Overview
ZeroPath generates exportable security reports for compliance reviews, stakeholder updates, and audit documentation. Reports are generated asynchronously and available for download from the dashboard. The Reports section of the dashboard is organized into tabs:- Assets — An overview of repositories, languages, and frameworks across your organization. The table footer shows your current position (e.g. “Showing 50 of 200 applications”) and loads more results automatically as you scroll.
- Views — Build custom report views from preset or saved filter configurations.
- Generate — Create downloadable Scan, Organization Summary, or SOC 2 reports.
- History — View and download previously generated reports.
Dashboard Overview Statistics
The dashboard displays four key security posture metrics at a glance:
The “Reachable & Exploitable” metric highlights the subset of dependency findings that have both a reachable code path and confirmed exploitability, helping you focus on the SCA issues that pose the most immediate risk.
Dashboard Filters
You can filter all dashboard charts by severity, vulnerability class, and application. The application filter lets you scope every widget — including Issues by Severity, Issues by Vulnerability, Issues by Repository, Issues by PR Author, Top Issues, and Top Issues Resolved — to one or more specific applications. This is especially useful in organizations with monorepos containing multiple services, allowing you to focus on the security posture of a single application at a time. When any filter is active — including workspace-level team or tag filters, severity, vulnerability class, application, or a time granularity override — a scope strip appears between the filter controls and the statistics cards. Each active dimension is shown as a chip; you can click the x on a chip to clear that single dimension, or click Clear all to reset the dashboard to the full workspace. Clickable statistics cards (Total Open, Total Resolved, Mean Time To Resolve) carry all active filters into the Issues view, so the list you land on always matches the numbers you clicked. The Top Issues widget ranks findings by score, highest first. Findings that have not yet received a score are placed at the bottom of the list so that scored, actionable findings are always surfaced first. The date range picker offers preset windows including Last 1 year, in addition to the shorter presets. You can also choose a Quarterly time granularity from the period picker alongside the existing daily, weekly, and monthly options. Granularity options that would produce too few or too many chart points for the selected date range are automatically disabled. If you change the date range so that a previously selected granularity no longer fits, the picker resets to Auto.Issues By Application
The dashboard includes an Issues By Application chart that groups open and resolved issues by application. Each bar represents one application, split by open (red) and resolved (green) segments. You can hover over a segment to see the exact count. This chart respects the same severity, vulnerability class, and application filters as the other dashboard widgets.Issues By PR Author
The Issues By PR Author chart shows open issues from each repository’s latest merged pull request scan, grouped by the PR author. Scans for pull requests that were never merged are excluded, so no author is attributed findings from work that did not ship. Full-scan-only findings are not included here.Mean Time To Resolve Chart
The Mean Time To Resolve trend chart plots the average remediation time — in days — for issues resolved within each individual period (day, week, month, or quarter). Each point reflects only the issues that were resolved during that period, so the value is self-contained and does not shift when you change the date range. Periods in which no issues were resolved show no data point rather than a misleading zero. This is consistent with the Mean Time To Resolve summary card above the chart, which reports the straight average for issues resolved within the selected range only.Exposure Window
The Exposure Window chart shows, for each period, the average time (in days) that open issues of each severity had been exposed — not a count of issues. If no issues of a given severity are open during a period, that severity’s line breaks rather than dropping to zero.Dashboard Profiles
A dashboard profile is a saved arrangement of the dashboard widgets on a 12-column grid, together with the filters (date range, period, severity, vulnerability class, application) that were active when it was saved. Selecting a profile restores both the layout and the filters.- The profile switcher beside the page title lists your personal profiles and the org templates shared with everyone in the organization. The dashboard opens with the profile you last opened (marked with a star), on every device. While the filters on the page differ from the saved profile, the switcher shows · edited and a notice under the filters offers Save to profile or Reset.
- Edit Layout opens the layout editor. Drag a widget by its header to move it, pull a new one in from the Add widgets panel, or remove one with the × in its header. Every widget has a fixed footprint (for example 4 × 2 cells), the outline shows where it will land, and a red outline means it would overlap another widget. Save profile writes the layout and the current filters back to the profile; Save as new saves them as a new profile instead.
- Manage profiles lets you open, star (open the dashboard with this profile without switching to it now), duplicate, or delete a profile. Deleting the starred profile makes the dashboard open with your next personal profile, or the default layout. Duplicating an org template gives you a personal copy you can edit freely. A new profile starts from the default filters; Cancel in the editor puts the page back exactly as it was when the editor opened.
