How do I share an OWASP ZAP scan report?

Run the baseline or full scan with HTML output — `zap-baseline.py -t https://example.com -r zap.html` — and POST the file to https://commareports.com/api/v1/reports with a Bearer comma_sk_ token. The report is self-contained, so it renders at the URL exactly as it does locally.

Where should a triage decision live?

On the finding. Highlight the alert row in the published report and pin the reasoning — 'reflected in an admin-only page behind SSO, accepted, SEC-311'. Next month's scan is a new revision of the same report, so the decision is still there when the same alert reappears.

Is it safe to publish a DAST report?

A DAST report is a map of your unfixed attack surface, so treat it accordingly. Reports are private by default and access is set per report — private, team-visible, domain-gated, or named reviewers. Publish with a scoped token that only has reports:write.

Can I compare this scan to the last one?

Yes. PATCH one report id per target so every scan appends a revision at the same URL, and diff two revisions to see which alerts are new and which the last release cleared.

Does the ZAP report's interactivity survive?

Yes — report HTML renders with scripts enabled inside a sandboxed iframe, so expandable alert details and the instance lists behave normally.

Share an OWASP ZAP report

A DAST scan produces a list of alerts and, immediately afterwards, a much more valuable list: which of them matter. The scan is automated. The second list is human, and CI has nowhere to put it — so the reasoning ends up in a Slack thread and is gone by the next scan, at which point someone triages the same alert again from scratch.

ZAP's HTML output is a single self-contained file. Give it a URL and the triage stops evaporating.

Publish it

zap-baseline.py -t https://staging.example.com -r zap.html || true

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html zap.html \
        --arg title "ZAP — staging — $(date +%F)" \
        '{title: $title, html: $html}')"

|| true because zap-baseline.py exits non-zero when it finds warnings, and that is precisely the run worth publishing. PATCH against a saved report id keeps one URL per target with a revision per scan.

Use a scoped token with reports:write only, and keep the report private or team-visible — see the sharing model.

What the URL changes

Accepted risks stay accepted. The note explaining why an alert is not exploitable is pinned to the alert, not to a channel. See commenting on HTML.
Scan-over-scan diffs. New alerts stand out from the standing noise.
Security and engineering read the same artifact. No CI access needed on either side.
Scheduled rescans. A routine can rescan on a cron, so a regression in a dependency shows up without a deploy to trigger it.

Limits

HTML body: 5 MB. A full active scan against a large app can exceed it — publish the baseline summary and attach the full XML/JSON as an asset.
Scripts run, sandboxed: allow-scripts, no allow-same-origin.
60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Publish a scan →

Security scan reports — the general pattern
Trivy reports · Snyk reports
npm audit reports · Monthly compliance digest

Share an OWASP ZAP report

Publish it

What the URL changes

Limits

Try it

Related