Share links¶

A share link lets someone without an account read one page report or one site audit. The link is read-only, shows the findings view only and can be revoked at any time.

Create a link¶

In the panel: open a report (History → report) or a site audit and click Share. Choose the expiry (default 30 days, or never), optionally include evidence quotes and the project name, set an optional password, then Create link. Copy the link right away - it is shown once.

With the API (user token; API keys cannot manage links):

curl -H "Authorization: Bearer $TOKEN" -H 'content-type: application/json' \
  -d '{"expires_in_days": 30, "include_evidence": false, "show_project_name": false, "password": null}' \
  https://judge.example.com/v1/reports/rep_…/shares
# -> 201 {"id": "shr_…", "link": "https://judge.example.com/share/<token>", "status": "active", ...}

The same for audits: POST /v1/audits/{aud_…}/shares. expires_in_days is 1-365 or null (never).

Endpoint	What it does
`POST /v1/reports/{id}/shares`, `POST /v1/audits/{id}/shares`	create a link (owner, admin, member of the organization; not viewer)
`GET /v1/reports/{id}/shares`, `GET /v1/audits/{id}/shares`	links of one report or audit (no tokens)
`GET /v1/share-links`	all links in the selected project (`X-Project-ID`) or in all visible projects
`PATCH /v1/share-links/{id}`	set or change the password (`{"password": "…"}`) or remove it (`{"password": null}`)
`DELETE /v1/share-links/{id}`	revoke (also `DELETE /v1/reports/{id}/shares/{share_id}`; the share must belong to that report/audit)

Each link reports status (active, expired, revoked), has_password, views and last_viewed_at. The password is write-only: it is never returned.

Password¶

A password is optional (8-128 characters). The recipient enters it once on the link page; the browser then keeps a signed cookie for 12 hours, scoped to that link only (HttpOnly, Secure, SameSite=Strict). The PDF needs the same. Changing or removing the password signs everyone out. After 5 wrong attempts from one IP the link is locked for that IP for 15 minutes; wrong password and lockout show the same message.

What the recipient sees¶

/share/{token} shows the verdict, counts and rules at or above the threshold, "Not assessed" and the disclaimer, plus Download PDF (/share/{token}/pdf). It never shows costs or balances, user names or e-mails, report or job ids, sampling details or fetch errors. In a project with private mode only the host is shown, never full URLs, URL patterns, batch titles or evidence quotes. Otherwise evidence quotes and the project name appear only if enabled on the link.

Security¶

Links are random: the token has 192 bits from a cryptographic random generator (secrets), so it cannot be guessed. The database stores only its SHA-256, so it cannot be shown again. Passwords are stored as scrypt hashes.
Unknown, expired and revoked links and links of a suspended organization return the same 404.
Pages are sent with X-Robots-Tag: noindex, nofollow, a robots meta tag, Referrer-Policy: no-referrer Cache-Control: no-store, X-Content-Type-Options: nosniff and a strict Content Security Policy; tokens and passwords never appear in server logs.
Rate limit: 30 requests per minute per IP and 60 per minute per link → 429 with Retry-After. Behind a reverse proxy set GSPAMJUDGE_TRUSTED_PROXIES so the client IP comes from X-Forwarded-For.