2026-11-09 22:15:14 +00:00
1 changed files with 4 additions and 3 deletions
@@ -91,7 +91,7 @@ Every inventoried target has exactly one state:
 | `pending` | Discovered and not yet scanned, within the 2-hour window. |
 | `stale` | Last successful scan is older than the 24-hour window. Prior findings are retained and labelled stale. |
 | `failed` | The most recent attempt failed. The reason is shown. Prior findings are retained. |
-| `credential-required` | The registry refused anonymous access. Shown with the registry. |
+| `credential-required` | The image is on a registry declared as needing a credential the scanner does not hold. Shown with the registry. A declared list is used because the private registry sits on the LAN, which the scanner's egress excludes, so it would otherwise surface as a network failure. |
 | `by-tag` | Scanned by mutable reference, because no running digest exists. |
 | `not-covered` | A target class this scanner cannot examine: VMs and nodes. |

@@ -244,8 +244,9 @@ compromised in March 2026 ([CVE-2026-33634](https://nvd.nist.gov/vuln/detail/CVE
  **nothing else**. It MUST NOT read Secrets or hold any write verb on the Kubernetes API.
 - It holds no git credential and no registry credential.
 - Network: ingress only from the Gateway for the page, from CI for the internal API and from
-  Prometheus for metrics. Egress only to the Kubernetes API, DNS, and TCP/443 on the public internet,
-  with cluster and LAN ranges excluded, through the direct path.
+  Prometheus for metrics. Egress only to the Kubernetes API, DNS, the platform Gateway and identity provider (required by the
+  SSO sidecar), and TCP/443 on the public internet, with cluster and LAN ranges otherwise excluded,
+  through the direct path.
 - It runs unprivileged, with a read-only root filesystem and no host namespaces or mounts.
 - The scanner's own images appear in the report like any other.