Code and image security

Two stages of security scanning

Vulnerability scanning is included in Free, Starter, and Pro at no additional charge.

AppJet scans projects at two stages: at the code level while working on the project, and at the container image level before deployment. Both stages use Google’s OSV-Scanner to identify known vulnerabilities in dependencies.

Stage	When it runs	What it checks
Code-level scanning	During work on the code	Dependencies identified from supported project source files, manifests, and lockfiles
Container image scanning	Before deployment	Supported operating-system packages and application dependencies in the built container image

Code-level scanning during development

AppJet uses OSV-Scanner while working on your code to check project dependencies against known vulnerability advisories. This helps identify affected packages while changes are being made, so they can be addressed before the application is deployed.

OSV-Scanner’s project source scanning identifies dependencies from supported artifacts such as lockfiles and compares them with the OSV vulnerability database. This is dependency vulnerability scanning; it does not establish that every line of application logic is secure.

Container image scanning before deployment

AppJet also uses OSV-Scanner to scan the built container image before deployment. A container includes more than your repository: its base image, operating-system packages, and installed application dependencies can introduce vulnerabilities of their own.

OSV-Scanner’s container image scanning extracts package information from the image and matches it against known vulnerabilities. Checking the built image complements the code-level scan by examining the packages included in the deployment artifact.

Respond to a finding

Review the affected package, installed version, and linked advisory. When a fix is available, update the dependency or base image, check compatibility, and rerun the relevant tests and scans.

Rebuild after changing dependencies or the base image so the container scan covers the updated artifact. Then deploy the new build and verify the running application. An earlier scan result belongs to the code or image it checked; it does not verify changes made afterward.

For a task, you can ask:

Review the vulnerability findings, explain the affected dependencies, and update them where a compatible fix is available. Run the relevant tests, rebuild the image, and report the new scan results and any unresolved findings.

See tasks and verification for reviewing checks and deploy your code for the build and deployment workflow.

What the scans cover

Coverage depends on the packages OSV-Scanner can identify and the advisories available when the scan runs. A scan with no findings means no matching known vulnerabilities were reported in that scope. Continue reviewing application permissions, authentication, secret handling, and business logic alongside dependency and container checks.