August 2026
An inferred edge never completes a path
A matching image tag is a useful clue, but tags can change or be reused. Treating that clue as proof can send a team toward the wrong workload. Investigators need to see both the relationship and the evidence supporting it.
We now classify every edge — observed, derived or inferred — and strict views use only the first two. Inferred edges are still shown as candidates, because they are useful hints. But the view will report a gap before it will draw a line it cannot justify, and a missing hop is never persisted, because storing an absence as an edge would fabricate a relationship. See image-to-workload binding.
August 2026
Blast radius that excludes siblings
A count of related findings is not a count of affected workloads. Several scanners may report the same vulnerable package, while only a few deployed services carry it. Blast radius should help an engineer understand deployment impact.
Blast radius now follows only how software is built, shipped and exposed — from package to image to workload to ingress — and is bounded so it stays meaningful. The number now means what an engineer assumes it means: how many workloads, services and ingresses carry the vulnerable package. See vulnerability management.
May 2026
Why our own scanner is untrusted
Scanners parse repositories, images and lockfiles supplied from outside the trusted platform. A parser defect can create risk regardless of who wrote the scanner. Our native engine therefore follows the same isolation boundary as third-party tools.
So the native engine runs isolated in the same trust band as Trivy and Semgrep, with the same restricted credentials, and reports through the same signed ingestion path. A failed tool is reported as incomplete coverage; its failure must not be presented as a clean result. Policy evaluation errors deny a gate decision rather than silently granting approval.
May 2026
Disposition is a human decision
Automated triage is attractive until you audit it. A model that flips a finding to false positive leaves you with a status and no accountable decision. We made disposition a single API with a mandatory reason code, blocked AI and automated writes to governance fields. The person making the decision and their reason remain part of the evidence that reviewers can inspect.
AI triage still exists. It writes suggestions and every prompt is audited, accepted or rejected. It never writes the verdict. See remediation and SLAs.
May 2026
Two-stage language detection
The trusted platform must never clone the repository: cloning is hostile-input handling and belongs in the isolated scan band. But the tool plan depends on the languages present.
The compromise is two stages. An initial plan is made without touching code, always including the native engine and the baseline tools. The isolated scan reports the languages it actually found, and the plan is refined there. Teams can inspect which tools ran and which did not finish, rather than assuming that a completed job covered every language or file.