Template Tags

Template tags are placeholders in your Word template that get replaced with real data on export.

Vulnsy uses a small, composable tag grammar: a handful of fields, a set of filters that transform them (| date, | sort, | where, …), and one block syntax ({#…} … {/}) that serves as both loop and conditional. You don't memorise hundreds of tags — you compose a few.

Tag Syntax

Close any block with a bare {/} (it closes the nearest open block), or name it explicitly with {/findings}.

Filters

Filters transform a value. Write them after a pipe, and chain as many as you like — they apply left to right.

{report.startDate | date:"UK"}
{#findings | where:"severity":"critical" | sort:"cvss"} … {/}
{severity | title}

Filter arguments:

• date formats: long (default — "17th March 2025"), US, US_short, US_abbr, UK, UK_abbr, month, monthYear, iso.
• sort orders: severity, cvss (3.1), cvss3, cvss4 (4.0), auto (the report's configured order).

Conditionals

A {#…} … {/} block renders its content only when the expression is truthy. Inside, you can compare real fields — there are no separate boolean tags.

{#report.overallRisk == "critical"}
This assessment identified critical risk.
{/}

{#cvss.score >= 7.0}High severity by CVSS.{/}

{#severity == "high" || severity == "critical"}
Priority remediation required.
{/}

Permitted operators: == != > < >= <= && || !. A bare {#cvss.temporal} … {/} is a presence check — it renders only when that data exists.

Report Fields

Conditional on risk: {#report.overallRisk == "critical"} … {/}. Conditional on sort order: {#report.sortOrder == "cvss"} … {/}.

Assessment dates resolve to the report's override if set, otherwise the parent project's dates.

Narrative & Scope Sections

Every narrative and scope section you write becomes a slug under report.sections (lowercased, non-alphanumeric → underscore). Keeping them under .sections means a section titled "Findings" can never collide with report.findings.

A section titled "Introduction" → {~report.sections.introduction}. A section titled "Technical Summary" → {~report.sections.technical_summary}.

Use {~report.sections.<slug>} for formatted HTML, or {report.sections.<slug> | text} for plain text.

Client Fields

Custom fields (key/value pairs you add on the client) are exposed as a loop — add a field in the app and it appears in the report with no template change:

{#client.customFields}{label}: {value}
{/}

Project Fields

project.* dates are always the literal project dates. Use report.startDate / report.endDate when you want the assessment-specific values (which honour a per-report override).

Custom fields: {#project.customFields}{label}: {value}{/}.

Dates

Dates are raw values. A bare tag renders the long format; the date filter reformats it:

The same works for project.startDate, project.endDate, and metadata.generatedDate.

Summary Counts

Severity tallies for exec-summary tables. Each is a number.

These are the same numbers as {findings | where:"severity":"critical" | count}, kept as a convenience because nearly every report has a severity table.

Organization & Metadata

Consultants

Loop with {#consultants} … {/}:

Outside the loop, {consultantNames} gives all names pre-joined with commas — handy for a single table cell.

Findings

Loop with {#findings} … {/}. Each finding exposes:

Identification & Body

For plain text of any HTML field, pipe through | text — e.g. {description | text}.

CVSS

CVSS is one version-agnostic object. cvss.* reflects whatever version the finding is scored with; {cvss.version} tells you which ("3.1" or "4.0"). Write your template against cvss.* and it works for both — no version branching.

Presence conditionals (each renders only when that data exists — 0/absent is falsy):

{#cvss.present}CVSS v{cvss.version}: {cvss.score} ({cvss.severity}){/}
{#cvss.hasTemporal}Temporal: {cvss.temporal.score}{/}
{#cvss.hasThreat}Threat: {cvss.threat.score}{/}
{#cvss.hasEnvironmental}Environmental: {cvss.environmental.score}{/}

Showing both versions side by side — the explicit cvss.v3_1 and cvss.v4_0 objects (each present only if the finding carries that version):

{#cvss.v3_1}CVSS 3.1: {cvss.v3_1.score} — {cvss.v3_1.vector}{/}
{#cvss.v4_0}CVSS 4.0: {cvss.v4_0.score} — {cvss.v4_0.vector}{/}

Each has the same nested shape (.score, .vector, .severity, .base.*, etc.).

Evidence (nested loop)

{#evidence} … {/}:

Affected Assets (nested loop)

{#affectedAssets} … {/}:

For a single cell, join them instead of looping: {affectedAssets | join:", "} (or {affectedAssets | join:"\n"} for one per line).

Custom Fields (nested loop)

Per-finding key/value fields: {#customFields}{title}: {content}{/}.

Ordering & Filtering Findings

Instead of separate pre-sorted arrays, apply sort and where to the findings collection:

{#findings | sort:"cvss"} … {/}                          ← highest CVSS first
{#findings | where:"severity":"critical"} … {/}          ← critical only
{#findings | where:"severity":"high" | sort:"cvss"} … {/}  ← high, CVSS-ordered

Count matches (also works as a conditional): {findings | where:"severity":"critical" | count}.

Tabs

A report can have multiple tabs (e.g. "Web Application", "Infrastructure"). Loop every tab with {#tabs} … {/}. Inside the loop:

{#tabs}
{name} — {findingCount} findings

{#findings | sort:"severity"}
{findingId}. {title} ({severity | title})
{~description}
{/}
{/tabs}

Prefix-Scoped Tags (no loop)

When a tab has a custom exportTagPrefix (e.g. appsec), its data is also reachable at the top level under that prefix — useful for fixed-layout templates that don't loop tabs:

Replace appsec with any custom prefix. When the prefix is report (the default), these live under report.*.

Template Patterns

Simple Report

{report.title}
Client: {client.name}
Date: {report.startDate | date:"UK"} — {report.endDate | date:"UK"}

{~report.executiveSummary}

{#findings | sort:"severity"}
{findingId} - {title} ({severity | title})
CVSS: {cvss.score} ({cvss.severity})
{~description}
{~remediation}
{#evidence}
{%image}
{@captionXml}
{/evidence}
{/findings}

Severity Sections (via where)

{#tabs}
{#findingCount}
{name} Technical Findings

{#findings | where:"severity":"critical"}
{title} — {cvss.score}
{~description}
{~remediation}
{/}

{#findings | where:"severity":"high"}
{title} — {cvss.score}
{~description}
{/}
{/findingCount}
{/tabs}

Consultants Table

Or a single string: {consultantNames}.

Moving From the Old Tags

If you have a template written for Vulnsy's earlier tag set, here's what changed. The old tags are no longer provided — update to the replacements below.