Does OSV-Scanner produce HTML?

Yes — `osv-scanner scan source -r . --format html --output osv.html` writes a self-contained page grouped by package and advisory. Publish that file and share the URL.

Why publish a vulnerability report instead of failing the build?

Do both. The gate decides whether to ship; the report is what the triage conversation happens on. A failing gate with no readable artifact just produces a re-run.

Is it safe to publish a vulnerability report?

Reports are private by default, and access is per report — private, team, domain-gated, or a named list of reviewers. Scan output naming unpatched dependencies should stay on one of the restricted settings.

How do I keep one link across scans?

PATCH the same report id every run. The URL is stable, each run appends a revision, and "is this the same finding as last week?" becomes a diff.

Can I record accepted risk on a finding?

Yes. Anchored threads sit on the advisory, so "accepted until the 3.x upgrade, owner: platform" is recorded next to the evidence rather than in a spreadsheet nobody opens.

Share an OSV-Scanner HTML report

OSV-Scanner reads your lockfiles, matches them against the OSV database and tells you which of your transitive dependencies has a published advisory. It writes HTML directly, which puts it ahead of most scanners — the missing piece is somewhere to put the file that is not a CI artifact bucket.

Run the scan

osv-scanner scan source -r . --format html --output osv.html || true

Container images and SBOMs work the same way:

osv-scanner scan image my-app:latest --format html --output osv.html || true
osv-scanner scan source --sbom=sbom.spdx.json --format html --output osv.html || true

|| true because a non-empty result is a non-zero exit, and a non-empty result is exactly when you want the report.

Publish it

Drag osv.html into the app, or from CI:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html osv.html \
        --arg title "OSV scan — $GITHUB_REF_NAME" '{title: $title, html: $html}')"

The page is self-contained; nothing else to upload.

Keep it restricted

Scan output is a list of things that are currently exploitable in your software. Reports are private by default and access is set per report — private, team, domain-gated, or a named reviewer list. Use one of those; see the sharing model. For an external auditor, a password-protected link with an expiry is the usual shape.

Triage on the report

Anchored threads on the advisory: owner, decision, deadline — recorded next to the CVE instead of in a parallel tracker that drifts. See commenting on HTML.
Revisions, so the difference between "new this week" and "we've been carrying this since March" is visible.
A routine re-scanning nightly — new advisories land against unchanged dependencies, so a scan that only runs on push misses them by definition.

Limits

Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a scan report →