Findings, SBOMs, and comparisons

Open a scan to review vulnerability severity, package and fixed-version data, scanner output, policy status, and contextual analysis. Use the vulnerability view controls to focus on the findings that matter to your organization. Confirm the image identity and completion state before comparing results from different builds or scanner providers.

From a completed scan you can export evidence, download available SBOM data, compare scans, add comments or manual findings, rescan an image, and share a result or grant an organization access.

Package investigation

The Packages & SBOM view keeps the original CycloneDX document alongside a searchable package inventory and its dependency relationships. Select a package to see its package URL, supplier, license evidence, direct dependencies, reverse dependencies, and the vulnerabilities linked to that package. This is the quickest way to answer “which package introduced this CVE?” without relying on a package-name guess in the UI.

The dependency tree and graph are generated only from relationships supplied by the SBOM. JustScan marks incomplete graph evidence when the source omits dependency records or references a component it did not include. Circular references are displayed as cycles rather than expanded repeatedly. A graph may be capped for very large images; use package search and the package drawer to investigate the exact neighborhood.

Use CycloneDX to download the retained source document. The authenticated scan page and token-shared result page expose the same package evidence; a public result does not expose this expanded investigation surface.

Use suppressions only for accepted risk; document the decision with a comment and review it regularly. A suppression is not a scanner fix and should not hide an unresolved operational error. See audit and governance for an evidence handoff checklist.

Living vulnerability intelligence

See the CVE Intelligence operator guide for the CVE Explorer, background worker, admin timeline, scheduling, progress telemetry, visibility rules, and troubleshooting. The scan-side model is summarized below.

Completed scans retain the scanner result as immutable scan-time evidence. The authenticated vulnerability response also exposes scan_time_intelligence and the separately derived current_posture; the scan response lists the intelligence_versions used for its feed snapshots. A newer feed can therefore update posture for an older finding without changing its original severity, finding data, or compliance verdict.

Posture changes include the source, observation time, intelligence version, reason, and (when available) a link to the CVE change event. Change events retain the provider payload plus normalized before/after CVE state, severity, CVSS, affected ranges, and fixed versions. Conflicting source evidence is retained and surfaced as needs_rescan; unknown applicability is never treated as not_affected. Affected-range updates are matched against the finding's package URL and installed version when available. If the identity is incomplete or only a CPE match is available, JustScan uses needs_rescan rather than guessing. Historical scans are backfilled asynchronously after the additive schema migration.

In Scan Details, the Signals area uses compact posture indicators for severity increases, available fixes, rescan requirements, no-longer-affected findings, and disputed/rejected CVEs. Unchanged findings stay quiet. The Intelligence filter narrows the table to those states; the full finding history remains in the finding details History tab instead of expanding every triage row.

The backend polls NVD CVE change history and fetches the current official CVE record plus the NVD CVE record for each change. Replaying the same source event is idempotent. A failed source fetch is checkpointed for retry and does not alter the last verified posture. Administrators can also add an independent normalized feed snapshot with POST /api/v1/admin/vulnerability-intelligence. The request supplies a source, immutable version, and records containing CVE state, CVSS data, affected ranges, fixed versions, exploit signals, and raw source evidence. A record with an empty package_name applies to all packages carrying that vulnerability. Replaying the same source/version/record is idempotent; newly inserted records immediately re-evaluate matching historical findings and append posture events without rewriting scan data.