@secureport/cli

Turn a scanner's output into a client-ready security report.

MIT licensed. Runs entirely offline. There is no account, nothing is uploaded, and nothing leaves the machine.

npx @secureport/cli report pen scan.jsonl --url https://app.example.com > report.md

Reads Nuclei, ZAP, Burp, Nessus and a generic JSON format, and works out which one it is looking at. Renders five reports — Penetration Test, Vulnerability Assessment, Executive Summary, Attestation Letter and Retest — as Markdown, HTML or JSON.

Two runs, and it remembers

The tracked thing is the issue, not the finding, so a second run can say what got fixed and what came back.

npx @secureport/cli import run1.jsonl --url https://app.example.com --out run1.json
npx @secureport/cli report retest run2.jsonl --previous run1.json

Of the 4 issues carried into this retest, 1 is confirmed fixed, 3 are still
present, 0 returned, and 0 could not be retested.

The second command needs no --url: the baseline carries the target, and a baseline for a different target is refused rather than compared.

"Could not be retested" is not "fixed". A run that did not cover where an issue was found proves nothing about it, so it gets its own verdict and is left out of the percentage rather than counted either way. Pass --scope to say what a run actually covered.

Commands

| | | | --------------------------------- | ----------------------------------------------------------- | | secureport report <kind> <file> | Render a report. pen, vap, exec, attest or retest | | secureport import <file> | Reconcile findings into a snapshot for a later --previous | | secureport validate <file> | Say what is in a file, and whether it parses |

secureport --help lists every option. Exit codes are 0 for success, 1 for a bad command line and 2 for a bad input file.

What it does not claim

Reports state how their findings were produced and what that does not establish. Automated results are described as automated, a partial scope names itself, and nothing here certifies compliance with any standard. That is derived from the run rather than written into a template, so it cannot drift out of date.

The domain model, the fingerprint and the reconciliation are @secureport/core, which this wraps. Both are MIT.

Rendered examples of all five reports are at secureport.io.