How do I generate an HTML report from Trivy?

Trivy ships an HTML template: `trivy image --format template --template "@contrib/html.tpl" -o trivy.html `. That writes a single self-contained file, which you can publish to Comma with one curl to get a URL instead of 4,000 lines of CI log.

Why not just read the scan output in CI logs?

Because triage is a conversation, and a log has nowhere to hold one. A published report gives each finding an anchor: a reviewer highlights a CVE row and pins 'not reachable from our entrypoint, tracked in SEC-241', and that note is still there on the next scan instead of scrolling away with the build.

How do I track whether the vulnerability count is going up or down?

PATCH the same Comma report id on every scan. Each scan appends a revision at one URL, so diffing two revisions shows exactly which CVEs appeared and which the base-image bump cleared — the trend that a per-run artifact link can never show.

Who can see the report?

Whoever you allow. Access is set per report — private, team-visible, domain-gated, or shared with named reviewers — which matters more than usual here, since a vulnerability report is a map of your unpatched surface. Reports are private by default.

Does this work for filesystem, IaC and SBOM scans too?

Yes. `trivy fs`, `trivy config` and `trivy sbom` take the same `--format template` flags, so the publish step is identical. Many teams keep one report per scan target so each has its own URL and its own history.

Share a Trivy scan report

A container scan produces two things: a list of CVEs, and a set of decisions about them. CI stores the first and loses the second. The finding scrolls past in a build log, someone decides it's not reachable from the entrypoint, and that decision lives in a Slack thread that is unfindable by the time the same CVE shows up next month.

Trivy already writes a readable artifact — the bundled HTML template produces one self-contained file. Give it a URL and the decisions have somewhere to live.

Publish it

trivy image --format template \
  --template "@contrib/html.tpl" \
  -o trivy.html \
  "$IMAGE" || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html trivy.html \
        --arg title "Trivy — $IMAGE — $(date +%F)" \
        '{title: $title, html: $html}')"

|| true because --exit-code 1 on HIGH findings is the run you most want published. PATCH on a saved report id keeps one URL per scan target with a revision per scan, which is what turns a pile of results into a trend.

Use a scoped token with reports:write only. Keep reports private or team-visible — see the sharing model. A vulnerability report is an inventory of what isn't patched yet, and it is private by default here for that reason.

What the URL changes

Triage notes stick to findings. Highlight the CVE row, pin the reasoning, and it's still attached on next month's scan. See commenting on HTML.
Scan-over-scan diffs. Which CVEs are new, which the base-image bump cleared. See revisions and diffs.
Auditors can read it. Someone with no CI access opens a link.
Scheduled rescans. A routine can refresh the report on a cron, so drift shows up without a push to trigger it — a base image gets a new CVE while your code sits still.

Limits

HTML body: 5 MB. A wide scan of a fat image can approach it; scan with --severity HIGH,CRITICAL for the published summary and attach the full JSON as an asset.
Scripts run, sandboxed: allow-scripts, no allow-same-origin.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Create your first report →

Security scan reports — the general pattern
Terraform plans — same review problem, different artifact
Compliance digests · Publish from CI

Share a Trivy scan report

Publish it

What the URL changes

Limits

Try it

Related