Skip to content

Report Viewer

Use the standalone PostQ Report Viewer to explore a completed cryptographic inventory and its assessments without running a scan. Security reviewers, architects, auditors, and application leads can investigate the same evidence without installing the scanner runtime.

Open the viewer

  1. Run a scan with the CLI or container.
  2. Copy report-viewer/index.html from the extracted CLI distribution, or from the container image, into the generated report folder.
  3. Open the copied index.html in a supported desktop browser.
  4. Select Load Folder to load the complete scan directory, or Load Files to choose individual report JSON files.
  5. Select a loaded report to explore Crypto Functions and Operation Groups, review Assessment, or inspect CBOM and SARIF when those files are present. Experimental Migration Review is available when the assessment report supplies the required information.

CLI packages include the viewer at:

postq-code-scanner-cli-<version>/report-viewer/index.html

Container users can copy it out of the image with docker cp or podman cp:

docker create --name postq-viewer-copy postqsoftwarelabs/postqcodescanner:<version>
docker cp postq-viewer-copy:/opt/postq/postq-code-scanner-cli/report-viewer/index.html ./reports/index.html
docker rm postq-viewer-copy

Load the complete report folder whenever possible. The primary review set is:

  • crypto-functions.json
  • operation-groups.json
  • crypto-finding-assessment.json

The viewer can also identify findings.json, cbom.json, results.sarif, and related report files. Files from one scan should share the same scanSession.

Review tools

  • Use presets such as PQC priority, quantum broken, quantum weakened, FIPS review, and review gaps to focus large reports.
  • Use text search and detailed filters for CWE, anti-pattern, quantum category, FIPS source assessment, risk signal, risk level, and confidence.
  • Collapse or expand file sections in both Crypto Functions and Operation Groups.
  • Follow Assessment category, group-count, or file-count links to a selection with editable filters.
  • Export the currently filtered Crypto Functions or Operation Groups to CSV or JSON for handoff.
  • Copy or download loaded CBOM and SARIF artifacts when reviewing interoperability output.

Local report access

The viewer is self-contained and does not require a PostQ service, Java, OpenGrep, or a scanner license. It reads the files you select in the browser. No source scan runs while you review reports. Treat the extracted viewer and loaded reports according to your organization's workstation and data-classification policy.

Limitations

  • The viewer does not modify source or scanner facts.
  • Source navigation is best experienced through the VS Code or Eclipse host where the scanned source remains available.
  • Loading one report from a folder can omit context shown by related reports.
  • Reports from different schemaVersion values may not expose identical fields.
  • Experimental Migration Review provides summaries and review guidance; it does not currently provide filters, a priority-operation table, or selection exports. See Assessment Overview.