Comma

Share a tfsec report

Terraform review is where security findings arrive at the worst possible moment: in a CI log, under a red X, on a PR that someone wants merged today. The finding needs a URL and a thread, not a 400-line log expando.

Produce the HTML

tfsec --format html --out tfsec.html .

tfsec exits non-zero when it finds anything, which will kill the job before the publish step unless you plan for it:

tfsec --format html --out tfsec.html . || true

curl -fsS -X PATCH "https://commareports.com/api/v1/reports/$REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html tfsec.html \
        --arg title "tfsec — $GIT_SHA" '{title: $title, html: $html}')"

Keep the gate: fail the job on the scan's exit code after publishing, so the build still goes red and the reviewer still has something to read. See publishing from CI.

Why the link changes the review

  • Anchored threads — "accepted: this bucket is fronted by CloudFront with OAC" sits on the rule, so it is not re-litigated next sprint. See commenting on HTML.
  • Revisions — one report id per stack; a finding that appears between two revisions is a regression you can point at.
  • Access per report — private, team-only, or domain-gated. See the sharing model.

Limits

  • Entry HTML: 5 MB. A large multi-module scan can approach it; run per stack rather than at the monorepo root.
  • Assets: 25 MB per file, 250 MB and 500 files per report.
  • 60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a tfsec report →

Related