Skip to main content

​
Export a single scan report

1

Open the scan run

Go to Tests, select the environment, and click on the scan run you want to export.
2

Export

On the run detail page, click Export.
3

Choose format

Choose PDF for a formatted report suitable for sharing with auditors, or JSON for integration with ticketing systems or security dashboards.

​
Export PR review findings

1

Open the PR run

Go to the Dashboard, select a repository, and click on a PR run to open its detail page.
2

Export

Click Export and select the format.
To export findings across all PRs for a repository, go to Dashboard → the repository → Export all findings. This produces a JSON file of all finding records for that repository.

​
What the PDF report includes

  • Scan date, target, and scope (permission tier)
  • Overall risk score
  • All findings with severity, location, description, and remediation
  • Attack surface summary (endpoints discovered, tests run)
  • Comparison with previous scan (new, resolved, persistent, regression)
The PDF is formatted for sharing with external parties — customers, auditors, security questionnaire respondents. It does not include internal metadata (run IDs, database IDs).

​
Evidence of continuous testing for SOC 2

SOC 2 Type II requires evidence that security controls operated continuously over the audit period, not just at a point in time.
Observability plan or higher is required for weekly scheduled scans, which produce the recurring timestamped reports auditors typically want.
To build your evidence package:
  • Enable weekly scheduled scans (Observability plan) — each scan produces a timestamped report
  • Export monthly JSON findings dumps from the Dashboard for each repository
  • The PR findings history shows security review was applied to every code change throughout the period
If your auditor needs a specific report format or additional metadata, contact wale@battletest.dev.