ScanRook Blog
Educational articles on vulnerability scanning, CVE databases, exploit prediction, and container security.
How to Scan a Docker Image for Vulnerabilities (4 Ways)
A step-by-step guide to scanning Docker images for vulnerabilities with Docker Scout, Trivy, Grype, and ScanRook — how to export an image, read the results, fix findings, and automate scanning in CI/CD.
IntegrationsScanRook MCP Server: Let AI Assistants Scan for Vulnerabilities
Introducing the ScanRook MCP server — give Claude, GPT, and any MCP-compatible AI assistant the ability to scan container images, check CVEs, and analyze licenses through natural conversation.
BenchmarksVulnerability Scanner Benchmark 2026: ScanRook vs Trivy vs Grype vs Snyk
Comprehensive 2026 vulnerability scanner benchmark comparing ScanRook, Trivy, Grype, and Snyk on real container images. Methodology, timing data, finding counts, and accuracy analysis.
Data sourcesCVE Database Comparison: NVD vs OSV vs GHSA vs Snyk Intel (2026)
Comprehensive comparison of vulnerability databases — NVD, OSV, GHSA, Snyk Intel, and Red Hat OVAL — covering coverage, update speed, API access, and when to use each.
BenchmarksScanRook Benchmark Results: Real Scan Data Against Trivy and Grype
Transparent benchmark results comparing ScanRook, Trivy, and Grype on five container images with analysis of finding differences.
LaunchWhy We Built ScanRook
Why we chose a local-first scanner architecture with optional cloud enrichment.
Technical deep-diveWhat Is an SBOM? How ScanRook Uses SBOMs for Faster, More Accurate Triage
A practical guide to SBOMs, why they matter for security programs, and how ScanRook uses them in real workflows.
What Is a CVE? A Plain-English Guide to Vulnerability IDs
What a CVE is, what the ID format means, who assigns them, and how the CVE lifecycle works — plus how CVE relates to CVSS, CWE, EPSS, and KEV.
Log4Shell (CVE-2021-44228) Explained: Detection and Remediation
A clear technical explanation of Log4Shell (CVE-2021-44228), the critical Log4j RCE — how the JNDI exploit worked, affected versions, the follow-up CVEs, and how to detect and remediate vulnerable JARs.
Alpine vs Debian vs Distroless: Which Container Base Image Is Most Secure?
Comprehensive comparison of Alpine, Debian Slim, Ubuntu, and Distroless container base images for security. Real vulnerability scan data, size comparison, compatibility tradeoffs, and migration guide.
EPSS Scores: How to Prioritize Vulnerabilities by Exploit Probability
A practical guide to using EPSS for vulnerability prioritization. Decision matrix, real CVE examples, CVSS comparison, and integration with ScanRook.
regreSSHion (CVE-2024-6387): The OpenSSH Vulnerability That Exposed Millions of Servers
Deep dive into regreSSHion (CVE-2024-6387), the OpenSSH signal handler race condition that affected 14 million internet-facing servers. Technical analysis, detection, and remediation.
Container Image Security Checklist: 15 Steps for Production-Ready Images
A comprehensive 15-step security checklist for hardening container images before production deployment, covering base images, scanning, secrets, runtime security, and monitoring.
How to Read an SBOM: CycloneDX vs SPDX Explained with Real Examples
Learn how to read and interpret Software Bill of Materials in CycloneDX and SPDX formats with annotated real-world examples, comparison tables, and regulatory context.
What Is the OSV API? Ecosystems, Advisories, and How It Works
A practical guide to the Open Source Vulnerabilities database, the advisory format it uses, and how scanners query it for vulnerability data.
Understanding the NVD and CVSS v3.1 Scoring
How the National Vulnerability Database works, what CPE matching means, and how CVSS v3.1 base scores are calculated.
EPSS Scores Explained: Exploit Prediction for Vulnerability Prioritization
What EPSS is, how percentile scores work, and why exploit probability is a better prioritization signal than severity alone.
CISA KEV Guide: Why Actively Exploited CVEs Demand Immediate Action
What the CISA Known Exploited Vulnerabilities catalog is, who it applies to, and how to use it in your remediation workflow.
Installed-State Scanning vs. Advisory Matching: Reducing False Positives
Why reading actual package manager databases produces more accurate findings than matching file paths against advisory lists.
Container Scanning Best Practices for Security Teams
Practical guidance on scanning container images effectively, from base image selection to CI/CD integration and finding prioritization.
What Is YARA and Why Security Teams Use It
A guide to YARA, the pattern-matching engine used by security teams for malware detection, and how ScanRook integrates it for deep container scanning.
Vulnerability Scanning for Compliance: What You Need to Know
Penalties for non-compliance, scanning frequency requirements by framework, and how to build a compliant vulnerability scanning program.
