Skip to content

Report Viewer Quick Start

Use this guide for a review-only deployment. The standalone viewer opens completed PostQ report folders without Java, OpenGrep, scanner execution, or a PostQ scanner license.

Typical time: 5 minutes. Requires the CLI or container artifact, a desktop browser, and an authorized report folder.

1. Confirm the review requirements

Have an authorized, complete PostQ report folder available. The viewer is carried inside the CLI and container artifacts; it requires a current desktop browser but does not require scanner prerequisites or a license to open completed reports.

2. Install or update the browser prerequisite

Use your organization's managed browser where available. If a browser must be installed, use an official publisher resource:

See Prerequisites for the complete requirement matrix and platform notes.

3. Copy the viewer

Copy report-viewer/index.html from the extracted CLI distribution into the report folder:

postq-code-scanner-cli-<version>/report-viewer/index.html

For container-only access, copy the same file from the image:

docker create --name postq-viewer-copy postqsoftwarelabs/postqcodescanner:<version>
docker cp postq-viewer-copy:/opt/postq/postq-code-scanner-cli/report-viewer/index.html ./reports/index.html
docker rm postq-viewer-copy

4. Prepare a report folder

Use a complete output directory from one scan. The recommended review set contains:

  • manifest.json;
  • crypto-finding-assessment.json;
  • operation-groups.json;
  • crypto-functions.json.

Files from the same scan share a scanSession.

5. Load the reports

  1. Select Load Folder in the viewer.
  2. Choose the complete scan output directory.
  3. Approve the browser's local file-selection prompt.
  4. Select the loaded report set.

Use Load Files only when folder selection is unavailable or policy requires a smaller set.

6. Complete the first review

  1. Open Crypto Functions to inspect the detected inventory, source locations, and settings.
  2. Open Operation Groups to examine related cryptographic calls together.
  3. Open Assessment for security posture, quantum exposure, and review workload.
  4. Inspect the CBOM when you need to exchange inventory data with a compatible tool.
  5. Record review decisions in your tracking system and retain the complete report set.

Success checklist

  • The report set appears in the viewer navigation.
  • Assessment, Crypto Functions, and Operation Groups load without errors.
  • The loaded files have compatible schemaVersion and scanSession values.
  • Reports remain in approved protected storage after review.

The viewer does not perform scans or modify scanner facts. Use VS Code or Eclipse when direct source navigation is required.

Next: Report Viewer and Interpret Results.