Comma

Share a Nuclei report

Nuclei's output is a stream of lines in a terminal, and the terminal belongs to whoever ran the scan. Triage requires the opposite: one artifact, one ordering, one place where "we accepted this risk in March" is written down.

Render the findings to HTML

From JSONL, sorted by severity:

nuclei -l targets.txt -j -o results.jsonl -silent

jq -sr '
  def rank: {critical:0, high:1, medium:2, low:3, info:4}[.info.severity] // 5;
  sort_by(rank)
  | "<table><tr><th>Severity</th><th>Template</th><th>Host</th><th>Matched</th></tr>"
    + (map("<tr><td>" + .info.severity + "</td><td>" + .info.name
           + "</td><td>" + .host + "</td><td>" + (."matched-at" // "") + "</td></tr>") | add)
    + "</table>"
' results.jsonl > nuclei.html

Or from the markdown export:

nuclei -l targets.txt -me nuclei-md -silent
pandoc nuclei-md/*.md -o nuclei.html --standalone --embed-resources

Then publish:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html nuclei.html \
        --arg title "Nuclei — prod edge, $(date +%F)" '{title: $title, html: $html}')"

Keep the report private or team-only. A scan report is a map of what is exploitable; see the sharing model for the visibility options.

Why triage needs the review layer

  • Anchored threads — "accepted, WAF rule 42 covers this" sits on the finding, so the same finding does not get re-triaged next month. See commenting on HTML.
  • Revisions — one report id per target; a new row between two revisions is a new finding.
  • Access per report — private, team-only, or domain-gated, decided per scan.

Limits

  • Entry HTML: 5 MB. A broad template run against many hosts can exceed it; filter to -severity critical,high,medium for the review copy.
  • Assets: 25 MB per file, 250 MB and 500 files per report.
  • 60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a scan report →

Related