How to export vulnerability findings to CSV or JSON

To export findings from Cyberlop as JSON or CSV, open Issues and click Export JSON or Export CSV. The same two buttons sit on the Targets list, and the Sitemap tab of a scan has Export CSV for discovered endpoints. Use JSON when another system will read the data, and CSV when a person will sort it in a spreadsheet.

What can you export from Cyberlop?

An export is a file download of the data you see in a list. Cyberlop offers three: findings from Issues, applications from Targets, and discovered endpoints from a scan's Sitemap tab. Each lets you move results into the tools your team already uses, such as a spreadsheet or an issue tracker.

A findings export is the raw data. If you want a document to hand to a manager or customer, use the branded PDF instead: see download PDF reports.

How do you export findings as JSON or CSV?

Narrow the Issues list to the findings you need, then click Export JSON or Export CSV. The browser downloads the file.

1. Click Issues in the sidebar. The page title reads "All findings across scans".
2. Use the search box ("Search findings by title or location...") to find a specific weakness or file.
3. Set the four filters if you want a slice: severity, confidence, class and target.
4. Set the triage chips. The first chip switches between Hiding and Showing only; the chips are New, Regression, Fixed, False Positive and Accepted Risk.
5. Click Export JSON or Export CSV.
6. Open the file and compare its row count with the list before you share it.

The list is sorted by severity, Critical first, and its columns are Severity, Title, Class, Confidence, Triage, Target and Location. For what each filter and chip does, read the Issues list guide.

Do the filters change what you export?

The API Reference describes the findings export as "Export issues as JSON or CSV with filters". The captured screens do not show whether the buttons pass your on-screen filters to the file. Test it: set a filter, export, and count the rows against the list.

Check the row count every time

A two-minute check beats a wrong number in a report. If the file holds more rows than the list, the filters were not applied. Export everything and filter inside the spreadsheet instead.

Who can export?

Exporting findings needs the issue:export permission. If the buttons are missing or refused, ask an administrator to check your role. See API tokens and permissions for how permission keys work.

How do you export targets and sitemap endpoints?

Targets and sitemaps use the same pattern: open the list, then click the export button. The target export suits an asset register; the sitemap export suits coverage reviews.

Export the targets list

1. Click Targets in the sidebar.
2. Optionally search by name, URL or tag.
3. Click Export JSON or Export CSV.

The list itself shows name, URL, results, tags, creator and environment. Use the export to feed your vulnerability management routine, and to answer "which applications do we test, and who owns them?" See manage targets for the list in full.

Export a scan's sitemap

1. Open a scan from Recent Scans.
2. Click the Sitemap tab ("Discovered endpoints").
3. Type in Filter by URL or method... if you only want some endpoints.
4. Click Export CSV.

Endpoints are grouped by host. Each row has a method, a path, any parameters, a short note from the scan and a role chip. Hand the file to whoever owns the application and ask them to mark routes they did not expect to exist. The scan sitemap guide explains how to read these rows.

JSON or CSV: which should you choose?

Choose CSV for people and JSON for programs. CSV opens in any spreadsheet; JSON keeps nested data, such as a list of reproduction steps, in one record.

Two standards explain most import failures. RFC 4180 says a field that holds a line break, a double quote or a comma should be wrapped in double quotes, and any double quote inside it is doubled. RFC 8259 says JSON text exchanged between systems outside a closed ecosystem must be encoded as UTF-8. If an import fails, those are the first two things to check.

We have not documented the exact column or field names in the files, so inspect the header row (CSV) or the first object (JSON) once, and map those names in your importer. Do not guess them from the on-screen table.

How do you use an export in a spreadsheet or tracker?

Treat the export as a snapshot: filter it, add an owner and a due date, then feed it to the place where work is tracked. Do the real status changes back in Cyberlop so the history stays in one place.

A spreadsheet triage workflow

1. Export CSV from Issues and open it in your spreadsheet tool.
2. Freeze the header row and filter by severity, then by confidence. Read severity and confidence first so you rank on both.
3. Add columns for owner, due date and ticket link, so each security finding has someone responsible.
4. Share the sheet with the team that will fix the findings.
5. Record each decision in Cyberlop with Update status, as described in triage findings. Good finding triage marks each false positive there, not in the sheet.

Getting findings into an issue tracker

Most trackers accept a CSV import and let you map columns to fields. Import only the findings your team will act on, usually Critical and High at Medium confidence or above, and put the finding's ID and its Location in the ticket so the engineer can find the evidence. The ID has a class prefix and a number, for example INJ-VULN-02.

Keep the link both ways. Put the ticket link in the spreadsheet, and when the fix ships, re-run the scan and let the Triage column show Fixed. This is the fix verification loop described in fixed and regressed issues.

What to put in the ticket

Include the title, severity, confidence, class, target and Location. Link back to the finding rather than pasting the full request and response into a place with wider access.

What to leave out

Leave out evidence you do not need to share. Payloads, requests and responses can contain sensitive data, so give them only to the people fixing the issue.

Reporting on progress

A dated export is useful evidence in an audit, next to the audit log kept in the Activity feed. Save one per release or per month and you can show how many findings were open then, and how many moved to Fixed since. To track mean time to remediate, compare two exports on finding ID. For a live view, the Dashboard Remediation card already shows Open, Fixed, Regressed and False positives. See the dashboard overview.

Is it safe to open a findings CSV in a spreadsheet?

Mostly yes, but handle it with care. Findings contain text that came from the application under test, such as payloads and titles, and a spreadsheet may treat a cell starting with a formula character as a formula.

OWASP describes this as CSV Injection, also called formula injection: it happens when websites "embed untrusted input inside CSV files". The characters that matter are equals (=), plus (+), minus (-) and at (@), plus tab, carriage return and line feed. Read the knowledge-hub entry on CSV injection for the plain-English version.

Safe habits for exported files

• Open the file in a protected or read-only view if your spreadsheet tool offers one.
• Do not enable macros, external links or "update links" prompts for a findings file.
• If a cell starts with one of the characters above, read it as text and do not click through a warning.
• For automated imports, prefer JSON and parse it as data.

OWASP's most reliable fix for Excel is a tab character at the start of any cell that begins with =, +, - or @, placed inside the quoted field. The tab stays in the data and can trip a later programmatic import, so apply it only if you re-export the data yourself.

Treat the export as sensitive

An export holds vulnerabilities that have not been fixed. Store it where only the right people can read it, do not email it to a wide list, and delete old copies. The same applies to the PDF.

Can you automate exports with the API?

Yes. The API Reference lists two export endpoints, and both return a file.

Authenticate with a session cookie or a Bearer API token. Tokens are issued by an administrator and carry the owner's permissions, so ask for one whose role has only the permissions the job needs. See the API reference guide and API tokens and permissions. To run scans from a pipeline too, read CI/CD integration.

The page also has JSON and OpenAPI download buttons that give the specification. That is a description of the API, not your findings. Do not confuse the two.

Troubleshooting: why is the export empty or wrong?

If a scan failed, it can still hold the findings found before it stopped, and those appear in the lists and exports. Read failed or cancelled scans before you trust a count.

Next step

Exports are easier to hand out when profiles are organised by team or environment. Read groups and tags to organise profiles by team or environment, so each team's slice is easy to find. See how to read a finding for what each field in the evidence means, and our evidence page for how proof is recorded.