Why doesn't the Scout Suite HTML report work when I send just the file?

Because it is not one file. Scout Suite writes `scoutsuite-report/ - .html` next to a `scoutsuite-results/` folder holding the findings as JavaScript. Detach them and the page loads with an empty dashboard.

How do I share it properly?

Publish the whole output directory to Comma — drag `scoutsuite-report/` (or a zip of it) in. The entry HTML becomes the report body, `scoutsuite-results/` uploads as assets, and the references are rewritten to the uploaded copies.

Do the dashboard and drill-downs still work?

Yes. Report HTML renders with scripts enabled inside a sandboxed iframe, so the service dashboards, the per-finding drill-downs and the filters behave as they do locally.

Is it safe to publish a cloud audit report?

Only under access control. It contains account identifiers, resource names and exploitable misconfigurations. Reports are private by default — keep it private, gate it to your team or domain, or password-protect the link for an external auditor.

Can I keep a stable URL across audits?

Yes. PATCH the same report id each run; every audit appends a revision, so what changed between two audits is visible rather than reconstructed.

Share a Scout Suite report

Scout Suite gives you the best free multi-cloud posture dashboard there is, and then hands it over in a form designed to resist sharing:

scoutsuite-report/
  aws-123456789012.html        # the page
scoutsuite-results/
  scoutsuite_results_aws-….js  # every finding, as a JS assignment
  scoutsuite_exceptions_….js

The HTML is a shell. The findings live in a sibling folder as JavaScript. Send the .html on its own — which is what everyone tries first — and the recipient gets a chrome-only dashboard with nothing in it.

Publish the whole output directory

Drag scoutsuite-report/ and scoutsuite-results/ (or a zip of the run's output) into the app:

The provider HTML becomes the report body.
The results JavaScript uploads as assets, with references rewritten to the uploaded copies — the step that fails over file://.
Scripts run inside a sandboxed iframe (allow-scripts, no allow-same-origin), so the dashboards and drill-downs work.

scout aws --report-dir ./out
zip -qr scoutsuite.zip out
# then drag scoutsuite.zip in, or POST it through the API

Access is the whole point

An audit report is a targeting package if it leaks. Reports are private by default; the sharing model gives you team, email-domain gating, named reviewers, or a password-protected link for an auditor who should not get a login.

Unlike a zip on a share drive, access stays revocable and there is exactly one copy.

Findings need decisions attached

Anchored threads on the finding — "known, this role is the CI deployer and the trust policy is scoped" — see commenting on HTML.
Revisions — one report id per account, one revision per audit.
Resolved threads preserve the reasoning, which is the artifact your next compliance review actually wants.

Limits

Entry HTML: 5 MB. Assets: 25 MB per file, 250 MB and 500 files total. A large account's results JS is the file to watch — it is a single big file, so the 25 MB per-file cap is the one that bites first.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish an audit report →