Reports and exports
Download PDF reports for a scan, or export all findings as CSV, JSON or SARIF.
PDF reports
On Scans, a completed scan in History has two downloads:
| Report | Contents | For |
|---|---|---|
| Report | Every finding from the scan, most severe first, with its class, CVSS score and status, then the impact, what we found, the evidence and how to fix it. | Engineering and auditors. |
| Summary | One block per finding with its severity, class, CVSS score, status and impact. No exploit detail. | Leadership and customers' security reviewers. |
Findings you have accepted as a risk are left out of reports.
Exports
On Findings, choose Export CSV, Export JSON or Export SARIF. Exports include every finding in your organization.
| Format | Contents |
|---|---|
| CSV | id, severity, status, cwe, cvss, title, impact. Opens in any spreadsheet. |
| JSON | Every field of every finding, including description, evidence and fix. |
| SARIF 2.1.0 | For GitHub code scanning and other security dashboards. Accepted findings are left out. |
Upload SARIF to GitHub code scanning
gh api repos/OWNER/REPO/code-scanning/sarifs \
-f commit_sha="$(git rev-parse HEAD)" \
-f ref=refs/heads/main \
-f sarif="$(gzip -c countermind.sarif | base64 | tr -d '\n')"