Reports
Cerberon issues a report when a scan finishes. Each regeneration creates a new version, and every version is kept.
What a report contains
Section titled “What a report contains”A report opens with a cover, document control and contents, then:
| Section | Content |
|---|---|
| Executive summary | The outcome in plain language, with counts by severity. |
| Scope and objectives, Timeline | What was tested, by which scan type, and when. |
| Methodology | The method and standard the scan followed, such as OWASP WSTG v4.2 or MASVS. |
| Risk rating and severity | How severity and CVSS were assigned. |
| Findings | Each finding with its evidence, affected location, standards references and remediation. |
| Analyst review | Agent triage notes, where the scan used an agent. |
| Exploitability and VEX | The exploitability status of each dependency advisory. |
| Measured engine facts | What each engine reported about its own run. |
| Limitations and exclusions | What was not tested and why. A scan that did not complete says so here. |
| Appendices, Sign-off | Supporting detail and the report author. |
Findings are mapped to the standards that apply: OWASP Top 10, OWASP API Security Top 10, OWASP ASVS, OWASP MASVS, OWASP Mobile Top 10, CWE and CIS Benchmarks.
The Summary layout is the same document without the detailed finding cards. Every number and sentence is the same.
Download a report
Section titled “Download a report”On the scan page, select Download. Choose:
- Format: PDF, HTML, CSV, SARIF or JSON.
- Full or Masked. See below.
- Layout: Standard report or Summary report.
- Template, and Open rendered preview to check it first.
Artifacts & Reports lists every report version with its creation time and SHA-256 fingerprint, and every file the scan produced.
| Format | format value |
Use |
|---|---|---|
pdf |
Management summaries and customer deliverables | |
| HTML | html |
A single offline file with severity filtering |
| CSV | csv |
Spreadsheets and tracker imports |
| SARIF 2.1.0 | sarif |
Code scanning annotations in GitHub, GitLab or Azure DevOps |
| JSON | json |
SIEM ingestion and your own tooling |
SBOM, CBOM and OpenVEX documents are exported from the dependency scan. See Dependencies and SBOM.
Masked reports
Section titled “Masked reports”A masked report applies the instance’s privacy policy before the file leaves the server. Secrets, tokens, internal addresses, host names and email addresses are masked. The database keeps the real values. Through the API, add redact=on to the download URL.
If the privacy policy is off, a masked download is labelled as not masked. See AI providers and privacy.
Integrity
Section titled “Integrity”Every report version and every produced file carries a SHA-256 fingerprint, so a recipient can confirm the file is the one the instance issued. Scan reports are fingerprinted, not signed. SBOM and CBOM documents are signed with Ed25519, and the public key is published at /.well-known/cerberon-signing-key.
Branding
Section titled “Branding”Administrators configure reports under Settings > Reporting:
- Report templates: your logo (PNG or SVG), accent colour and the default template.
- Report author: the name and contact details in the report sign-off.
- Document signing key: the key that signs SBOM and CBOM documents.