- A member who has not saved a profile yet sees the default layout (the dashboard as it looked before profiles), unsaved, with a strip offering to keep it as a profile, start blank, or browse the org templates. Edit Layout on it starts a new profile from that layout.
Report Types
Export Formats
Scan reports support multiple output formats:
The Monthly Security Report is generated as a DOCX document. Organization Summary, SLA Compliance, and SOC 2 reports are generated as PDF documents. Custom reports can be exported as CSV, CASA CSV, SARIF, or PDF (see Exporting Custom Reports).
Generating Reports
Scan Report
- Navigate to Reports → Generate in the dashboard.
- Click the “Scan Report” card.
- Select a repository from the dropdown.
- Select a scan from the dropdown (populated after choosing a repo — shows full and PR scans with issue counts).
- Select the format (DOCX, CSV, SARIF, or SBOM).
- Set a score threshold — only findings above this score are included.
- Choose which issue types to include (Exclude False Positives or All Issues).
- Click Generate. The report is created asynchronously — download it from the History tab when ready.
Organization Summary
- Navigate to Reports → Generate in the dashboard.
- Click the “Organization Summary Report” card.
- Optionally provide a custom company name.
- Optionally narrow the report scope by selecting specific tags or repositories. By default the report covers your entire organization.
- Click Generate. Download the DOCX from the History tab when ready.
SOC 2 Report
- Navigate to Reports → Generate in the dashboard.
- Click the “SOC 2” card.
- Optionally provide a company name.
- Optionally narrow the report scope by selecting specific tags or repositories. By default the report covers your entire organization.
- Click Generate. Download from the History tab when ready.
All organization-level reports — Monthly Security Report, Organization Summary, SLA Compliance, and SOC 2 — display a Scope field on their cover page or header. When you generate a report without selecting any specific tags or repositories, the scope reads “All repositories” with the total count. When you narrow the scope, it lists the specific tags and repository names you chose. This makes the report self-describing for audit purposes, so a reader can tell exactly what was in scope without referring back to the generation settings.
Report History
All generated reports are listed in the Reports section of the dashboard with:- Report type and title
- Generation date and status (pending, processing, completed, failed)
- File name and file size
- Download button
fileName alongside the status, so you can identify the generated file before downloading it.
Reports can be downloaded or deleted from the history view. The same per-report-type visibility applies to downloads and deletions — you cannot download or delete a report you cannot see in the history list.
Custom Report Statistics
Custom reports let you apply the full set of issue filters and retrieve aggregated statistics for the matching findings. This is useful for building executive dashboards, tracking remediation progress over time, or generating focused views of your security posture.Interactive Dashboard
When you open a custom report in the Views tab, the platform displays an interactive dashboard with visual charts that update automatically as you change filters:
Below the charts, a paginated issue table lists all matching findings with columns for severity, score, title, repository, vulnerability class, status, and detection date. You can click any row to open a side pane with full issue details — your filters, scroll position, and selected report remain intact. Actions taken in the side pane (such as marking an issue as false positive or changing its status) refresh the report in the background without losing your place.
Filter Bar
The filter bar uses a chip-based interface for building queries. Each filter appears as a compact chip showing the field name, operator, and selected value. You can:- Click “Add filter” to choose from available filter fields, organized by category (Issue, Repository, Scan).
- Click an existing filter chip to edit its field, operator, or value inline via a popover.
- Remove individual filters by clicking the x button on a chip, or click Clear to reset all filters.
- Click Save to store the current filter configuration as a named report (see Saved Custom Reports below).
- Click Export to download the matching issues in your preferred format (see Exporting Custom Reports below).
Custom report statistics include:
You can narrow results using any combination of the standard issue filters, including:
- Date ranges — filter by issue creation date (
createdAfter/createdBefore) or resolution date (resolvedAfter/resolvedBefore) to focus on a specific time window - Validation state — include only confirmed, disconfirmed, or unknown findings
- Reachability — filter by whether the vulnerable code path is reachable in your application
- Vulnerability class operators — match vulnerability classes using exact match, prefix, or substring operators for more precise filtering
- Application filters — narrow results to specific applications detected within your repositories (useful for monorepos with multiple services)
- Repository branches — scope the custom report to specific branches per repository, rather than using only the default branch
- Score exclusion — exclude issues at a specific score value
Preset Reports
The Views tab includes several built-in preset reports so you can start analyzing common issue categories immediately without configuring filters manually:
Preset reports cannot be edited or deleted. To customize a preset, select it and modify the filters, then save it as a new custom report.
