Add an image
There are two ways to get images into BreachLens.- Add one image
- Connect a registry
Open Containers → Add container and enter the image reference — e.g.
ghcr.io/acme/api:1.4.2 or registry.internal/team/web:sha-abc123. Optionally label its registry. That’s it; a public image needs nothing more.Private registry credentials
Private images need pull credentials, supplied when you connect the registry (encrypted at rest). Each type takes what that registry expects:ECR is the fully-supported reference path. If a private ACR / GAR / Docker Hub connection needs a hand for your setup, reach out — we’ll get it wired.
Run a scan
1
Open the container
Go to Containers and click the image.
2
Run the scan
Click Run scan. BreachLens pulls the image server-side and reports CVEs across OS packages and language dependencies, each tiered by reachability.
3
Triage patch-first
Sort by reachability + severity — a Critical CVE in code your image actually loads beats a Critical in a package that’s present but never used.
Verify signatures
If you sign your images, BreachLens can confirm each scanned image was signed by a key you trust — surfacing an unsigned or wrong-key image as a supply-chain finding. Signing keys are configured per Application, not per image: add the trusted public key(s) (ECDSA / RSA / Ed25519 PEM, or a keyless signer identity) to the Application, and every container linked to it is checked on its next scan. A revoked key stops trusting new images without deleting the history.Export an SBOM
Every container can produce a software bill of materials for procurement or downstream tooling:- CycloneDX (default) —
Download SBOM - SPDX — choose the SPDX format for NTIA / EO 14028 evidence
Next steps
Monitor continuously
Auto-import + auto-scan new tags, and schedule nightly re-scans so a new base-image CVE surfaces overnight.
Scan a web app
Point DAST and the autonomous pentest at a running app and get reproducible Proof-of-Exploit.