Observe and maintain JustScan

Treat JustScan as a release-decision service once CI depends on policy outcomes. Monitor the service and its dependencies, then keep a visible maintenance process for changes.

Signals to review

• Backend health: query /api/v1/health through the same route used by users and CI.
• Scan activity: review pending, active, stale, and failed scans; inspect scan step progress and backend logs before changing global timeouts.
• Scanner readiness: use the administration scanner health view and confirm registry reachability, database freshness, and available worker capacity.
• Notifications: test channels and inspect delivery logs and queued delivery state after configuration changes.
• Audit records: review organization and administrator activity when investigating access, ownership, policy, or token changes.

CVE Intelligence health

Review CVE Intelligence after enabling the feature and whenever a security feed incident is suspected. The admin page exposes the last successful checkpoint, retry state, recent sync runs, and live progress for an active run. Watch the completed/total event count and the last progress timestamp, not only the running badge: source events can continue appearing while current-record enrichment is still in progress.

Keep the initial lookback bounded in production. The worker follows a resumable NVD change cursor and does not enumerate every Vulnerability Knowledge Base entry during normal operation. A newly created or widened checkpoint can still create a large upstream backlog, so inspect the current CVE, unique-CVE count, backend logs, and NVD response errors before changing the interval or retrying manually.

Planned maintenance

Use the administration maintenance setting to communicate planned work to application users. Before an upgrade, capture backups, pin the target release tags, and tell CI owners whether the policy gate should be temporarily non-blocking. After the change, verify health, authentication, a registry connection, a representative scan, and notification delivery.

If a signal is unhealthy, work from troubleshooting before increasing concurrency or timeouts. A larger timeout can hide a credential, network, or scanner-data failure instead of resolving it.