Saved Custom Reports
You can save frequently used filter configurations as named custom reports for quick access. Saved reports are available both from the Views tab in the dashboard and through the API. From the Views tab, you can:- Select New Custom Report to build a report from scratch, or choose a preset report to start from a predefined filter configuration.
- Save a custom report with a name so you can return to it later. Saved reports appear in the report selector dropdown under Saved Reports.
- Delete a saved report by selecting it and clicking the delete button.
Exporting Custom Reports
You can export any custom report view by clicking the Export button in the filter bar. This opens an export dialog where you choose a format and download the matching issues.Export Formats
Export Completeness
Exports include all matching findings regardless of whether they have a confidence or priority score. Findings that have not been assessed by a validation agent report null values for confidence and score rather than being omitted from the export. This ensures that security exports are always complete and no findings are silently dropped.Ticket Links in Exports
CSV exports include a Tickets column and a Ticket URLs column carrying the Jira and Linear tickets each finding was filed as, so an export can be reconciled against your tracker — for example, pulling the keys out of an export to ask which of those tickets are still open. Multiple tickets on one finding are separated by; , and the two columns stay position-aligned: the Nth key always describes the same ticket as the Nth URL, so a ticket whose browse URL could not be derived holds an empty slot rather than shifting the later URLs. A finding that was never filed leaves both cells empty. The same links are available programmatically as the tickets array on each item returned by /api/v2/issues/export. Scan report CSVs carry the same two columns.
Linear tickets are keyed by their human identifier (ENG-7), the same value Linear’s UI searches on, and their URL is exported in canonical form (https://linear.app/<workspace>/issue/<ID>) rather than the longer form Linear shows in the browser. The trailing segment of a Linear URL is a slug of the ticket title, and exports withhold AI-generated titles for secret findings; dropping the slug keeps that guarantee. The shortened URL opens the same ticket.
PDF Export Details
The generated PDF includes:- A cover page with the report name, generation date, total issue count, and mean time to remediation
- Charts matching the interactive dashboard: total issues, severity distribution, MTTR, top vulnerability classes, and issue trend over time
- A top issues table listing the highest-scoring findings (up to 500) with severity, score, title, repository, vulnerability class, status, and detection date. Findings without a score are sorted to the bottom of the table so that scored findings are always surfaced first.
Exporting custom reports requires the Custom Report View permission.
Filter Schema Discovery
You can retrieve the full list of available filter fields and their valid values programmatically via the filter schema endpoint. This is useful when building integrations or custom dashboards, as it lets you discover which filters are supported and what operators each filter accepts without hardcoding filter definitions.Report Contents
Scan Report (DOCX)
- Executive summary with finding counts by severity
- Repository and scan metadata (branch, commit, date)
- Detailed finding list with:
- Title, severity, confidence score
- Affected file and line range
- Vulnerability description and remediation guidance
- CWE classifications
Monthly Security Report (DOCX)
- Month-over-month security posture for the repositories in scope
- Per-repository scan activity and finding counts
- Severity breakdown and top vulnerability families
- AI-generated executive summary for stakeholder communication
- Mean Time to Remediate is formatted with appropriate precision and includes the number of resolved issues and the date window the average covers — for example, “43 days (941 issues resolved Jul 1 – Jul 31, 2026)” — so readers can judge the weight of the metric at a glance. When no issues were resolved during the month, the metric is omitted from the summary rather than shown as zero (which would imply instant remediation).
- Cover page includes a Scope field describing the repositories included
Organization Summary (PDF)
- Aggregate statistics across the repositories in scope
- Finding trends and severity distribution
- Repository-level breakdown
- Top vulnerabilities by impact
- Mean Time to Remediate and per-severity exposure days are formatted with appropriate precision rather than always rounding to whole days. The mean remediation time includes the number of resolved issues and the date window the average covers, so readers can assess the sample size alongside the metric. When no issues were resolved in the report window, the mean remediation time is omitted rather than shown as zero.
- Cover page includes a Scope field describing the repositories included
SLA Compliance Report (PDF)
- Policy-based SLA compliance tracking: which findings are within or past your configured remediation windows
- Filtered to the repositories in scope, with a Scope field on the report header
SOC 2 Report (PDF)
- Compliance-focused metrics structured for SOC 2 audit evidence
- Repository coverage and scan activity for the period
- Cover page includes a Scope field describing the repositories included
SBOM Export
- CycloneDX JSON format
- Full dependency inventory from the SCA scan (when available)
- Package metadata, licenses, and dependency relationships
- You can generate an SBOM from any completed scan — an SCA scan is included automatically if available, but is not required
- SBOM generation usually takes less than a minute. Keep the dialog open while it completes.
- See SCA SBOM Exports for details