Help

DanSec Reports is a privacy-first security reporting platform. All your report data stays in your browser's IndexedDB - nothing is sent to our servers except when you export a PDF (the report data is sent transiently to our Puppeteer renderer and never stored).

Creating a report: Click "New Report" on the Reports page and choose from Incident Report, Threat Intelligence, Threat Hunt, or Pentest report types. Each type comes with pre-configured sections appropriate for that report type.

Installing as a PWA: Use your browser's install prompt (or look for the install banner at the bottom of the screen) to install DanSec Reports as a desktop or mobile app. Once installed, the app works fully offline.

TLP (Traffic Light Protocol) is a data-sharing framework maintained by FIRST.org. DanSec Reports implements TLP 2.0.

- TLP:RED - For named recipients only; not for disclosure beyond them. The highest restriction. - TLP:AMBER+STRICT - Limited disclosure to the recipient's organisation only (no clients/partners). - TLP:AMBER - Limited disclosure within the recipient's organisation and to clients/partners needing to act. - TLP:GREEN - May be shared within the community; not publicly posted. - TLP:CLEAR - No restriction; may be shared publicly.

Setting a TLP level adds a colour strip at the top of the editor and embeds TLP headers in exported PDFs.

The MITRE ATT&CK framework is a knowledge base of adversary tactics, techniques, and procedures (TTPs). DanSec Reports supports the Enterprise, Mobile, and ICS matrices.

Adding mappings: Open the Security panel (Shield button) in the editor and navigate to the ATT&CK tab. Search by technique ID (e.g. T1078) or name. You can add notes and a confidence level to each mapping.

In PDFs: All ATT&CK mappings are rendered in an appendix table showing the tactic, technique, and any evidence.

The IOC (Indicators of Compromise) manager automatically detects IOC types from pasted text and supports defanging for safe sharing.

Supported types: IP addresses (v4/v6), domains, URLs, MD5/SHA1/SHA256 hashes, email addresses, filenames, registry keys, and CVE identifiers.

Defanging: Domains are automatically defanged (e.g. evil[.]com) when the defang toggle is enabled. URLs replace :// with [://].

STIX 2.1 export: Export your IOC list as a STIX 2.1 bundle for consumption by threat intelligence platforms.

The Findings panel lets you document security findings with structured severity, CVSS scoring, and remediation guidance.

CVSS Calculator: The built-in CVSS 3.1 calculator lets you select base metric values and automatically computes the score and vector string. Scores are colour-coded by severity (Critical/High/Medium/Low/Informational).

Finding status: Track remediation with Open, Accepted Risk, or Remediated statuses.

DanSec Reports supports four export formats:

- PDF - Consultancy-grade PDF with your branding, TLP headers, table of contents, and page numbers. Rendered server-side by Puppeteer - requires internet connection. Report data is sent transiently and never stored. - DOCX - Microsoft Word format for client-editable delivery. Complex layouts are simplified. - JSON - Machine-readable export of the full report schema. Suitable for SIEM ingestion or archiving. - .dansec - Native compressed archive. Self-contained, round-trip safe, includes all assets and version history. Save these to your encrypted drive for long-term archival.

Approval warning: If you export a non-approved report as PDF or DOCX, you will see a warning. You can proceed, but it is recommended to complete the review/approval workflow first.

Every report maintains a local version history. Versions are created automatically on:

- Status changes (draft → in_review → approved) - Manual checkpoints (Checkpoint button in the editor toolbar) - Each version stores a full snapshot of the document content.

Restoring: Open the History panel from the editor toolbar to view all versions. Click "Restore" on any older version to create a new version from that snapshot - the original versions are preserved.

Portability: All version history is included in .dansec exports and restored when you open the file.

Snippets are reusable text blocks stored locally in your browser. Use them for standard disclaimers, methodology boilerplate, common remediations, or any text you reuse across reports.

Managing snippets: Go to Snippets in the sidebar to create, edit, delete, and organise snippets by category.

Export/Import: Snippets can be exported as a JSON file and imported on another device, making them portable across installs.

DanSec Reports is designed privacy-first:

- No accounts required. There is no sign-up, login, or user tracking by default. - Client-side storage. All report data lives in your browser's IndexedDB. Clearing site data removes all reports. - PDF rendering. The only server-side operation is PDF export. Your report JSON is sent to our Puppeteer renderer, a PDF is generated, and the data is immediately discarded. Nothing is persisted. - Analytics. We use self-hosted Umami for anonymous usage analytics (no cookies, no personal data).

See the full Privacy Policy for details.