What We Learned from Black Duck (And How We Made License Scanning Better)
How Black Duck pioneered license scanning with snippet matching and proprietary databases, what has changed since 2005, and how modern tools deliver the same results at a fraction of the cost.
The Complete Guide to Open Source License Compliance in 2026
A comprehensive guide to open source license compliance covering legal risks, common mistakes, building a compliance program, tooling comparisons, and SBOM integration.
On-Prem vs SaaS Vulnerability Scanning: Which Is Right for You?
Data sovereignty, air-gapped environments, cost comparison, and when on-prem scanning is required versus when SaaS makes sense.
How Red Hat Backports Security Patches: A Complete Guide to RHEL Vulnerability Management
Understand how Red Hat backports security fixes, why package versions don't tell the full story, and how OVAL/CSAF data enables accurate RHEL vulnerability scanning.
Is the Nginx Docker Image Safe? What Our Scanner Found
We scanned nginx:1.27 with ScanRook: 2,952 findings (408 critical). What that means, which CVEs matter, and why the Alpine tag cuts findings by 79%.
How to Reduce CVEs in Docker Images: 6 Steps That Work
Six concrete steps to reduce CVEs in Docker images: smaller base images, multi-stage builds, package updates, rebuild cadence, and scan verification.
How to Scan Docker Images in GitHub Actions
A complete GitHub Actions workflow for scanning Docker images: install the scanner, scan on pull request, upload reports, and fail builds on critical CVEs.
Trivy Alternatives in 2026: When to Use Something Else
An honest look at Trivy alternatives — ScanRook, Grype, Snyk, Docker Scout — with benchmark data on finding depth, speed, and if Trivy is still right.
Is the Postgres Docker Image Safe? What Our Scanner Found
We scanned postgres:17 with ScanRook: 2,983 findings (387 critical). What that means, which CVEs matter, and why the Alpine tag cuts findings by 86%.
Is the Redis Docker Image Safe? What Our Scanner Found
We scanned redis:7-alpine with ScanRook: 299 findings (20 critical) versus 1,399 (114 critical) for the Debian-based redis:7 tag. Which tag actually wins.
How to Patch Docker Base Image Vulnerabilities
A step-by-step guide to patching Docker base image vulnerabilities: retag, rebuild with --pull, apply OS patches, pin digests, and verify with a scan.
Is the Node Docker Image Safe? What Our Scanner Found
We scanned node:22 with ScanRook: 30,726 findings (1,794 critical). What that means, which CVEs matter, and why node:22-alpine cuts findings by 99%.
Is the Python Docker Image Safe? What Our Scanner Found
We scanned python:3.12 with ScanRook: 31,590 findings (1,875 critical). What that means, which CVEs matter, and why the Alpine tag cuts findings by 99%.
Multi-Stage Docker Builds for Security: A Practical Guide
How multi-stage Docker builds improve security: split build and runtime stages, avoid leaking build secrets, and ship a minimal final image.
How to Scan Docker Images in GitLab CI
A complete GitLab CI pipeline for scanning Docker images: build in Docker-in-Docker, scan with ScanRook, store reports, and fail merge requests on critical CVEs
Migrating to Distroless Images: A Step-by-Step Guide
How to migrate Docker images to distroless: assess your base, adapt the build per language, handle debugging without a shell, and verify with a scan.
Grype Alternatives in 2026: When to Use Something Else
An honest look at Grype alternatives — ScanRook, Trivy, Snyk, Docker Scout — with benchmark data on finding depth, SBOM workflows, and when Grype is right.
Jenkins Docker Image Scanning: A Complete Pipeline
A complete Jenkins pipeline for scanning Docker images: build, save, scan with ScanRook, archive the report, and fail the build on critical or high CVEs.
Docker Image Hardening Checklist: 8 Steps With Code
An eight-step Docker image hardening checklist with runnable code for each step: non-root users, minimal base images, capability drops, and scanning.
How to Automate Docker Base Image Updates
How to automate Docker base image updates with Renovate or Dependabot, scheduled CI rebuilds, digest pinning, and automatic scan verification.
How to Fix npm Vulnerabilities in Docker Builds
How to fix npm vulnerabilities in Docker builds: audit and patch the lockfile, use npm ci, exclude devDependencies, and verify with a rescan.
Snyk vs Trivy vs Grype: Which Should You Actually Use?
Snyk vs Trivy vs Grype compared honestly: pricing, workflow, and finding depth, with benchmark data on where open source diverges from commercial scanners.
The Minimal Docker Image Guide: Alpine, Distroless, Scratch
A practical guide to building minimal Docker images: choosing a base tier, static binaries into scratch, multi-stage cleanup, and size verification.
