Variables

This page lists all variables available in templates. These variables are populated from your report data when rendering or exporting.

report

General report metadata.

Variable	Type	Description
report.title	string	Report title
report.status	string	draft, waiting-for-review, under-review, completed
report.language	string	Language code (e.g. EN, FR)
report.version	string	Report version (e.g. 1.0.0)
report.executiveSummary	HTML	Executive summary content
report.createdAt	date	Creation date
report.updatedAt	date	Last update date

Authors & reviewers

Variable	Type	Description
report.author	object	Primary author
report.author.name	string	Full name
report.author.email	string	Email
report.author.firstName	string	First name
report.author.lastName	string	Last name
report.authors	array	All authors
report.coAuthors	array	Co-authors
report.reviewer	object	Reviewer who accepted the review
report.reviewers	array	All reviewers

Each entry in authors, coAuthors, and reviewers has the same fields as report.author.

Author: {{ report.author.name }}

{% if report.coAuthors.size > 0 %}
  Co-authors:
  {% for author in report.coAuthors %}
    {{ author.name }} ({{ author.email }})
  {% endfor %}
{% endif %}

client

The company/client associated with the report.

Variable	Type	Description
client.name	string	Company name
client.logo	string	Logo URL
client.primaryContact	object	Main contact
client.primaryContact.name	string	Full name
client.primaryContact.email	string	Email
client.primaryContact.phone	string	Phone
client.primaryContact.role	string	Role / job title
client.contacts	array	Contacts on the linked company

Each entry in client.contacts:

Variable	Type	Description
firstName	string	First name
lastName	string	Last name
email	string	Email
phone	string	Phone
role	string	Role / job title

Prepared for: {{ client.name }}

{% for contact in client.contacts %}
  {{ contact.firstName }} {{ contact.lastName }}, {{ contact.role }}, {{ contact.email }}
{% endfor %}

TIP

The client logo can be inserted as an image element through the visual editor. Use the variable client.logo as the image source.

dates

Variable	Type	Description
dates.startDate	string	Assessment start date (YYYY-MM-DD)
dates.endDate	string	Assessment end date (YYYY-MM-DD)
dates.currentDate	string	Current date at render time (YYYY-MM-DD)
dates.createdAt	string	Report creation date (YYYY-MM-DD)

Assessment period: {{ dates.startDate | formatDate: 'long' }} – {{ dates.endDate | formatDate: 'long' }}

scope

The assessment scope defined in the report.

Variable	Type	Description
scope.description	string	Scope description
scope.entries	array	Scope entries

Each entry in scope.entries:

Variable	Type	Description
type	string	ip, url, or other
name	string	Entry label
value	string	Entry value

{% if scope.description != blank %}
  {{ scope.description }}
{% endif %}

{% for entry in scope.entries %}
  {{ entry.type | uppercase }}: {{ entry.name }}, {{ entry.value }}
{% endfor %}

TIP

Scope entries are best displayed using a table element in the visual editor with a row loop. See the Table documentation.

stats

Vulnerability count statistics.

Variable	Type	Description
stats.totalVulnerabilities	number	Total findings
stats.criticalCount	number	Critical count
stats.highCount	number	High count
stats.mediumCount	number	Medium count
stats.lowCount	number	Low count
stats.informativeCount	number	Informational count

Critical: {{ stats.criticalCount }}
High: {{ stats.highCount }}
Medium: {{ stats.mediumCount }}
Low: {{ stats.lowCount }}
Informational: {{ stats.informativeCount }}
Total: {{ stats.totalVulnerabilities }}

TIP

Statistics are best displayed using a table element in the visual editor. You can use cell background colors to match severity levels.

vulnerabilities

Array of all findings in the report. Each vulnerability contains:

Core fields

Variable	Type	Description
title	string	Vulnerability title
severity	string	Critical, High, Medium, Low, Info
status	string	Finding status
templateName	string	Name of the vulnerability template this finding was created from. Useful when the report uses more than one vulnerability template; see Filtering by vulnerability template.

CVSS

Available when the vulnerability template includes a CVSS field.

Variable	Type	Description
cvss.score	string	Final score; for v3.1, prefers environmental, then temporal, then base
cvss.severity	string	Severity label for the final score
cvss.baseScore	string	Base score
cvss.baseSeverity	string	Base severity
cvss.vector	string	CVSS vector string
cvss.temporalScore	string	Temporal score (if enabled)
cvss.temporalSeverity	string	Temporal severity
cvss.environmentalScore	string	Environmental score (if enabled)
cvss.environmentalSeverity	string	Environmental severity

CVSS v3.1 base metrics: cvss.AV, cvss.AC, cvss.PR, cvss.UI, cvss.S, cvss.C, cvss.I, cvss.A.

CVSS v4.0 uses cvss.AT, cvss.VC, cvss.VI, cvss.VA, cvss.SC, cvss.SI, and cvss.SA alongside AV, AC, PR, and UI. Metric values are expanded to readable labels. For v4.0, use cvss.score and cvss.severity; separate temporal and environmental score fields are empty.

Custom score

Available when the vulnerability template includes a custom score field.

Variable	Type	Description
customScore.score	number	Calculated score
customScore.maxScore	number	Maximum possible score
customScore.criteriaValues	object	Individual criteria scores
customScore.severity	string	Label for the score band
customScore.color	string	Color for the score band
customScore.displayScore	string	Score formatted with the configured precision
customScore.criteria	object	Selected option labels, keyed by criterion ID

customScore refers to the first custom score field. When a template has several, use each field's own variable, such as vuln.business_risk.score. Copy its name from the variable browser.

Custom fields

Fields are available by their stored field ID and by the name shown in the variable browser. Names are converted to lowercase with underscores, so Remediation Complexity becomes remediation_complexity. Inside a loop, use the loop variable:

{% for vuln in vulnerabilities %}
  {{ vuln.description }}
  {{ vuln.remediation }}
  {{ vuln.impact }}
{% endfor %}

The available field names depend on your vulnerability template configuration. Multilingual fields automatically resolve to the report's language.

Looping examples

{% for vuln in vulnerabilities %}
  {{ forloop.index }}. {{ vuln.title }}
  Severity: {{ vuln.severity }}, CVSS: {{ vuln.cvss.score | score }}
  {{ vuln.description }}

  {% if vuln.remediation != blank %}
    Remediation:
    {{ vuln.remediation }}
  {% endif %}

  {% unless forloop.last %}{% pagebreak %}{% endunless %}
{% endfor %}

custom

Report-level custom variables defined in the template. Variable keys use dot-notation that gets converted to a nested structure.

For example, if your template defines variables with keys custom.introduction, custom.methodology.description, and custom.methodology.tools, they are accessible as:

{{ custom.introduction }}
{{ custom.methodology.description }}
{{ custom.methodology.tools }}

Rich text variables contain formatted content; simple text variables contain a plain value. Only variables declared on the selected template are available when rendering.

killchain

The killchain array contains findings included in the kill chain, ordered by step. Findings grouped together share the same step value.

Field	Description
step	Step number, starting at 1
id	Finding ID
title	Finding title in the report language
severity	Normalized severity name
severityColor	Severity color
note	Step description in the report language

Use the visual Kill Chain element for the standard diagram. These variables are available if you need a custom text or table layout.