Who This Topic Is For
Users coordinating remediation and stakeholder communication from scan outputs.
Help
Reports And Sharing Help
Get practical help with triage, report sharing, copied URLs, and communicating remediation progress clearly.
Prerequisites
Before You Start
Use this checklist to make sure the workflow guidance applies cleanly to your current task.
- A recent scan result is available.
- You know the intended audience for shared output.
- You can identify owner and timeline for the top-priority findings.
Expectations
What To Expect
Use this section to set the right outcome before you start the workflow.
Agency client links last 14 days in-app
Copy client link and Email to client create a branded /r/ view. Expired tokens stay dead. Create a new link from Scan History or the pentest workspace. Do not send /report/{domain}/{date} as the agency path.
Pentest PDFs have no score
Use severity colors and the do-this-week list. Dashboard credit scans still show a score.
Playbook
Step-By-Step Guidance
Follow these steps in order for a reliable and repeatable outcome.
Prioritize before sharing.
Summarize highest-impact findings first so stakeholders focus on meaningful risk reduction.
Share in the right format for the audience.
Use private in-app views, generated HTML/PDF/JSON outputs, copied workflow URLs, or supported public-safe pages based on what the recipient actually needs and what the workflow currently provides. API spec scans can also be reviewed and shared through saved scan history rather than forcing teams to pass around the original imported JSON.
Track closure and rerun validation.
Attach remediation status and rerun results so reports show progress, not just a static snapshot.
Share pentest HTML and PDF without expecting a score.
Penetration Test and Comprehensive Pentest reports use do-this-week lists and color-coded severity (Critical red, High orange, Medium amber). They do not include a 0-100 score or PCI, SOC 2, or ISO badges.
Use included retests from the premium workspace, not a dashboard credit rescan, to prove a pentest finding is closed.
Use a branded client link for agency delivery.
Team and Enterprise users should use Copy client link or Email to client so the recipient opens /r/{token} with organization branding. That is not the same as copying a dashboard URL or the older /report/{domain}/{date} public-safe page.
See White-Label Reports help if the logo, hide-Vulnify setting, or link expiry is wrong.
Use recurring review cadence.
Review and share updates at key release milestones so risk posture discussions stay current and actionable.
Examples
Worked Examples
These scenarios show how the workflow looks in practice, including the result you should see.
Client opened the wrong URL
The client used /report/shop.example.com/2026-08-01. That public-safe page is not the branded agency deliverable. The agency copies a new client link from Scan History.
Share after branding save
The logo was uploaded after the PDF was generated. The emailed file still shows Vulnify. They save branding, download a new sample, then copy a new client link.
Operations
Operational Playbook
Use this long-form guidance to execute the workflow consistently across planning, implementation, and validation.
Design Reports For Decision-Making, Not Data Dumping
Effective reporting starts with audience intent. Technical teams need actionable remediation context, while leadership needs clarity on risk concentration, ownership, and timeline confidence. A comprehensive report should therefore lead with prioritized impact, not raw finding volume. Begin with critical and high-severity outcomes, then show what is being fixed now, what is pending, and what requires escalation. Include concise summaries that explain why each priority matters to operational risk. Avoid unstructured exports that force stakeholders to infer conclusions themselves. Decision-ready reports shorten alignment cycles and improve remediation momentum because stakeholders can act immediately. In practice, your report structure should answer four questions quickly: what matters most, who owns it, when it will be addressed, and how closure will be verified.
Make Ownership And Timeline Fields Mandatory
Reports are comprehensive only when accountability is explicit. Every high-priority finding should include an owner, a target resolution window, and a current status. Without these fields, reporting becomes observational instead of operational. Standardize status language so stakeholders read updates consistently across teams and time periods. If ownership is shared, identify one accountable lead to avoid diffusion of responsibility. Add timeline confidence notes when dependencies may affect closure windows. This creates transparency and reduces surprise escalation late in delivery cycles. Ownership metadata also improves cross-functional communication because non-technical stakeholders can track remediation progress without interpreting raw technical detail. Making ownership mandatory transforms reports into execution artifacts, not static documents.
