Security

What data StackRadar receives

The scanner runs inside your cluster. The only thing it sends outward is a CycloneDX SBOM per container image — an inventory of package names, versions and licenses.

An SBOM does not contain, and StackRadar never receives:

• Source code, or any part of an image layer
• Secrets, environment variables, or ConfigMap and Secret contents
• Registry credentials — imagePullSecrets are read and used in-cluster only
• Application data, logs, or traffic

Alongside the SBOMs, the scanner reports the workload metadata needed to attribute a finding to a workload — namespace, workload name, image reference and digest — plus a heartbeat with its own version.

Where it is processed

Everything you upload is stored and processed exclusively on servers in the EU. There is no replication to a non-EU region.

Network posture

The scanner makes outbound HTTPS requests to api.stackradar.io on port 443 and to nothing else. It needs no inbound connectivity, no ingress, and no public endpoint. Against the Kubernetes API it needs read access to list pods and workloads.

For clusters that cannot reach the public internet, see private registry & restricted-network installs.

Authentication

Each cluster gets its own cluster-scoped API key. SBOM upload rejects org-scoped keys outright, so a key taken from one cluster cannot be used to write data attributed to another. Keys are revocable per cluster from the dashboard. See API keys & cluster scoping.

Supply chain integrity of the scanner

The tool you install to audit your supply chain is itself auditable:

• Open source. The scanner and its Helm chart are public — you can read every line of what runs in your cluster on GitHub.
• Signed. Every release is signed with Sigstore Cosign.
• Digest-pinned. The chart ships the exact sha256 digest of the image, so tag mutation cannot swap what you install.
• Attested. Built in GitHub Actions with SLSA provenance attestations stored in GHCR.

Vulnerability data

Findings are matched against a continuously synced mirror of OSV.dev, the open vulnerability database run by Google under the OpenSSF. Because the source is public, every finding StackRadar reports can be checked against its advisory independently of us. See how vulnerability matching works.

Reporting a vulnerability

Report suspected vulnerabilities in StackRadar or its scanner to security@stackradar.dev. Please include enough detail to reproduce the issue. We will acknowledge your report and keep you updated while we investigate. Please do not disclose publicly until we have had a chance to respond.

Certifications and audits

StackRadar does not currently hold a SOC 2, ISO 27001 or equivalent third-party certification, and this page will not claim one before it exists. If your procurement process needs our current posture in writing, a DPA, or a subprocessor list, contact hello@stackradar.dev and we will send what we have.