Reports

myrqen session finish builds one canonical report object and renders it four ways. All four land in the project you scanned, and none of them require an account.

.myrqen/reports/<localReportId>/report.html
.myrqen/reports/<localReportId>/report.json
.myrqen/reports/<localReportId>/report.md
.myrqen/reports/<localReportId>/report.sarif.json

The four formats

HTML

A self-contained page: filter by severity and verification, expand a finding for evidence and remediation, copy the fix prompt. No external scripts, stylesheets, or fonts — it opens with the network off.

JSON

The canonical ScanReport, validated against schemas/report.schema.json. This is the machine-readable source of truth.

Markdown

For a pull request, an issue, or a wiki.

SARIF

For code-scanning tooling that consumes SARIF.

Verify the HTML is genuinely offline:

grep -c "<script src\|<link .*href\|@import" .myrqen/reports/*/report.html   # 0

What the canonical report contains

ScanReport in packages/contracts/src/domain.ts, schema version 1.0.0:

Field	Contents
`project`	Name, workspace kind and name, repository label.
`scan`	Requested and resolved effort, the effort profile, start and end instants, duration, agent metadata, host environment, token usage with provenance, the scope (local targets plus authorized external targets), phase records, and the detected stack.
`authorization`	`destructiveActionsAllowed: false`, the prohibited-action list, `externalTargetAuthorization: "exact_origin_only"`, and whether local targets were in scope.
`summary`	Finding count, per-severity counts, per-verification counts, and candidate, duplicate, and fixed counts.
`findings`	Every finding, with evidence, corroboration, redacted secret references, status, and fix history.
`coverage` / `coverageAreas`	What was assessed, and how.
`limitations`	What was not assessed, and why.

limitations is not an afterthought. The product’s stated position is that silence from a scanner is not a clean bill of health, so a report that found nothing still says what it covered and what it could not reach.

Token usage is reported with provenance

tokenUsage.source is mandatory and is one of:

Source	Meaning
`exact`	A real count the host agent reported.
`estimated`	An estimate, with `estimator` naming the method and version.
`unavailable`	The host could not report it.

An exact count is never fabricated. Where the platform aggregates this, exact and estimated counts are kept in separate columns and never averaged together.

The fix prompt

myrqen fix prompt MYR-001

Prints a remediation prompt a coding agent can act on, and records that a fix was suggested. The HTML report has the same thing behind Copy prompt to fix. See Fix and retest.

Synced reports and projections

A synced report can be opened in the dashboard and shared. What a given viewer receives is decided server-side by a projection policy — never by client-side hiding. ProjectionPolicy is deliberately a typed, testable structure rather than a programmable policy language:

{
  "version": 1,
  "sections": { "mode": "allow_only", "ids": ["metadata", "summary", "findings"] },
  "findings": { "mode": "allow_only", "ids": ["MYR-001", "MYR-002"], "maxSeverity": "high" },
  "fields": { "evidence": true, "code": true, "reproduction": true },
  "anonymize": false
}

Part	Effect
`sections`	Which of `metadata`, `summary`, `findings`, `coverage`, `limitations`, `methodology` are included.
`findings`	Which findings are included, optionally capped by severity.
`fields`	Masks applied to what remains: `evidence`, `code`, `reproduction`, `remediation`, `metadata`.
`anonymize`	Strips identifying project and account detail.

Hidden content is absent from the payload, not hidden in it. That holds for the page, the JSON, and every export format — the export routes resolve the same projection the page does, so no format is a bypass.

Report expiry

A synced report has a retention window from its plan (21 days on free). When it expires the worker deletes the body and its stored object, share links stop working, and the report page explains the expiry. Requests return REPORT_EXPIRED (HTTP 410). Your local files are untouched. That is the point of local-first.

Encryption at rest

In the hosted service, report bodies are encrypted with REPORT_ENCRYPTION_KEY before they reach object storage, so the store never holds plaintext. REPORT_ENCRYPTION_KEY_PREVIOUS accepts retired keys for reads only, which is what makes key rotation possible — move the old key there when rotating, or every stored report stops opening.

Share a report

One URL that renders differently per recipient.

Report export API

GET /api/v1/reports/{id}/export/{format} and the share equivalent.

Getting started

Core concepts

Guides

Reference

Troubleshooting

The four formats

HTML

JSON

Markdown

SARIF

What the canonical report contains

Token usage is reported with provenance

The fix prompt

Synced reports and projections

Report expiry

Encryption at rest

Share a report

Report export API

​The four formats

HTML

JSON

Markdown

SARIF

​What the canonical report contains

​Token usage is reported with provenance

​The fix prompt

​Synced reports and projections

​Report expiry

​Encryption at rest

​Related

Share a report

Report export API

The four formats

What the canonical report contains

Token usage is reported with provenance

The fix prompt

Synced reports and projections

Report expiry

Encryption at rest

Related