reports

Read-only views of completed scans + report exports.

📄️Report metadata — scan + targets + finding summary + non-issues.

Report metadata — scan + targets + finding summary + non-issues.

📄️LLM usage for one scan (per-model/per-agent rows + totals) and its security-run-unit entitlement.

LLM usage for one scan (per-model/per-agent rows + totals) and its security-run-unit entitlement.

📄️Single-finding detail with full description, CVSS, adversarial-review state, etc.

Single-finding detail with full description, CVSS, adversarial-review state, etc.

📄️Raw proof-of-concept artifact for a finding.

Tier-gated by `allow_artifact_generation`. Tiers without artifact generation get a 404 (not 403) so they can't infer artifact existence.

📄️Draft disclosure email for a finding (Markdown).

Tier-gated by both `allow_artifact_generation` and `allow_disclosure_tracking`. Missing artifact generation returns 404; missing disclosure tracking returns 403.

📄️Generate a report export in markdown, single-file HTML, or pentester-style PDF.

Generate a report export in markdown, single-file HTML, or pentester-style PDF.

📄️Download the scan's SBOM (CycloneDX 1.5 or SPDX 2.3 JSON).

Rendered from the scan's durable dependency-scan artifact: the full pinned-component inventory, with OSV advisories embedded in the CycloneDX variant. 404 for scans without a dependency inventory (remote scans, dependency scan disabled, or no pinned dependencies).