. See
  [commenting on HTML](/comment-on-html).
- **Revisions** — one report id per stack; a finding that appears between two
  revisions is a regression you can point at.
- **Access per report** — private, team-only, or domain-gated. See the
  [sharing model](/docs/sharing).

## Limits

- **Entry HTML: 5 MB.** A large multi-module scan can approach it; run per
  stack rather than at the monorepo root.
- **Assets: 25 MB per file, 250 MB and 500 files per report.**
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision
history.

**[Publish a tfsec report →](https://commareports.com/)**

### Related

- [Share a Checkov report](/share-checkov-report) · [Share a Terraform plan](/share-terraform-plan)
- [Share a Trivy report](/share-trivy-report) · [Share an Infracost report](/share-infracost-report)
- [Share a KICS report](/share-kics-report) · [For SRE teams](/for/sre-teams)