Security Insights

Security Insights shows database security recommendations and enabled container image assessments for the selected project. It checks PostgreSQL and Redis IP allowlist configuration to help you restrict database access to trusted networks.

Review findingsCopy Anchor Link

1. Select a workspace and project. You need permission to view the project's resources.
2. Open Security Insights.
3. Review the resource, resource type, recommendation, status, and Last checked time for each finding.
4. Select Open firewall settings to review the affected database's firewall configuration.

The summary shows Issues to resolve, Resolved issues, and Unavailable or out of date. Resource types are shown as Relational Database for PostgreSQL and Memory Store for Redis.

Available checksCopy Anchor Link

Both findings have high severity while open. Unrestricted-rule findings include the affected rule names and CIDR ranges. Review every recommendation: resolving one check does not mean that the other check has passed.

For configuration guidance, see PostgreSQL external connections and Redis network access. Changing firewall settings requires permission to manage the resource.

Finding lifecycleCopy Anchor Link

Database firewall findings are recorded only after a problem is detected. A database that passes a check from the beginning does not receive a resolved finding. An empty table means no issues have been recorded; it does not prove that every resource has been checked.

After you correct a problem, the next successful background check changes the existing finding to Resolved (PASSED). If the same problem returns, that finding changes back to Action required, with the current affected rules. It does not create a separate row for each recurrence.

Affected-rule details are retained when a finding is resolved or a check fails. Treat them as evidence of the earlier problem in those states, rather than a list of currently unrestricted rules. The table represents the latest state of each detected issue, not a complete timeline of every change.

Refresh resultsCopy Anchor Link

Checks run in the background. The page does not refresh automatically. After changing firewall settings, allow the next check to finish, then select Refresh results.

Refreshing retrieves stored results; it does not start a new scan. Check Last checked before relying on a result. Results are out of date marks database findings whose last check is more than 90 minutes old; stale resolved findings are excluded from the resolved summary.

ScopeCopy Anchor Link

Database checks assess saved firewall configuration. They do not test live network reachability or certify that a database is secure. Password-age checks and other database hardening checks are not currently included. Image CVE discovery is described below.

Container image vulnerabilitiesCopy Anchor Link

When image scanning is available, Security Insights shows the latest assessment for each eligible active container. Select Package occurrences to expand CVE IDs, severity, package names, installed versions and available fixed versions. The scanned image digest and platform identify the artifact. Open container opens its resource page.

Newly deployed images are checked on a 30-minute schedule. Assessments for an unchanged image may take up to 24 hours to refresh, including failed assessments for end-of-life operating systems. Other failed scans are retried automatically. Scans can be delayed, so check Last checked before relying on a result. Refresh retrieves the latest available result and does not trigger a scan. Image assessments older than 26 hours are marked out of date.

A scan with detected vulnerabilities requires attention. A completed scan with no detected vulnerabilities appears as PASSED; this is not a security guarantee. Pending scans have no current result. Image transfer or scan errors, changed images, unsupported or end-of-life operating systems and images with no analyzable targets appear as failed assessments. Any evidence shown with a failed assessment may be incomplete.

Scanning supports one running managed application container on Linux amd64 or arm64. It checks the deployed image, including images from private registries and locally built images. You do not need to provide registry credentials for scanning. Multi-container services and preview deployments are unsupported.

The assessment covers image layers and image configuration, including files baked into the image. It excludes volumes, bind mounts, changes made inside a running container and runtime-injected environment variables. Image archives larger than 2 GiB or images that cannot be retrieved within three minutes cannot be assessed.

The summary separates unique vulnerabilities, affected packages (name and installed-version pairs), and package occurrences. One vulnerability can affect several packages or targets; a large occurrence count does not necessarily mean that many distinct vulnerabilities. Identical entries are counted once. The reported-fix count identifies package occurrences with an available fixed version.

If Package occurrences cannot load, select Retry. A loading failure does not mean that no vulnerabilities were found.

Details group occurrences under each vulnerability ID and display up to 100 occurrences, with Critical and High severity first. Summary counts cover the full assessment, including entries outside that limit.

The latest available assessment is retained while a replacement scan runs or fails. Check Latest scan attempt and Latest available assessment separately. A retained-evidence notice means the displayed digest and findings do not confirm the currently deployed image's state. A successful replacement scan updates the assessment; a successful clean scan removes obsolete findings. This feature discovers known package vulnerabilities; risk assignment, remediation tracking and compliance certification are outside its scope.