Comma

Share a KICS scan report

KICS finds the misconfiguration. It cannot find out whether you meant it.

That second part is the whole job — a public S3 bucket that is a static site, a privileged container that is a CNI plugin, an open security group someone accepted last quarter with a reason. The scanner produces the list; a person produces the verdict; and the verdict, in most pipelines, is stored nowhere.

Publish it

kics scan -p . --report-formats html -o ./kics-out || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html ./kics-out/results.html \
        --arg title "KICS — $STACK — $(date +%F)" \
        '{title: $title, html: $html}')"

|| true because KICS exits non-zero on HIGH severity results, and that is the run you most want published rather than swallowed by a failed job.

PATCH on a per-stack report id gives you one URL with a revision per scan. Use a scoped token with reports:write only, and keep the report private or team-visible — see the sharing model.

What the URL changes

  • Verdicts stick to findings. "Accepted — this bucket is the docs site, tracked in INFRA-88" pinned to the query result, still there next scan. See commenting on HTML.
  • Scan-over-scan diffs. Which queries are new since the last apply, which the hardening PR actually cleared.
  • Auditors read a link. No CI access, no pipeline permissions.
  • Scheduled rescans. A routine re-scans on a cron, so drift from a console change shows up without anyone pushing code.

Limits

  • HTML body: 5 MB. A large monorepo scan can exceed it; scan per stack, or filter with --severity HIGH,MEDIUM for the published view and attach the full JSON as an asset.
  • Scripts run, sandboxed: allow-scripts, no allow-same-origin.
  • 60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Create your first report →

Related