English overview / Español

report-gen: from evidence to delivery

A local report editor with reviewed bulk changes, owner-specific remediation packages, external workspaces and verified update preparation.

Updated

OPEN SOURCE · LOCAL EDITOR · VERSION 0.31.2

report-gen brings findings, evidence and remediation into one editable project, then produces files a recipient can review.

Checks and limits

Automated checks passed for this revision. This is a dated review, not a live status monitor.

Version
0.31.2
Reviewed

Published release and package checksums

Inspect the checks and their scope
  • Ubuntu 24.04 · Python 3.12

    Editor journeys and PDF, DOCX, Markdown and HTML exports. Creation, saving and recovery flows in Chromium and Firefox; portable HTML and editor-specific checks in Chromium.

  • Windows Server 2025 · Python 3.12

    Selected automated save, import, delivery and history checks, plus creation and recovery flows in Chromium. The runner has no Microsoft Word installation.

  • Reproducible source package

    Two archives built from the same commit compare byte for byte. A clean Linux installation checks the launcher, saving in an external workspace and all four exports. This does not certify every generated report.

Still pending

Native Microsoft Word review and five usability sessions with participants. Acceptance scope and limits.

Automated results apply to these scenarios and environments. Review each final report in the recipient’s software before sharing it.

From a finding to a reviewable delivery

  1. Document. Give the finding a stable identity, describe what was observed and attach evidence with its context and limits.
  2. Review. Inspect references, metadata and the produced files. Record editorial observations separately from remediation and retest status.
  3. Deliver. Produce PDF, DOCX, Markdown or portable HTML. Recipient-specific profiles select actual content; simply hiding part of a complete HTML report does not remove that data.

The editor runs locally. The browser exercise below is a small illustration of audience selection, not the editor itself.

Edit one finding, compare two audiences

A fictional exercise in this browser. Edit the fields: both HTML previews update as you type. The technical view keeps the observation; the executive view highlights the consequence and decision. This does not use AI, run security tests or generate a report-gen document.

This exercise does not send or save your edits. Reloading restores the fictional example.

Example fields
You choose it for this example; no CVSS calculation or risk validation is performed.

The initial comparison works without JavaScript. Enable JavaScript to edit it.

Audience comparison

Technical reading

Access to another account’s documents

Document portal · local laboratory

Illustrative severity

High

Technical observation

In the scenario, account A receives a document belonging to account B after changing the requested reference.

Proposed action

Validate identity, ownership and permission for every document on the server. Repeat positive and negative controls.

Synthetic example · no test or retest

Executive reading

Access to another account’s documents

Document portal · local laboratory

Illustrative severity

High

Business consequence

Account separation could fail and expose another fictional customer’s private documents.

Proposed action

Validate identity, ownership and permission for every document on the server. Repeat positive and negative controls.

Synthetic example · no test or retest

Turn findings into remediation work

Review changes to owner, due date and root cause for selected findings before applying them together. Preserve each finding’s identity, evidence and retests. Prepare reviewed packages by owner with readable findings and a CSV from the same saved revision. Track issuance, receipt and accepted changes, then accept returned fields individually. A reported correction never becomes a verified retest automatically; exchanging the files remains your decision.

Organise and protect your projects

  • Project catalogue. Search by title or client, sort by modification, due date or pending retests, and archive or reactivate projects without deleting their data.
  • Explicit recovery. Restore supported capture and decision forms in the same browser; recovery never attaches evidence or confirms publication automatically.
  • Reviewed imports. Nuclei JSONL creates unverified findings. Nmap XML adds assets and service observations to pending coverage; an open port is not a vulnerability.
  • Private backups. Encrypt saved projects with a password. Pending browser copies remain separate and must be saved into the project before moving devices.
  • Optional local OCR. Request a scan of an image for possible sensitive data. Tesseract runs locally; alerts require manual review and do not redact the image.

Inspect a real exported example

Banco Lumbre is a completely fictional banking scenario. Its downloadable HTML is an actual historical export from report-gen 0.25.0, retained with that version label. It is not evidence of a banking engagement.

Use the full local application

On Linux or Kali, extract the source and run python3 scripts/install.py --desktop --lang en. Open report-gen from your application menu or run ~/.local/bin/report-gen, then visit http://127.0.0.1:8080 in your browser. Python 3.11+ and the documented dependencies are required. Keep the extracted application and its .venv; the launcher is not a standalone executable. Follow the guide for Windows and macOS.

The installer keeps data in $XDG_DATA_HOME/report-gen, or ~/.local/share/report-gen by default. Choose a different directory with --workspace and follow the guide to migrate existing projects.

“Update report-gen” checks the official stable Release only when you request it. Review the package before preparing a verified download and private backup in a new directory. Stop the current editor, then follow the installation and recovery instructions. Preparation never executes downloaded code; browser drafts require separate saving or downloading.

For support, open “Check installation”, review the synthetic diagnostic report and download it. The JSON includes version, generic operating system and test results; it excludes projects, paths and usernames. Review final exports in the recipient’s software; structural DOCX checks do not replace opening the document in Word.