QFinch resolves approved container-image references, records immutable image identity where available, inventories operating-system and application packages, and correlates affected versions with vulnerability intelligence.
Evidence you can use
- Requested and resolved image identity.
- Platform and digest provenance.
- Package inventory and affected versions.
- Severity, known-exploited status and remediation context where available.
- SBOM and downloadable report artifacts.
- Scan history and progress in the same workflow as other assets.
Private registries require appropriate scoped access. An image scan assesses the selected artifact; it does not assess the full runtime configuration or cloud environment.
CTA: Add a container image