Questions people actually ask

Do containers come out with zero CVEs?

No, and neither does anything else. There is no such thing as a zero CVE container, only a container that was clean at the moment somebody measured it. Not every CVE applies to how you actually deploy either: a vulnerability in a code path you never call is not the same risk as one on your front door.

So the pipeline does three things instead of promising a number. Every finding arrives ranked with the fix that closes it. Serious failures return to engineering automatically and never reach approval. What remains is assessed for reachability, upgrade path, and compensating controls, and whatever is accepted is accepted knowingly, in writing, by a person whose name is on it.

Does the AI approve anything?

No, and it never will. Steps 01 through 05 run without you. Step 06 is a person: a named reviewer approves under their own verified identity, enforced by the platform's own permissions. Never a bot, never on someone's behalf. Explainable AI drafts the justification from the evidence with every sentence cited; the words and the signature stay yours.

What do we have to change to use it?

Connect your pipeline. Evidence publishes to your own private security repository in immutable, hash verified directories, and the review opens in the project your team already works in. Self managed or hosted, in your cloud or ours.

Where does our code and evidence live?

With you. Scan output lands in your security repository. We do not take custody of your source or your artifacts, and every record we produce points back to a hash you can verify yourself.

What scanners does it run?

Open source tools on every push, covering SBOM, vulnerabilities, exposed secrets, misconfiguration, malware, static analysis, and Dockerfile hygiene. The pipeline is not hardcoded. As tools change, the gates and the record change with them. See Scanners.

We already pay for an AppSec platform. Why add this?

Because none of them end in a decision. Detection tools hand your team a list, hardened images cover the parts you buy, your platform stores the artifacts, and every one of those leaves a person staring at unresolved risk with no way to dispose of it on the record. Attest scans on every push and then produces the signed authorization, which is the only thing an auditor, a regulator, or a customer accepts as proof.

What happens when a container has not changed?

It is recognized as unchanged and the second review cites the delta rather than starting over. Minutes, not days, and the record says exactly why it was quick. See Reviewing an unchanged container again.

What can we hand an auditor?

An attributed, timestamped decision tied to an evidence hash: what was found, what was fixed, what was accepted, on what basis, and who decided. It exports for a SOC 2 auditor, an ISO 27001 review, a regulator, or a customer's security questionnaire. See Exports and evidence.

Who is behind it?

Ulap Inc., a minority owned small business, profitable since 2019 and fully self funded, with multiple Army and Air Force SBIR Phase I and II awards and significant investment from U.S. Cyber Command and AFWERX.