Skip to main content
CyStack VulnScan reports turn scan results into shareable remediation and management artifacts. VulnScan supports three report formats: CSV, JSON, and PDF. Export report

​
Format Selection

Other export formats are intentionally not supported so the product can keep report quality, field mapping, and automation behavior consistent.

​
Export From the Web UI

  1. Open Scans and select the completed scan, or open Reports.
  2. Choose Export.
  3. Select CSV, JSON, or PDF.
  4. Choose the report language where available.
  5. Confirm the export.
CSV and JSON are generated for immediate download. PDF export runs as a background job because report rendering may take longer for large scans.

​
PDF Background Jobs

PDF generation does not depend on the browser tab staying open. When a user starts PDF export:
  1. VulnScan creates a report job in the database.
  2. The PDF export button is locked for that report while the job is running.
  3. The user can leave the page or close the browser.
  4. When the PDF is ready, VulnScan marks the job completed.
  5. If mail is configured, the report creator receives a report-ready email.
  6. The user returns to the Web UI to download the file. Deployments may also attach the PDF to the email where allowed by mail size policy.
This model is designed for large scans and avoids losing reports when a browser session ends.

​
What a Report Includes

Report content depends on the scan results and selected format, but the core report model includes:
  • Workspace and scan metadata.
  • Target, asset, and scan source.
  • Scan start time, finish time, and duration.
  • Severity summary and finding distribution.
  • Findings with title, severity, risk score, confidence, affected location, and status.
  • CVE, CWE, CVSS, EPSS, CISA KEV, OWASP Top 10, and OWASP WSTG fields where available.
  • Evidence and remediation guidance.
  • References.
  • Discovery context such as technologies, services, TLS, and WAF/CDN where relevant.

​
Export From the CLI

Generate JSON and CSV:
Generate Vietnamese report text where supported:
Scan targets from a file and include subdomain discovery:

​
Report Quality Checklist

Before sharing a report externally:
  • Confirm the scan target and source are correct.
  • Review Critical and High findings for obvious ownership or scope mistakes.
  • Check whether authenticated scan context was used when required.
  • Confirm the report language.
  • Verify that false positives or accepted risks are documented.
  • Confirm mail delivery if the PDF was generated asynchronously.