Use Verification History To Show Real Risk Movement
A single report snapshot cannot prove trend direction. Include verification history that shows before-and-after status across remediation cycles. When possible, attach rerun outcomes and highlight whether each priority finding is resolved, partially improved, or unchanged. This historical context is essential for leadership confidence and for technical planning, because teams can see whether interventions are reducing risk or merely shifting symptoms. If a finding remains open after changes, explicitly state next actions and revised timeline rather than hiding unresolved items. Comprehensive reporting embraces transparency because it builds credibility and prevents false closure assumptions. Over multiple cycles, verification history becomes one of the strongest signals of security program maturity and execution discipline.
Create Distribution Paths Based On Least Privilege
Report sharing should be intentional and role-aware. Technical remediation details may not be appropriate for all recipients, while summary-level risk views may be insufficient for engineers implementing fixes. Define distribution groups by purpose: remediation execution, program governance, and leadership oversight. Share the right level of detail with each group while preserving least-privilege access to sensitive data. Document where reports are stored, who can edit status fields, and who can approve final closure communication. This prevents uncontrolled forwarding and helps maintain data handling discipline. Structured distribution also improves follow-up quality because each audience receives information in the format most useful for their decisions.
Operationalize Recurring Reporting Cadence
Comprehensive reporting is a recurring practice, not a one-time deliverable. Establish cadence aligned to release cycles and risk posture reviews, such as pre-release checkpoints and post-remediation verification updates. Keep update intervals predictable so stakeholders know when to expect refreshed status and can plan decisions accordingly. Include escalation thresholds for unresolved high-impact items so governance paths are triggered before deadlines are at risk. Over time, recurring cadence improves consistency and reduces meeting overhead because report consumers trust that updates will arrive with stable structure. It also strengthens SEO value for Help content because your guidance reflects real-world operational rhythm and measurable process maturity.
Create Stakeholder-Specific Report Views Without Losing Consistency
Large organizations often need multiple report views: a technical execution view, an operational governance view, and a leadership summary view. Comprehensive help should guide users to maintain one source of truth while adapting presentation depth for each audience. Use consistent severity labels, ownership fields, and verification-state language across all views so interpretation remains stable. Then tailor emphasis: technical views focus on remediation specifics, governance views highlight trend and control effectiveness, and leadership summaries focus on impact and timeline confidence. This approach improves communication quality while preventing contradictory narratives across teams. It also reduces rework because the report model stays consistent even when audience needs differ.
Validation
Validation Checklist
Use this checklist to confirm the workflow was completed correctly.
- Shared report includes priority context.
- Owners and remediation windows are defined.
- Recipients understand whether the shared URL is temporary, private, or public-safe.
- Post-fix verification state is visible.
- Status updates are reviewed on recurring cadence.
Troubleshooting
Common Problems And Fixes
If something does not match expectation, check these common failure modes first.
Sharing raw findings without action context
Include ownership, target date, and severity priority so report consumers can make decisions quickly.
Sharing a copied URL without clarifying what it opens
Explain whether the link points to an app view, a generated HTML/PDF/JSON artifact, or a public-safe route so recipients know what level of access and persistence to expect.
No trend tracking after first report
Use recurring comparisons to show whether risk is improving over time.
Reporting lacks clear ownership fields
Attach clear owner and target date details so technical and leadership stakeholders can execute decisively.
Forwarding imported API spec files instead of the resulting report context
Share the saved Vulnify result or generated report output when possible. The imported spec is input material; the report is the operational artifact stakeholders usually need.
Navigate
Related Pages
Use these links to continue your workflow without losing context.
Documentation: Reports And Exports
Open Documentation: Reports And Exports to continue this workflow.
Documentation: Premium Assessments
Open Documentation: Premium Assessments to continue this workflow.
Documentation: White-Label Reports
Open Documentation: White-Label Reports to continue this workflow.
Help: White-Label Reports
Open Help: White-Label Reports to continue this workflow.
Help: Running Scans
Open Help: Running Scans to continue this workflow.
Documentation Hub
Open Documentation Hub to continue this workflow.
Contact Support
Open Contact Support to continue this workflow.
FAQ
Reports And Sharing Help FAQs
Common questions for this topic.
No. Share prioritized current state with clear remediation status and planned closure windows.
Next Recommended Action
Continue to the best next page based on where you are in your workflow.