Reading the HTML report

The HTML report is the format to reach for when a person, not a pipeline, needs the results. Export it from the Flow Auditor’s Export menu; the Save-As dialog suggests PowerToolBox-Findings-yyyyMMdd-HHmm.html. It is a single self-contained file that opens in any browser and is easy to email or archive.

What it contains

• A header with the report title and the generation time.
• A findings table: severity badge, rule ID, category, flow, environment, title with description, confidence, and remediation for each finding.

Triaging with it

1. Start at the Critical and High rows. Each row names a rule ID; open the matching rule page for what the rule checks and what to do: Security, Exfiltration, Governance, Operational, Compliance, AI.
2. Map severity and category to expected urgency using the scoring bands. Exfiltration findings weigh heaviest. Note that in 1.2.0 every flow is scored with the Default-environment multiplier; see Known limitations in 1.2.0.
3. Work by environment. The environment column in the table lets you focus on one environment at a time.

When HTML is not enough

The HTML report is a reading view. If you need to sort, filter, or pivot the data, use the CSV or Excel export. If you need to feed another system, use the JSON. Rule IDs and flow names are the same in every format, so you can find a row in the HTML report and then look up the same finding in the CSV or JSON version. All formats are described in Report formats.

Safety of the file itself

User-controlled values (flow names, environment names, finding text) are HTML-encoded before they are written, so a crafted flow name cannot inject markup into the report. It is safe to open and to forward.

That said, the report still contains your flow names, environment names, and remediation guidance. Treat it as internal material and share it under the same retention rules as the other formats.

Last updated: July 27, 2026