Editor journeys and PDF, DOCX, Markdown and HTML exports. Creation, saving and recovery flows in Chromium and Firefox; portable HTML and editor-specific checks in Chromium.
Selected automated save, import, delivery and history checks, plus creation and recovery flows in Chromium. The runner has no Microsoft Word installation.
Two archives built from the same commit compare byte for byte. A clean Linux installation checks the launcher, saving in an external workspace and all four exports. This does not certify every generated report.
Automated results apply to these scenarios and environments. Review each final report in the recipient’s software before sharing it.
From a finding to a reviewable delivery
Document. Give the finding a stable identity, describe what was observed and attach evidence with its context and limits.
Review. Inspect references, metadata and the produced files. Record editorial observations separately from remediation and retest status.
Deliver. Produce PDF, DOCX, Markdown or portable HTML. Recipient-specific profiles select actual content; simply hiding part of a complete HTML report does not remove that data.
The editor runs locally. The browser exercise below is a small illustration of audience selection, not the editor itself.
Edit one finding, compare two audiences
A fictional exercise in this browser. Edit the fields: both HTML previews update as you type. The technical view keeps the observation; the executive view highlights the consequence and decision. This does not use AI, run security tests or generate a report-gen document.
This exercise does not send or save your edits. Reloading restores the fictional example.
The initial comparison works without JavaScript. Enable JavaScript to edit it.
Audience comparison
Technical reading
Access to another account’s documents
Document portal · local laboratory
Illustrative severity
High
Technical observation
In the scenario, account A receives a document belonging to account B after changing the requested reference.
Proposed action
Validate identity, ownership and permission for every document on the server. Repeat positive and negative controls.
Synthetic example · no test or retest
Executive reading
Access to another account’s documents
Document portal · local laboratory
Illustrative severity
High
Business consequence
Account separation could fail and expose another fictional customer’s private documents.
Proposed action
Validate identity, ownership and permission for every document on the server. Repeat positive and negative controls.
Synthetic example · no test or retest
Turn findings into remediation work
Review changes to owner, due date and root cause for selected findings before applying them together. Preserve each finding’s identity, evidence and retests. Prepare reviewed packages by owner with readable findings and a CSV from the same saved revision. Track issuance, receipt and accepted changes, then accept returned fields individually. A reported correction never becomes a verified retest automatically; exchanging the files remains your decision.
Organise and protect your projects
Project catalogue. Search by title or client, sort by modification, due date or pending retests, and archive or reactivate projects without deleting their data.
Explicit recovery. Restore supported capture and decision forms in the same browser; recovery never attaches evidence or confirms publication automatically.
Reviewed imports. Nuclei JSONL creates unverified findings. Nmap XML adds assets and service observations to pending coverage; an open port is not a vulnerability.
Private backups. Encrypt saved projects with a password. Pending browser copies remain separate and must be saved into the project before moving devices.
Optional local OCR. Request a scan of an image for possible sensitive data. Tesseract runs locally; alerts require manual review and do not redact the image.
Inspect a real exported example
Banco Lumbre is a completely fictional banking scenario. Its downloadable HTML is an actual historical export from report-gen 0.25.0, retained with that version label. It is not evidence of a banking engagement.
On Linux or Kali, extract the source and run python3 scripts/install.py --desktop --lang en. Open report-gen from your application menu or run ~/.local/bin/report-gen, then visit http://127.0.0.1:8080 in your browser. Python 3.11+ and the documented dependencies are required. Keep the extracted application and its .venv; the launcher is not a standalone executable. Follow the guide for Windows and macOS.
The installer keeps data in $XDG_DATA_HOME/report-gen, or ~/.local/share/report-gen by default. Choose a different directory with --workspace and follow the guide to migrate existing projects.
“Update report-gen” checks the official stable Release only when you request it. Review the package before preparing a verified download and private backup in a new directory. Stop the current editor, then follow the installation and recovery instructions. Preparation never executes downloaded code; browser drafts require separate saving or downloading.
For support, open “Check installation”, review the synthetic diagnostic report and download it. The JSON includes version, generic operating system and test results; it excludes projects, paths and usernames. Review final exports in the recipient’s software; structural DOCX checks do not replace opening the document in Word.