How do I share Snyk results with someone who has no Snyk seat?

Pipe the JSON through snyk-to-html — `snyk test --json | npx snyk-to-html -o snyk.html` — and POST the file to https://commareports.com/api/v1/reports with a Bearer comma_sk_ token. Anyone you grant access to the report can read the findings without a Snyk account.

Why not just link to the Snyk dashboard?

A dashboard link shows current state, re-evaluated every time it is opened, and requires a seat. A published report is the specific scan you were discussing, frozen, with the triage conversation attached to the specific advisory.

Can I track whether the vulnerability count is going down?

Yes. PATCH one report id per project so every scan appends a revision at the same URL. Diffing two revisions shows which advisories the upgrade cleared and which arrived with it.

Does it work for container and IaC scans too?

Yes. `snyk container test` and `snyk iac test` produce JSON in the same shape, so the snyk-to-html step and the publish step are identical. Keep one report per scan target so each has its own history.

Is the report private?

Reports are private by default and access is set per report — private, team-visible, domain-gated, or named reviewers. A dependency report is an inventory of what you have not patched, so it should stay that way.

Share a Snyk report

Snyk finds the advisory. The expensive part is what comes after: deciding whether the vulnerable path is reachable, whether the major-version bump is worth it this sprint, and who owns it. That decision is made once and lost immediately, because CI keeps the finding and throws away the reasoning.

snyk-to-html already renders a readable artifact. The missing piece is a place where the artifact and the reasoning live together.

Publish it

snyk test --json > snyk.json || true
npx snyk-to-html -i snyk.json -o snyk.html

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html snyk.html \
        --arg title "Snyk — api — $(date +%F)" \
        '{title: $title, html: $html}')"

|| true because snyk test exits non-zero when it finds something, which is the run you want published. One report id per project, PATCHed on every scan, gives you a stable URL and a revision history.

What the URL changes

Advisories get owners and reasons. Highlight the finding, pin "transitive via foo@2, not reachable from our entrypoint, upgrade queued". See commenting on HTML.
Trend instead of snapshot. Revision diffs show what the dependency bump actually fixed.
Readable without a seat. Auditors, contractors and the security reviewer who does not use your CI can open the link.
Scheduled rescans. A routine re-runs the scan weekly so new advisories against unchanged code still surface.

Limits

HTML body: 5 MB. A monorepo scan with --all-projects can exceed it — publish per project.
Scripts run, sandboxed: allow-scripts, no allow-same-origin.
60 requests/minute per token. Use a scoped token with reports:write only.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a scan →

Share a Snyk report

Publish it

What the URL changes

Limits

Try it

Related