Advisory feed

​

Turn it on

​

Signatures

​

Format

{
  "version": 1,
  "generated_at": "2026-01-01T00:00:00Z",
  "entries": [
    {
      "id": "TEST-0001",
      "severity": "high",
      "summary": "One line description",
      "fixed_in": "20.5.0",
      "reference": "https://example.invalid/TEST-0001",
      "affected": [
        {
          "repository": "docker.io/library/node",
          "tags": ["20.1.0"],
          "ranges": [{ "from": "20.0.0", "before": "20.5.0" }],
          "digests": ["sha256:..."]
        }
      ]
    }
  ]
}

• version must be 1. severity is critical, high, medium or low. id is unique in the feed.
• Each affected item needs a repository and at least one of digests, tags or ranges, so an entry can never match a whole repository by accident.
• Repositories compare after removing docker.io/ and library/, so node and docker.io/library/node are the same.
• A range covers from (inclusive, optional) up to before (exclusive). Tags are read by their leading dotted number, so 20.2.1-alpine is 20.2.1. Tags that are not versions only match through tags.
• A digest matches when the app’s last successful deploy resolved to that registry digest. Local builds have no registry digest and match by tag or range only.

​

Where it shows

• Attention feed: one item, “N running images match a known advisory”, critical when any match is critical.
• Security center, Checklist tab: a compact card with the feed state, signature label and per-app matches.
• CLI: levelrail-cli security advisories list and levelrail-cli security advisories match.
• API: GET /api/v1/security/advisories (read ability). Callers only see apps they can read.

​

Refresh an affected app

levelrail-cli security advisories match
levelrail-cli security advisories refresh <app> [--confirm]