Reading scan results
A successful build does not mean an image has zero reported vulnerabilities. Here is exactly what the numbers mean.
What gets published
- Grype scans every production image and publishes raw JSON and SARIF results. SARIF is uploaded to the repository's Security tab.
- Findings are informational. There is no global severity threshold that blocks publication — a CVE with no available fix should not stop a security update to everything else in the image.
- Dev images are excluded from the dashboard. Their larger toolchain surface is not representative of the production image.
Raw vs effective counts
The catalog shows two numbers. Raw is what the scanner reported. Effective is what
remains after applying OpenVEX statements, which
can mark a finding not_affected or fixed
with a stated justification.
Both are shown deliberately. A single "0 CVEs" headline hides whether it was achieved by patching or by suppression.
Suppressions cannot quietly rot
Anything can be suppressed once. The check that matters is whether a suppression is still true, so every scan reconciles VEX statements against fresh results and flags two kinds of drift:
- Stale — the suppressed CVE is no longer present at all, so the statement is dead weight.
- Now fixable — a real upstream fix exists, so the finding should be patched, not hidden.
VEX documents are also schema-validated in CI. The workflow is documented in tools/vex/README.md.
Check it yourself
Every claim here is verifiable from your terminal without an account — see Verify.