Does pip-audit have an HTML output?

No. `-f` accepts columns, json, cyclonedx-json, cyclonedx-xml and markdown. Markdown through `pandoc -s` is the shortest path to a standalone page.

Should I audit the environment or the lockfile?

The lockfile — `pip-audit -r requirements.txt` — is reproducible and matches what deploys. Auditing the live environment also catches things installed outside the lockfile, which is worth a separate scheduled report.

`--fix` upgrades to the first non-vulnerable version. Run it locally, not in the reporting job; a scan that rewrites your lockfile is not a scan.

How do I show the backlog shrinking?

PATCH one report id per repo on a schedule. The revision history is the remediation record, without anybody maintaining a spreadsheet.

Who should be able to open it?

Keep it private or team-scoped. A vulnerability report is a list of the exact versions you are running, which is not something to publish openly while it is still true.

Share a pip-audit report

pip-audit checks your installed packages or your requirements file against the Python advisory database. The output is a table in a terminal, which works fine until the finding needs an owner — and dependency findings almost always need an owner who is not the person who ran the scan.

Markdown → HTML

pip install pip-audit pandoc

pip-audit -r requirements.txt -f markdown > audit.md || true
pandoc audit.md -s -o audit.html

|| true because pip-audit exits non-zero when it finds anything, and the scan with findings is the one worth publishing. Keep a separate unmuted pip-audit step if you want the build to fail.

Or CycloneDX, if you are tracking an SBOM

pip-audit -r requirements.txt -f cyclonedx-json -o sbom.json

That is a different artifact with a different audience — see sharing an SBOM.

Publish it

Drag audit.html into the app, or from CI:

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html audit.html \
        --arg title "pip-audit — $GITHUB_REF_NAME" '{title: $title, html: $html}')"

Restrict the access level. This report lists the precise versions you are running and the advisories against them. Private or team-scoped, not public — see the sharing model.

The triage that actually happens

Most advisories in a Python project are transitive, and the useful question is never "is this CVE real" but "does our code path reach it". That is a judgment call somebody makes once and then forgets, and three weeks later the same advisory comes back and somebody makes it again.

Anchored threads on the advisory — "we don't call the affected parser; upgrade blocked on the numpy pin, tracked in PLAT-88." Written once, next to the finding. See commenting on HTML.
A routine re-scanning weekly and PATCHing the same id, so new advisories appear as a diff rather than as a CI log nobody opened.

Limits

Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a security report →