How do I share an OWASP Dependency-Check HTML report?

Dependency-Check writes a single self-contained `dependency-check-report.html`. POST it to https://commareports.com/api/v1/reports with a Bearer comma_sk_ token, or drag it into the app, and you have a URL instead of a build artifact with a 30-day retention window.

Should a vulnerability report be a public link?

No, and it does not have to be. Every report has a visibility level — private, team, email-domain-gated, named reviewers, or public — so an unpatched-CVE inventory can be team-only from the moment it is published. Sharing does not mean publishing to the internet.

How do I stop re-triaging the same CVE every week?

Publish to the same report id on each scan and comment the triage decision on the finding. Comment threads anchor to the rendered content and persist across revisions, so 'not reachable — the vulnerable codec is never invoked' stays attached to that CVE row instead of living in a Slack thread nobody can find on the next scan.

Does the interactive filtering in the report still work?

Yes. Dependency-Check inlines its own script and stylesheet, and report HTML is rendered with scripts enabled inside a sandboxed iframe, so the collapsible evidence panes and the severity filters behave normally.

Can I publish it automatically from CI?

Yes. PATCH one report id per repository after every scan. You get a stable URL and a revision per run, which makes 'what's new since last week' a diff rather than a re-read of the whole report.

Share an OWASP Dependency-Check report

Dependency-Check does the hard part well: it walks your dependency tree, matches artifacts against the NVD, and writes an HTML report with the evidence that led to each match. Then the report goes where every scanner report goes — a CI artifact, unread, expiring on a retention schedule — and the security conversation reverts to a ticket that says "fix the criticals."

The report is not the problem. Triage is the problem, and triage is a conversation that needs somewhere to live.

Publish the report

dependency-check --scan ./ --format HTML --out reports/

curl -fsS -X POST "https://commareports.com/api/v1/reports" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html reports/dependency-check-report.html \
        --arg title "Dependency-Check — $(date +%Y-%m-%d)" \
        '{title: $title, html: $html, visibility: "private"}')"

The report is one self-contained file — inline CSS, inline script — so there is nothing else to upload, and the collapsible evidence panes still work inside the sandboxed iframe.

Set visibility deliberately. A list of unpatched CVEs in your own dependency tree is a map for an attacker, so create it private and widen from there — team, email-domain, or named reviewers. See the sharing model.

Triage that survives the next scan

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html reports/dependency-check-report.html '{html: $html}')"

One report id per repository. Each scan appends a revision at the same URL, and the comment threads stay attached to what they were about. That is the whole trick:

"Not reachable — the vulnerable parser is never called." Recorded on the finding, visible to whoever reads the next scan.
"Waiting on upstream, tracked in SEC-412." Attached, not remembered.
"This one is real, patching this sprint." With a date on it.

Without that, every scan restarts the same argument with the same three people. See commenting on HTML.

What changed since last week

The diff between two revisions is the answer to the only question that matters in a recurring scan: which findings are new. A weekly routine can run the scan and publish it on a schedule, so the report arrives without anyone remembering to produce it.

Limits

HTML body: 5 MB. A monorepo scan with full evidence can exceed it — scan per module, or use --format HTML --format JSON and publish the HTML per project.
Scripts run, sandboxed: allow-scripts, no allow-same-origin.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a scan report →