Sharing Reports

Use PostQ reports to exchange cryptographic asset inventories, share remediation findings with application teams, and retain evidence for security and migration reviews. Standard scan reports are generated automatically; exports of selected rows are created from the report viewer.

Cryptography bill of materials

PostQ produces cbom.json in CycloneDX 1.7 format to exchange detected cryptographic asset information with inventory and governance processes.

Import the file into a tool that supports the relevant CycloneDX cryptography data, or inspect it in the Report Viewer. Confirm which fields the receiving tool preserves. The CBOM describes detected cryptography and does not provide a complete software dependency inventory.

Security-tool results

PostQ produces results.sarif in SARIF 2.1.0 format for source-linked findings. Use it to bring supported results into a compatible code-scanning or security review tool.

Configure the receiving tool's import or your pipeline's upload step. Review the original PostQ reports when you need grouped-operation context that the receiving tool does not display.

Spreadsheet review lists

Export CSV when a team needs to sort, discuss, or track a selected set of findings in a spreadsheet.

Apply the desired report filters and choose the CSV export. Include the application version and scan reference in your handoff so the recipient can return to the complete evidence.

Selected results in JSON

Export JSON when you need a structured copy of the currently reviewed rows. Select the appropriate report view, apply filters, and choose the JSON export.

The export represents a review selection. For a recurring integration that needs the complete assessment, use the original scan reports described below.

Complete reports for automation

PostQ provides JSON reports for individual crypto functions, operation groups, repository assessment, and supporting findings. These files let your team build its own reporting or acceptance-policy integration.

Use Report File Reference to choose the input and check its schema version. Preserve scan identity when joining related reports, and account for format changes when upgrading PostQ.

Scan identification and traceability

Each scan includes manifest.json with its identity, inputs, report locations, and available warnings. Use it to establish which reports belong together and what source was assessed.

Retain the manifest with reports used for review, audit, or automation. Check it when source scope or report completeness is in question.

Complete report handoff

Share the completed report folder when another reviewer needs the full assessment context. The recipient can use the standalone Report Viewer without a scanner license.

Use an approved transfer location and include the source revision in your handoff records. Reports can contain source excerpts and security-sensitive settings. See Security and Privacy.

Diagnostic evidence

The scan folder includes raw scan evidence that can help investigate unexpected or incomplete results. The report artifact reference identifies these files and their purpose.

Start troubleshooting with the manifest, exit code, and logs. Provide raw evidence through your approved support process when needed, after checking it for sensitive content. See Troubleshooting.