Overview
ZeroPath generates exportable security reports for compliance reviews, stakeholder updates, and audit documentation. Reports are generated asynchronously and available for download from the dashboard. The Reports section of the dashboard is organized into tabs:- Assets — An overview of repositories, languages, and frameworks across your organization. The table footer shows your current position (e.g. “Showing 50 of 200 applications”) and loads more results automatically as you scroll.
- Views — Build custom report views from preset or saved filter configurations.
- Generate — Create downloadable Scan, Organization Summary, or SOC 2 reports.
- History — View and download previously generated reports.
Dashboard Overview Statistics
The dashboard displays five key security posture metrics at a glance:
The “Reachable & Exploitable” metric highlights the subset of dependency findings that have both a reachable code path and confirmed exploitability, helping you focus on the SCA issues that pose the most immediate risk.
Dashboard Filters
You can filter all dashboard charts by severity, vulnerability class, and application. The application filter lets you scope every widget — including Issues by Severity, Issues by Vulnerability, Issues by Repository, Issues by PR Author, Top Issues, and Top Issues Resolved — to one or more specific applications. This is especially useful in organizations with monorepos containing multiple services, allowing you to focus on the security posture of a single application at a time.Issues By Application
The dashboard includes an Issues By Application chart that groups open and resolved issues by application. Each bar represents one application, split by open (red) and resolved (green) segments. You can hover over a segment to see the exact count. This chart respects the same severity, vulnerability class, and application filters as the other dashboard widgets.Report Types
Export Formats
Scan reports support multiple output formats:
Organization summary and SOC 2 reports are generated as DOCX documents. Custom reports can be exported as CSV, CASA CSV, SARIF, or PDF (see Exporting Custom Reports).
Generating Reports
Scan Report
- Navigate to Reports → Generate in the dashboard.
- Click the “Scan Report” card.
- Select a repository from the dropdown.
- Select a scan from the dropdown (populated after choosing a repo — shows full and PR scans with issue counts).
- Select the format (DOCX, CSV, SARIF, or SBOM).
- Set a score threshold — only findings above this score are included.
- Choose which issue types to include (Exclude False Positives or All Issues).
- Click Generate. The report is created asynchronously — download it from the History tab when ready.
Organization Summary
- Navigate to Reports → Generate in the dashboard.
- Click the “Organization Summary Report” card.
- Optionally provide a custom company name.
- Click Generate. Download the DOCX from the History tab when ready.
SOC 2 Report
- Navigate to Reports → Generate in the dashboard.
- Click the “SOC 2” card.
- Optionally provide a company name.
- Click Generate. Download from the History tab when ready.
Report History
All generated reports are listed in the Reports section of the dashboard with:- Report type and title
- Generation date and status (pending, processing, completed, failed)
- File name and file size
- Download button
fileName alongside the status, so you can identify the generated file before downloading it.
Reports can be downloaded or deleted from the history view.
Custom Report Statistics
Custom reports let you apply the full set of issue filters and retrieve aggregated statistics for the matching findings. This is useful for building executive dashboards, tracking remediation progress over time, or generating focused views of your security posture.Interactive Dashboard
When you open a custom report in the Views tab, the platform displays an interactive dashboard with visual charts that update automatically as you change filters:
Below the charts, a paginated issue table lists all matching findings with columns for severity, score, title, repository, vulnerability class, status, and detection date. You can click any row to navigate directly to the issue detail page.
Filter Bar
The filter bar uses a chip-based interface for building queries. Each filter appears as a compact chip showing the field name, operator, and selected value. You can:- Click “Add filter” to choose from available filter fields, organized by category (Issue, Repository, Scan).
- Click an existing filter chip to edit its field, operator, or value inline via a popover.
- Remove individual filters by clicking the x button on a chip, or click Clear to reset all filters.
- Click Save to store the current filter configuration as a named report (see Saved Custom Reports below).
- Click Export to download the matching issues in your preferred format (see Exporting Custom Reports below).
Custom report statistics include:
You can narrow results using any combination of the standard issue filters, including:
- Date ranges — filter by issue creation date (
createdAfter/createdBefore) or resolution date (resolvedAfter/resolvedBefore) to focus on a specific time window - Validation state — include only confirmed, disconfirmed, or unknown findings
- Reachability — filter by whether the vulnerable code path is reachable in your application
- Vulnerability class operators — match vulnerability classes using exact match, prefix, or substring operators for more precise filtering
- Application filters — narrow results to specific applications detected within your repositories (useful for monorepos with multiple services)
- Repository branches — scope the custom report to specific branches per repository, rather than using only the default branch
- Score exclusion — exclude issues at a specific score value
Preset Reports
The Views tab includes several built-in preset reports so you can start analyzing common issue categories immediately without configuring filters manually:
Preset reports cannot be edited or deleted. To customize a preset, select it and modify the filters, then save it as a new custom report.
Saved Custom Reports
You can save frequently used filter configurations as named custom reports for quick access. Saved reports are available both from the Views tab in the dashboard and through the API. From the Views tab, you can:- Select New Custom Report to build a report from scratch, or choose a preset report to start from a predefined filter configuration.
- Save a custom report with a name so you can return to it later. Saved reports appear in the report selector dropdown under Saved Reports.
- Delete a saved report by selecting it and clicking the delete button.
Exporting Custom Reports
You can export any custom report view by clicking the Export button in the filter bar. This opens an export dialog where you choose a format and download the matching issues.Export Formats
PDF Export Details
The generated PDF includes:- A cover page with the report name, generation date, total issue count, and mean time to remediation
- Charts matching the interactive dashboard: total issues, severity distribution, MTTR, top vulnerability classes, and issue trend over time
- A top issues table listing the highest-scoring findings (up to 500) with severity, score, title, repository, vulnerability class, status, and detection date
Exporting custom reports requires the Custom Report View permission.
Filter Schema Discovery
You can retrieve the full list of available filter fields and their valid values programmatically via the filter schema endpoint. This is useful when building integrations or custom dashboards, as it lets you discover which filters are supported and what operators each filter accepts without hardcoding filter definitions.Report Contents
Scan Report (DOCX)
- Executive summary with finding counts by severity
- Repository and scan metadata (branch, commit, date)
- Detailed finding list with:
- Title, severity, confidence score
- Affected file and line range
- Vulnerability description and remediation guidance
- CWE classifications
Organization Summary
- Aggregate statistics across all repositories
- Finding trends and severity distribution
- Repository-level breakdown
- Top vulnerabilities by impact
SBOM Export
- CycloneDX JSON format
- Full dependency inventory from the SCA scan (when available)
- Package metadata, licenses, and dependency relationships
- You can generate an SBOM from any completed scan — an SCA scan is included automatically if available, but is not required
- SBOM generation usually takes less than a minute. Keep the dialog open while it completes.
- See SCA SBOM Exports for details