Skip to content

Report Viewer Quick Start

Use this guide for a review-only deployment. The standalone viewer opens completed PostQ report folders without Java, OpenGrep, scanner execution, or a PostQ scanner license.

Typical time: 5 minutes. Requires the Report Viewer artifact, a desktop browser, and an authorized report folder.

1. Confirm the review requirements

Have the Report Viewer archive and an authorized, complete PostQ report folder available. The viewer requires a current desktop browser but does not require scanner prerequisites or a license.

2. Install or update the browser prerequisite

Use your organization's managed browser where available. If a browser must be installed, use an official publisher resource:

See Prerequisites for the complete requirement matrix and platform notes.

3. Install the viewer

Extract postq-code-scanner-report-viewer-<version>.zip to an approved local directory. Keep its files together and open index.html in a current enterprise-supported desktop browser.

4. Prepare a report folder

Use a complete output directory from one scan. The recommended review set contains:

  • manifest.json;
  • crypto-finding-assessment.json;
  • operation-groups.json;
  • crypto-functions.json.

Files from the same scan share a scanSession.

5. Load the reports

  1. Select Load Folder in the viewer.
  2. Choose the complete scan output directory.
  3. Approve the browser's local file-selection prompt.
  4. Select the loaded report set.

Use Load Files only when folder selection is unavailable or policy requires a smaller set.

6. Complete the first review

  1. Open Assessment for repository posture and review workload.
  2. Open Operation Groups for crypto-operation lifecycles.
  3. Open Crypto Functions for source locations and parameter evidence.
  4. Record review decisions outside the immutable generated JSON.

Success checklist

  • The report set appears in the viewer navigation.
  • Assessment, Crypto Functions, and Operation Groups load without errors.
  • The loaded files have compatible schemaVersion and scanSession values.
  • Reports remain in approved protected storage after review.

The viewer does not perform scans or modify scanner facts. Use VS Code or Eclipse when direct source navigation is required.

Next: Report Viewer and Interpret Results.