Solutions
Organised by the job, not the industry
Every job below is answered with a mechanism that exists in the product today, and every one that is only partly served says so in the same breath. If your job is not here, it is probably in the list of things TRUSTIVAN does not do — which is at the bottom of this page rather than absent from it.
Jobs TRUSTIVAN is used for
Release gating
Stop a bad image without stopping the pipeline
A build asks one question — may this image ship — and needs an answer it can branch on. TRUSTIVAN records a verdict against a versioned policy and returns it in the response body, so a pipeline distinguishes “policy failed” from “the security tool is down” instead of treating both as a non-zero exit.
- Rules match on severity floor, finding kind, lifecycle state, fixability, advisory identifier, age and count
- The verdict names which rule fired, in a fixed order, so two verdicts diff cleanly
- Evaluation is a pure function of policy, findings and time — historical verdicts replay identically
Backlog triage
Stop re-reading the same three hundred findings
The cost of vulnerability management is not the scan, it is the judgement. TRUSTIVAN gives a finding an identity derived from its content rather than its position in a report, so the triage you did last month survives the rescan that would otherwise erase it.
- Severity, line numbers and installed version are excluded from identity, so a re-rating does not orphan a decision
- Suppression requires a reason, an owner and an expiry capped at two years — there is no permanent “ignore”
- Only evidence resolves a finding: a scan that would have found it did not. No button marks something fixed
Continuous coverage
Know that today's answer used today's data
An image that was clean in March is not clean now, and a scanner running on a stale vulnerability database produces the most dangerous output in security tooling: silence that looks like good news.
- Scheduled rescans run as durable, idempotent jobs rather than a cron that forgets it already ran
- A vulnerability database too old to trust fails the scan instead of reporting clean
- Reopening is a distinct, permanent state — a finding that came back cannot be relabelled as merely open
Machine identity
Give a pipeline a credential you can reason about
CI is the busiest user of a security API and the worst place to put a human's credentials. TRUSTIVAN treats the machine caller as a first-class identity with its own scopes, its own expiry, and its own line in the record.
- API keys carry explicit scopes — a pipeline that only creates and reads scans cannot suppress a finding
- Expiry is mandatory; there is no “never expires” option to select by accident
- Revocation is immediate and keeps the record, because an incident review needs to know which credential did what
- A key presented in a cookie is refused, so a credential is never both ambient and unprotected
Remediation workflow
Route a finding to whoever can actually fix it
TRUSTIVAN does not run your ticketing system, and pretending otherwise would put a fake connector logo on this page. What it does is emit the events your existing workflow needs, at the moment the state actually changed.
- Three signed webhook events: a scan completing, a verdict being recorded, a finding changing state
- Published from inside the transaction that caused them, so a delivery never describes a state that was rolled back
- Signed with a rotatable secret, timestamped against replay, retried with backoff for roughly a day
- No Jira, Slack or Linear connector ships today — the events are the integration surface
Enterprise security review
Answer the questionnaire without a sales call
Security teams evaluating a security vendor ask sharper questions than anyone else, and the useful answer is a mechanism rather than a badge. TRUSTIVAN is self-hosted, so your findings and your decision record stay in your own PostgreSQL instance.
- Tenant-scoped queries require a scope value constructible only after a membership check — a handler that forgets to authorise does not compile
- “Belongs to another tenant” and “does not exist” return byte-identical responses
- The scanner asks for no Docker socket and no container runtime; images are pulled from the registry
- SAML and OIDC single sign-on, SCIM provisioning, and an append-only trail of who changed authentication and when
- No SOC 2, ISO 27001 or DPA — no third-party attestation exists, and the security page says so rather than implying otherwise
Scope
One surface, done to depth
TRUSTIVAN scans container images for known vulnerabilities. That is the whole scan surface today, and everything above is what happens to a finding after it is found.
Not available
- Infrastructure-as-code or Kubernetes scanning
- Pull-request or push-triggered scanning
- Reachability analysis — known-exploited status is enriched, but not whether vulnerable code is called
- A blended risk score — findings order by exploited-status then severity, and no invented 0–100 number is produced
- Third-party attestation — evidence maps to SOC 2, ISO 27001, PCI DSS, NIST SSDF and EU CRA controls, but TRUSTIVAN holds no report or certificate of its own
- Mail delivery — an invitation issues a token, and sending it to your colleague is yours to do
- A published price — checkout and the billing portal ship behind BILLING_PROVIDER=stripe, but no price has been set up for this service yet, so a plan is arranged by conversation
Why the list is here
A solutions page that answers every job is describing a roadmap, not a product. Naming the boundary costs a few evaluations that were never going to succeed, and saves the ones that were from finding out late.
Detection itself is not ours: vulnerability matching is done by Trivy, an established open-source engine, under Apache 2.0. What TRUSTIVAN builds is everything that happens to a finding afterwards.
Getting started
Four HTTP calls to a gated pipeline
The evaluation that tells you most is the smallest one: scan an image you already ship, write a policy that matches what you would actually block on, and see what the verdict says about a build you know the answer to.