How to export findings for a security audit or SOC 2
Export a single scan report
Section titled “Export a single scan report”Open the scan run
Go to Tests, select the environment, and click on the scan run you want to export.
Export
On the run detail page, click Export.
Choose format
Choose PDF for a formatted report suitable for sharing with auditors, or JSON for integration with ticketing systems or security dashboards.
Export PR review findings
Section titled “Export PR review findings”Open the PR run
Go to the Dashboard, select a repository, and click on a PR run to open its detail page.
Export
Click Export and select the format.
To export findings across all PRs for a repository, go to Dashboard → the repository → Export all findings. This produces a JSON file of all finding records for that repository.
What the PDF report includes
Section titled “What the PDF report includes”- Scan date, target, and scope (permission tier)
- Overall risk score
- All findings with severity, location, description, and remediation
- Attack surface summary (endpoints discovered, tests run)
- Comparison with previous scan (new, resolved, persistent, regression)
The PDF is formatted for sharing with external parties: customers, auditors, security questionnaire respondents. It does not include internal metadata (run IDs, database IDs).
Evidence of continuous testing for SOC 2
Section titled “Evidence of continuous testing for SOC 2”SOC 2 Type II requires evidence that security controls operated continuously over the audit period, not just at a point in time.
To build your evidence package:
- Export monthly JSON findings dumps from the Dashboard for each repository
- The PR findings history shows security review was applied to every code change throughout the period
If your auditor needs a specific report format or additional metadata, contact [email protected].