PDF reports

Vulnara turns the same data you see in the web app into PDF reports you can share with people who do not use Vulnara: management, auditors, customers. There are six: a security summary for your whole workspace, and reports for one git workspace, one repository, one scan, one web application or one network.

What it is for

• Giving a security owner or manager a readable answer to "how are we doing, and where is the problem?"
• Handing evidence of a scan to someone outside the team.
• Keeping a dated record of your posture at a point in time.

How it works

Every report is an A4 landscape PDF with a Vulnara header and a page footer on every page. Each opens with the score and a plain-language executive summary: how the posture reads, how urgent the critical and high findings are, which repository is weakest and how much has been scanned. Severities use the same scale and colours as the web app, advisory ids link to their NVD or GitHub advisory page, file paths link to the file on GitHub, GitLab, Bitbucket or Azure DevOps, at the line where one is known (Codeberg / Forgejo paths link to the repository), and every repository, git workspace and scan links back to the web app.

The six reports

• Security summary: your whole workspace. Overall posture with the headline score, never-scanned and open-finding counts, the executive summary, a Workspaces table (when you have more than one git workspace) showing each git workspace's repositories, scanned and unscanned counts, findings and worst score, findings by severity, score by repository, the repository inventory, the full scan history grouped by what each scan covered, and a Not yet scanned list. When the workspace has web applications, it also has a Web application section: how many targets you have and how many were scanned, a table with each target's latest scan, web findings by severity, and the most severe web findings with their triage state. When it has networks, a Networks section does the same for them: each network's latest scan, its ports by state and the open ports found. A scan that covered two categories is listed once, under both together, so the groups add up to the number of scans.
• Workspace report: one git workspace. Its score, coverage, executive summary, findings by severity, score by repository and a table of its repositories.
• Repository report: one repository across every scan. Its score, findings by severity, a Scan results table with one row per current scan and a Coverage column naming the categories it covered, a Categories covered count, and the code, secret and dependency findings from those scans. Two scans covering the same category stay two rows, each with its own score.
• Web application report: one web application. Its address, the paths in and out of scope, whether a sign-in is set and which kind (never the secret), its latest completed scan, findings by severity, every finding with the URL where it was found, its CVE or CWE and its triage state, and its 10 most recent scans.
• Network report: one network. Its address range and type, whether it is reached through a connector agent, its latest completed scan, its ports by state (open, filtered, closed), the services found on open ports, and its recent scans.
• Scan report: one scan. Its status, finding count, critical count and duration, findings by severity, and its Code and secret findings and Vulnerable dependencies tables. Its caption names what the scan covered, for example "Dependencies and secrets scan of my-app".

Reports name scans by category and never by scanner. A scan whose categories cannot be determined reads Uncategorised and is not counted as coverage. Web application and network results come from each target's latest completed scan. In the security summary they have their own sections and are not added to the headline totals, so those still match the dashboard. A network scan reports open ports and the services behind them, not vulnerabilities, so network reports group results by port state instead of by severity.

Dependency tables show severity, package, installed version, fixed-in version (or "not fixed") and advisory. Finding tables are sorted with the most severe first.

Scores in reports

• The headline score in the security summary is the same score as on the dashboard. See Security score.
• Scores are labelled with a band: Strong (80 and above), Good (60 and above), Fair (40 and above) or Needs attention (below 40).
• A repository that has never been scanned shows as Not assessed, not as 0. Reports say how many repositories are unscanned and that unscanned is not the same as clean.
• A scan that did not finish successfully has no score. Its report says the scan did not complete and reports no findings, because a scan that never ran finds nothing and would otherwise read as clean.
• A git workspace's score in the security summary is its worst repository's score, not an average, and the report says so.
• In the security summary, a repository scanned several times is counted once in the totals, while all its scans appear in the scan history.
• Reports show findings by severity and no breakdown by category. A finding two scanners both reported is counted once in the report's total and twice in any per-scan breakdown, so a category chart would not reconcile with the total printed beside it.

What you can set

• Report type and scope: the security summary, or one git workspace, repository or scan.
• Workspace: reports cover the workspace you are working in. Switch workspace first to report on another.
• Schedule: to have a report emailed on a schedule instead of downloading it, see Schedule recurring scans.

Do it

In the web app

Every report is a Download report button in the web app at vulnara.rso.dev:

• Security summary: on the Dashboard, next to the period selector. Schedule beside it sets up a scheduled summary.
• Workspace report: in the git workspace's detail panel under Workspaces.
• Repository report: in the repository's detail drawer, or from its row actions under Repositories.
• Scan report: on the scan result page under Repository Scans.
• Web application report: on the web application's screen, or from its row actions under Web applications.
• Network report: on the network's screen, or from its row actions under Networks.

The Vulnerabilities explorer also offers a repository or scan report when it is filtered to a single repository or scan. The report covers everything in that repository or scan, not only the rows the filters left.

The file is saved as vulnara-security-summary_<workspace>_<date>.pdf, or vulnara-<kind>-report_<workspace>_<name>_<date>.pdf for the others.

With the REST API

The reports are also plain HTTP downloads at https://vulnara-gw.rso.dev:

• GET /reports/summary: the security summary.
• GET /reports/workspace/:id: a git workspace report.
• GET /reports/repository/:id: a repository report.
• GET /reports/scan/:id: a scan report.
• GET /reports/web-target/:id: a web application report.
• GET /reports/network/:id: a network report.

Send your access token as Authorization: Bearer <token>. To choose the workspace, send its id in the X-Tenant header; without it, your first workspace is used.

curl -H "Authorization: Bearer $VULNARA_TOKEN" \
     -H "X-Tenant: <workspace id>" \
     -o summary.pdf \
     https://vulnara-gw.rso.dev/reports/summary

See the REST reference for the full list of routes.

Good to know

• Any member of the workspace can download reports.
• A report lists at most 400 findings, most severe first. When there are more, it says how many of the total it shows and that the full list is in the web app.
• Text a PDF font cannot show, such as some characters in a matched value, is replaced rather than failing the report. Long values are shortened with ... to fit their column.
• Report downloads are limited to 20 a minute per person, with a burst of 5, across all reports. Past that, the download is refused with 429 and a Retry-After header saying how many seconds to wait.
• A missing or invalid token returns 401, and a workspace you are not a member of returns 403. A report that cannot be generated returns 404 or 502. In the web app, a failed download shows an error and saves no file.