Know which pods run a new CVE the moment it is published.

Often you should — for one or two clusters where you only need to know what is vulnerable right now, it is a genuinely good answer. The difference: Trivy Operator stores scan results inside each cluster and they expire after a day, so it has to rescan and each cluster stands alone. StackRadar keeps the dependency list itself, outside the cluster, so new advisories are checked against it without a rescan, across every cluster at once, with a dated history. See the Trivy Operator section above for when to stay.

A Software Bill of Materials: the list of everything inside a container image — OS packages, libraries, runtimes, their versions, and licenses. It contains only names and versions, never source code, secrets, or image contents, which is why sending it to StackRadar is safe.

It runs inside your cluster, scans each new image with Syft as it appears (plus a full sweep every 6 hours), and uploads only the resulting SBOM together with what is running where. Vulnerability matching happens on our side. The How it works section above walks through each step.

From OSV.dev — an open, public vulnerability database run by Google. It gathers security warnings from many sources: GitHub Security Advisories, Linux distributions (Debian, Alpine, Ubuntu, and others), and package ecosystems like npm, PyPI, Go, Maven, RubyGems, and crates.io. StackRadar keeps its own always-fresh copy of these 900K+ warnings and checks your dependency lists against it. Because the data is open, there is no black box: every finding links to its public advisory, and you can double-check any result yourself on osv.dev.

Findings are ranked by a risk score that combines three things: how bad the flaw could be (its CVSS severity score), how likely attackers are to actually use it (its EPSS probability, updated daily), and whether attackers are already using it right now (the CISA Known Exploited Vulnerabilities list). So a flaw being used in real attacks outranks a scary-sounding one nobody touches, and your list starts with the findings that matter.

The scanner runs inside your cluster and sends exactly two things to StackRadar: the dependency lists (package names, versions, and licenses — none of your own code) and a list of what is running where (namespace and workload names, image references, Helm chart versions, ArgoCD application names — from a short fixed list of well-known labels, never anything else). Your actual container images, source code, secrets, and environment variables never leave your network. Everything you upload is stored and processed only on servers in the EU.

The scanner works on any standard Kubernetes cluster — EKS, GKE, AKS, DigitalOcean Kubernetes, k3s, kind, and self-managed clusters. It uses the standard Kubernetes API and its access is read-only: it lists and watches pods, plus optional read-only lookups of workload controllers and ArgoCD applications for attribution. It never creates, modifies, or deletes anything.

The scanner and its Helm chart are published under the PolyForm Shield 1.0.0 licence — "source-available", which is not quite the same as open source. Every line of code that runs in your cluster is on GitHub, so you can read it, check it, run it, and change it for your own use. The only thing the licence forbids is reselling it as a competing service. Every release is signed and carries a verifiable record of how it was built, so you can check that the image you download really came from that code. The dashboard (where findings are shown and tracked) is the paid part.

Yes. The scanner automatically uses the same credentials your pods already use (their imagePullSecrets) when it pulls images to read their contents. This works with any standard registry — ECR, GCR, Docker Hub private repos, GitHub Container Registry, and self-hosted registries.

The scanner works in two complementary modes: it watches for pod events in real time so new or updated images are scanned as soon as they appear, and it performs a full cluster sweep every 6 hours (configurable via Helm values) to ensure nothing is missed. Each distinct image is scanned once per cluster. You can also choose which namespaces are scanned using include or exclude lists, and skip specific images by name pattern.

Yes. No contracts, no commitments. Cancel from your dashboard with one click. You'll keep access until the end of your billing period. The scanner itself is free and will continue to run in your cluster.

Email contact@stackradar.io for anything — questions, feedback, enterprise pricing, or help with an install. A person reads it and replies. Security reports go to security@stackradar.io; see the security page for disclosure details.