Who This Topic Is For
Users who need to interpret, share, and operationalize vulnerability findings.
Documentation
Reports And Exports
Use report outputs to prioritize remediation, communicate findings, and maintain repeatable review quality.
Prerequisites
Before You Start
Use this checklist to make sure the workflow guidance applies cleanly to your current task.
- At least one scan, API spec result, or tool result is available to review.
- You know who needs the output (engineering, leadership, partner, or client context).
- You understand your remediation ownership path.
Expectations
What To Expect
Use this section to set the right outcome before you start the workflow.
Dashboard scans use a score. Pentest reports do not
Credit-scan reports include a security score. Penetration Test and Comprehensive Pentest HTML and PDF use do-this-week lists and color-coded severity instead of a 0-100 circle.
Client delivery is a share link, not a portal
Team and Enterprise agencies use Copy client link so the recipient opens a branded /r/ view for 14 days. Clients do not log in. Free and Pro keep Vulnify branding.
Copied URLs are not all the same
A dashboard URL, a generated artifact, a public-safe /report/ page, and a branded /r/ client link have different access and lifetime. Confirm which one you are sending.
Playbook
Step-By-Step Guidance
Follow these steps in order for a reliable and repeatable outcome.
Review findings by severity and impact.
Start with critical and high-signal issues before lower-priority hardening opportunities.
Use evidence and remediation guidance together.
Pair what was observed with the recommended corrective action so fix plans stay concrete and auditable.
Export and share based on workflow need.
Use the output that matches the workflow: in-app views for private review, HTML/PDF/JSON artifacts when they are generated, copied URLs when a route or artifact needs to be referenced, and supported public-safe pages only when that workflow is intentionally used.
API spec scans now follow the same stored-report pattern, so imported-spec findings can be reviewed later from scan history rather than being treated as throwaway output. Team and Enterprise agencies should use Copy client link for a branded /r/ view rather than forwarding a dashboard URL.
See White-Label Reports documentation for logo, overlay, and expiry behavior.
Review pentest reports separately from credit-scan scores.
Dashboard credit scans use a security score.
Penetration Test and Comprehensive Pentest reports do not: there is no 0-100 score circle and no PCI, SOC 2, or ISO badge. Use the do-this-week list, numbered remediation, and color-coded severity (Critical red, High orange, Medium amber).
Comprehensive adds an attack-surface appendix, authorization matrix, a detailed, actionable PDF for security specialists and developers, and an auditor-ready evidence pack that is not a certificate.
Track changes over reruns.
Revalidate after fixes and compare outcomes so score movement and finding closure can be verified.
Examples
Worked Examples
These scenarios show how the workflow looks in practice, including the result you should see.
Internal triage from Scan History
Engineering opens the saved scan, sorts Critical then High, assigns owners, and exports PDF for the weekly risk meeting.
Agency send with overlay
After branding is saved, Copy client link asks for Prepared for and engagement title. The agency pastes Acme Retail and Q3 checkout review, then emails the client.
Pentest PDF without a score
A buyer expected a 0-100 circle on the $297 report. The PDF uses severity colors and a do-this-week list. They use the included retest from the pentest workspace, not a credit rescan, to prove closure.
Validation
Validation Checklist
Use this checklist to confirm the workflow was completed correctly.
- Critical/high findings have named owners and target resolution windows.
- Remediation steps are documented before moving to lower-severity items.
- Shared output format matches the receiving stakeholder context.
- Everyone involved understands whether the shared link is a private app view, temporary artifact, or public-safe page.
- Post-fix rerun confirms closure of the original issue.
Troubleshooting
Common Problems And Fixes
If something does not match expectation, check these common failure modes first.
Exporting without triage context
Before sharing externally, summarize highest-priority findings and remediation status so reports remain actionable.
Treating every copied URL as the same kind of share path
A copied URL can point to an app view, a temporary report artifact, or a public-safe route depending on the workflow. Confirm what the recipient is meant to open before distributing it.
No rerun after fix deployment
Always rerun after remediation to verify closure and avoid reporting assumptions.
Assuming API spec imports do not create saved reports
API spec scans are saved in account history and can generate stored report artifacts. Review the result from scan history when you need to share or compare the imported-spec workflow later.
Navigate
Related Pages
Use these links to continue your workflow without losing context.
Scans And Depths
Open Scans And Depths to continue this workflow.
Help: Reports And Sharing
Open Help: Reports And Sharing to continue this workflow.
Premium Assessments
Open Premium Assessments to continue this workflow.
Tools And Guides
Open Tools And Guides to continue this workflow.
How to Fix Missing Security Headers
Open How to Fix Missing Security Headers to continue this workflow.
White-Label Reports
Open White-Label Reports to continue this workflow.
FAQ
Reports And Exports FAQs
Common questions for this topic.
No. Reports can be used by technical and decision stakeholders when paired with clear remediation context and risk prioritization.
Next Recommended Action
Continue to the best next page based on where you are in your workflow.