How to Triage Vulnerability Scan Results
A repeatable vulnerability triage process: rank findings by severity, EPSS, KEV, and reachability, gate CI, assign owners, and re-scan on a cadence.
SBOM Requirements in 2026: A Practical Map
A practical map of SBOM requirements in 2026: federal procurement, the EU Cyber Resilience Act, FDA medical device rules, and what teams need in place now.
OSV vs NVD: How the Two Vulnerability Databases Actually Differ
OSV vs NVD compared: how each publishes and matches vulnerability data, where their coverage diverges, and why scanners that use only one develop blind spots.
Kubernetes Admission Control for Image Scanning
How Kubernetes admission control blocks unscanned or vulnerable container images at deploy time, with a working Kyverno policy and where ScanRook fits the gate.
The EU Cyber Resilience Act and Container Images
What the EU Cyber Resilience Act means for container images: SBOM duties, vulnerability handling, and patching obligations for products with digital elements.
What Is a Vulnerability? Weaknesses, CVEs, and Risk
What a vulnerability is in security terms: how it differs from threats and risk, common types, the CVE lifecycle, and how scanners find known weaknesses.
Vulnerability Management: A Practical Lifecycle Guide
Vulnerability management is a continuous lifecycle, not a one-time scan. The stages, risk-based prioritization, SLAs, metrics, and where ScanRook fits.
What Is SCA? Software Composition Analysis Explained
What SCA (software composition analysis) is: how it inventories open-source components, matches them to known CVEs and licenses, and where it fits vs SAST.
Gitleaks: Fast Secret Scanning for Git Repos and CI
Gitleaks is a fast, open-source secret scanner for git repos and CI. How its regex and entropy detection works, its tradeoffs, and where ScanRook fits.
Ubuntu vs Debian: Which Docker Base Image to Choose
Ubuntu vs Debian as a Docker base image: real security, size, and support tradeoffs, plus a clear recommendation for most container workloads.
SAST vs DAST: How Application Security Testing Differs
SAST vs DAST explained: how static and dynamic application security testing differ, what each catches and misses, and where SCA and IAST fit alongside them.
Anchore Alternatives in 2026: A Fair Comparison
An honest look at Anchore alternatives — Grype, Syft, Trivy, Snyk, and ScanRook — covering the open-source tools, Anchore Enterprise, and when each wins.
Patch Management: A Practical Guide for Modern Stacks
Patch management is how you close known vulnerabilities. The lifecycle, prioritization, testing, and why containers are rebuilt instead of patched.
Heartbleed (CVE-2014-0160) Explained: Impact and Remediation
Heartbleed (CVE-2014-0160) leaked server memory through an OpenSSL TLS heartbeat over-read. Affected versions, the private-key risk, and how to remediate it.
Kubernetes Secrets Security: A Practical Guide
A practical guide to Kubernetes secrets security: why base64 is not encryption, encryption at rest, RBAC, external secret stores, and safe mounting.
Docker Security: A Practical Hardening Guide for 2026
A practical Docker security guide: harden containers with non-root users, dropped capabilities, read-only filesystems, seccomp, and image scanning.
Docker Rootless Mode: How and Why to Run Without Root
Docker rootless mode runs the daemon as a non-root user so a container escape lands unprivileged. How it works, how to set it up, and its limits.
NVD API Key: How to Get One and Why Scanners Need It
How to request and use an NVD API key: the rate limits with and without one, how to send it, and why vulnerability scanners need it for enrichment.
kube-bench: Scanning Kubernetes Against the CIS Benchmark
kube-bench checks whether your Kubernetes cluster is configured to the CIS Benchmark. How it works, how to run it, what it catches, and what it does not.
Secret Scanning: A Practical Guide to Finding Leaked Keys
Secret scanning finds hardcoded credentials in code, git history, and images. Detection methods, the tool landscape, remediation, and where ScanRook fits.
Trivy Operator: Continuous Scanning Inside Kubernetes
The Trivy Operator continuously scans Kubernetes workloads and writes vulnerability, config, and secret reports as CRDs. How to install and use it.
Leaky Vessels (CVE-2024-21626): runc Container Escape
Leaky Vessels (CVE-2024-21626) is a runc container escape via a leaked file descriptor. How it works, the affected versions, the 1.1.12 fix, and detection.
Pod Security Standards: A Practical Kubernetes Guide
A practical guide to Kubernetes Pod Security Standards: the Privileged, Baseline, and Restricted profiles, Pod Security Admission, and enforcement.
Trivy vs Grype: An Honest Comparison of Two Scanners
Trivy vs Grype compared honestly: scope, databases, output formats, speed, and finding depth, with benchmark data and when to pick each scanner.