Skip to content

Reports and exports

Prepare a useful source-assessment handoff, choose JSON or CSV, and keep scope and uncertainty with the findings.

Choose the right report for the questionPermalink to Choose the right report for the question

Use a report to hand work to a developer, discuss an assessment with a reviewer, or retain a record of what was examined. First decide whether you need a source assessment or a report of authorized dynamic testing; they are not interchangeable.

WorkflowWhere to find itWhat it describes
Source Security AssessmentOpen a result from Scan history.The selected repository version, reported coverage, findings, candidates, and any available policy verdict.
Source result exportChoose JSON or CSV in the scan result header.A downloadable scan record or findings spreadsheet with scan and coverage context.
Pentest ReportOpen Pentest Reports.A separate completed, explicitly authorized dynamic engagement within its target, method, and rate scope.

Before exporting, select the correct workspace and scan, make sure its result is available, and confirm that the intended recipients may receive the repository information. An unavailable report is not a report with zero findings.

Prepare a source-assessment handoffPermalink to Prepare a source-assessment handoff

  1. Identify the assessment

    Open the scan and record the repository, branch or ref, assessed version, and date. Do not present an older branch assessment as the current release.

  2. Lead with scope and coverage

    Read the Source Security Assessment summary and Scope and limits notes. State insufficient coverage before discussing a low or zero finding count.

  3. Separate evidence from review work

    Distinguish confirmed findings from candidates, and record the policy verdict only if one is available.

  4. Give the recipient a next step

    State which issue needs investigation, who will coordinate remediation, and what validation is still missing. Use your team's tracker or handoff process for ownership.

  5. Attach the appropriate export

    Choose JSON or CSV, then verify that the downloaded file corresponds to the intended scan. Keep any additional limitations and decision context alongside it.

Choose JSON or CSVPermalink to Choose JSON or CSV

FormatIncluded informationUseful for
JSONScan identity, status, headline, available timing and version information, coverage, summary counts, error information where present, and finding details.A structured scan record or input to your own review process.
CSVOne row per included finding with scan context, coverage, severity, proof state, title, location, available classification, and remediation summary.A spreadsheet or a selected set of finding details for a tracker.

Exports use the result already loaded in the console; exporting does not start another scan or refresh the source assessment. JSON is not a complete copy of every result panel: policy details, separate Awaiting review items, and all scope notes are not guaranteed to be included. Add the relevant context explicitly when sharing.

An empty findings CSV still describes the outcome

When there are no included finding rows, CSV contains an explanatory row rather than only a header. Read that statement and the scan status. It may describe limited coverage or no result, not an all-clear assessment.

Keep the limits attachedPermalink to Keep the limits attached

  • Retain coverage and scan status when copying rows into another document. Findings from examined code do not describe areas the scan could not assess.
  • Do not combine candidate severities with confirmed findings or present Needs validation as confirmed.
  • Explain triage changes. A smaller confirmed count can reflect Not a real issue or Ignored decisions rather than code remediation.
  • Describe a source assessment as source review, not a live penetration test, proof of runtime exploitation, certification, or a compliance guarantee.
  • These export controls provide JSON and CSV, not a PDF or a raw evidence archive. Only use downloads actually offered by the relevant report page.

Use a new result for verificationPermalink to Use a new result for verification

After remediation, retain the original report and inspect the new verification or scan result separately. Compare the relevant source versions, the original finding, and the coverage. An old export does not update when code, triage decisions, or later results change.