Your PDF Report Used to Be a Printed Webpage. Now It's an Actual Document.
Every report Decloak generates, the free scan, the paid AI Agent scan, Active Security Testing, AI Pentesting, and the Priority Remediation Plan, could already be exported as a PDF. Those PDFs, if we're honest about it, were a styled HTML printout of the web report. Raw markdown syntax occasionally leaking through unrendered. Text cut off at page edges. No table of contents, no page numbers, no cover page. A dark theme that neither prints nor photocopies well.
For a product where the PDF is often the actual thing customers hand to an auditor, a client, or their own security team, that wasn't good enough. This came directly from customer feedback, the first version was very basic, and people using these reports as real deliverables told us so. We rebuilt it.
One shared print shell, not five reskins
Rather than redesign five separate PDF templates independently, we built a shared print shell, a library of reusable document primitives, cover page, table of contents, section headers, severity charts, finding cards, checklists, tables, with a single light, print-safe visual language distinct from the app's own dark theme. Each of the five reports assembles itself from those shared pieces, contributing only the content that's actually specific to it.
We deliberately built it in a specific order: prove the shell out completely on the free-tier report first, the simplest case, and the one every visitor sees, before porting it to the more complex paid-tier reports. That let us find and fix the hard rendering problems once, against real production infrastructure, instead of four separate times.
What actually changed structurally
- A table of contents with working jump links, scaled sensibly to the report, a severity-count summary plus links to the highest-priority findings on a large scan, not an unusable list of hundreds of rows.
- A real running header and footer with live page numbers ("Page 3 of 52"), not a static template, genuinely harder to get right than it sounds, more on that below.
- Structured finding cards, severity, confidence tier, CWE/OWASP references, full evidence, and remediation guidance rendered as real formatted text, headings, bullet lists, code blocks, not raw markdown syntax showing through.
- A Scan Configuration section, including, for Enterprise customers using custom Scan Profiles, a side-by-side "what was configured" versus "what actually happened" comparison, request throttling, retries, rate-limiting encountered, whether a crawl limit was actually hit.
- A Risk Summary showing up to three independent scores side by side, overall Security Score, Active Testing Score, AI Pentesting Score, when applicable. An honest "not scored" state when a test genuinely had nothing eligible to run against, rather than a misleading perfect score. And a lightweight "this is an Enterprise feature" note rather than a hard sell when a lower tier doesn't have access to something.
- A compliance appendix mapping findings to SOC2, ISO27001, NIS2, DORA, LGPD, and PCI DSS controls for paid tiers.
The Priority Remediation Plan PDF, a ranked action list across a domain's history rather than a single scan, deliberately kept a lighter structure, no score, no methodology section, while adopting the same visual language. That was a useful test on its own: it proved the shell generalizes to a genuinely different kind of document, not just five copies of the same report with different logos.
See the new report format on your next scan today, for free and paid users. Scan your site free →