Reports and exports
Prepare a useful source-assessment handoff, choose JSON or CSV, and keep scope and uncertainty with the findings.
Choose the right report for the questionPermalink to Choose the right report for the question
Use a report to hand work to a developer, discuss an assessment with a reviewer, or retain a record of what was examined. First decide whether you need a source assessment or a report of authorized dynamic testing; they are not interchangeable.
| Workflow | Where to find it | What it describes |
|---|---|---|
| Source Security Assessment | Open a result from Scan history. | The selected repository version, reported coverage, findings, candidates, and any available policy verdict. |
| Source result export | Choose JSON or CSV in the scan result header. | A downloadable scan record or findings spreadsheet with scan and coverage context. |
| Pentest Report | Open Pentest Reports. | A separate completed, explicitly authorized dynamic engagement within its target, method, and rate scope. |
Before exporting, select the correct workspace and scan, make sure its result is available, and confirm that the intended recipients may receive the repository information. An unavailable report is not a report with zero findings.
Prepare a source-assessment handoffPermalink to Prepare a source-assessment handoff
Identify the assessment
Open the scan and record the repository, branch or ref, assessed version, and date. Do not present an older branch assessment as the current release.
Lead with scope and coverage
Read the Source Security Assessment summary and Scope and limits notes. State insufficient coverage before discussing a low or zero finding count.
Separate evidence from review work
Distinguish confirmed findings from candidates, and record the policy verdict only if one is available.
Give the recipient a next step
State which issue needs investigation, who will coordinate remediation, and what validation is still missing. Use your team's tracker or handoff process for ownership.
Attach the appropriate export
Choose JSON or CSV, then verify that the downloaded file corresponds to the intended scan. Keep any additional limitations and decision context alongside it.
Choose JSON or CSVPermalink to Choose JSON or CSV
| Format | Included information | Useful for |
|---|---|---|
| JSON | Scan identity, status, headline, available timing and version information, coverage, summary counts, error information where present, and finding details. | A structured scan record or input to your own review process. |
| CSV | One row per included finding with scan context, coverage, severity, proof state, title, location, available classification, and remediation summary. | A spreadsheet or a selected set of finding details for a tracker. |
Exports use the result already loaded in the console; exporting does not start another scan or refresh the source assessment. JSON is not a complete copy of every result panel: policy details, separate Awaiting review items, and all scope notes are not guaranteed to be included. Add the relevant context explicitly when sharing.
An empty findings CSV still describes the outcome
Keep the limits attachedPermalink to Keep the limits attached
- Retain coverage and scan status when copying rows into another document. Findings from examined code do not describe areas the scan could not assess.
- Do not combine candidate severities with confirmed findings or present Needs validation as confirmed.
- Explain triage changes. A smaller confirmed count can reflect Not a real issue or Ignored decisions rather than code remediation.
- Describe a source assessment as source review, not a live penetration test, proof of runtime exploitation, certification, or a compliance guarantee.
- These export controls provide JSON and CSV, not a PDF or a raw evidence archive. Only use downloads actually offered by the relevant report page.
Use a new result for verificationPermalink to Use a new result for verification
After remediation, retain the original report and inspect the new verification or scan result separately. Compare the relevant source versions, the original finding, and the coverage. An old export does not update when code, triage decisions, or later results change.