Turn scanner output into client-ready reports — without your data ever leaving your machine.

You do the testing. We kill the reporting.

The engagement is the fun part. The write-up is the tax you pay afterward — copying findings out of four tools, reconciling the ones that overlap, normalizing severities, and formatting it all into something a client will read.

Triagely aggregates the raw output from every tool you already run, collapses duplicate findings into one entry that credits each scanner, and auto-generates the document you'd otherwise hand-write. You review and ship — you don't retype.

• One normalized schema

  Nmap, Nuclei, and Burp output parsed into a single finding model — severity, asset, evidence, CWE/CVE.

• Cross-tool dedup

  The same issue seen by two scanners becomes one finding that keeps every tool's evidence and rating.

• Report-grade output

  A branded PDF with cover, exec summary, findings, and appendix — plus manual findings you add yourself.

The image is private — request access and you'll be added, then the commands below just work.

docker run -p 7442:8080 -v "$(pwd)/data:/data" ghcr.io/pentest-reports/pentest-reporter:latest

Then open http://localhost:7442. The image is pulled from the registry — there's nothing to build. Your database lives at ./data/pentest.db on your disk and survives restarts, upgrades, and re-pulls.

Port already in use? Change only the first number — -p 9000:8080 — and browse to localhost:9000 instead. The container always listens on 8080 internally; 7442 is just an uncommon host default (so it won't fight Burp's proxy, Jenkins, or your dev servers on 8080).

Prefer Compose? Drop this in a docker-compose.yml and run docker compose up:

services:
  pentest-reporter:
    image: ghcr.io/pentest-reports/pentest-reporter:latest
    ports:
      - "7442:8080"   # change 7442 if the port is taken
    volumes:
      - ./data:/data
    restart: unless-stopped