Vulnerability checks
How launchroom reads the packages of your images, which public sources it checks them against, what it sends and how often.
launchroom checks the packages and runtimes of every live service against public vulnerability data. Each launchroom instance does this on its own. There is no launchroom service in between.
Reading the packages of an image
When a deployment goes live, a build server reads the packages of its image:
- It scans the image with the SBOM scanner it already uses for builds. The scanner runs without network access and reads the image without changing it.
- For images launchroom built, it also reads the lockfiles of the commit (
package-lock.json,pnpm-lock.yaml,composer.lock,poetry.lockand others). They tell development dependencies apart from the ones that run in production. - Only the list of packages is stored. The image's SBOM document isn't kept.
Images of preview environments aren't read. Reading never delays a deployment. If it fails three times, launchroom tries again after 10 minutes and after an hour, then shows the reason under Worth knowing.
Sources
| Source | What it provides | How often |
|---|---|---|
| OSV | Vulnerabilities per package version for npm, PyPI, Go, Maven, NuGet, crates.io, RubyGems, Packagist, Hex, Pub, Debian, Ubuntu, Alpine and Red Hat based images, and common runtimes and servers | After every new image, then every 6 hours |
| CISA Known Exploited Vulnerabilities | Vulnerabilities known to be used in attacks | Daily |
| endoflife.date | Release cycles, latest patches and end-of-life dates of runtimes, databases and distributions | Daily |
OSV includes the reviewed advisories of GitHub's advisory database, so launchroom doesn't call GitHub separately.
What leaves your instance
- OSV receives the ecosystem, name and version of each package. It never receives project, service, team, server or user names. It sees your dashboard's public address.
- CISA and endoflife.date receive plain requests for public files.
All requests go to fixed HTTPS addresses. Advisory data is only data: it can't run code or change a setting in launchroom.
Switching sources off
Instance owners can switch each source off in Settings → Security → Vulnerability data. Without OSV there are no findings, but the inventory and the web firewall keep working. An instance without internet access can switch all three off.
When a source can't be reached
Nothing is raised or resolved because data is missing. The status at the top of the page shows when packages were last checked. After a day without a successful check it names the source it can't reach, and after three days the source is listed under Worth knowing.