What zero-trust means for a scanner

Why ZTVS attaches evidence to every finding, and what that rules out.

You are viewing 0.0.1. The latest release is 0.0.2.

View 0.0.2

"Zero trust" is usually said about networks: authenticate every request, trust no segment, assume the perimeter has already failed. Applied to vulnerability scanning it means something specific and slightly awkward.

The claim a scanner usually makes#

A conventional scanner reads a manifest — a lockfile, an OS package database, an SBOM someone generated in CI last quarter — and reports on what the manifest says. The output looks factual. It is actually a claim about a claim: the scanner is telling you what a file told it.

That is fine right up until the manifest and the artefact disagree, which they do constantly. A dependency vendored by hand. A binary patched in place. A base image rebuilt under the same tag.

What ZTVS does instead#

Every finding carries the evidence that produced it: which source, which file, which line or which layer digest. Not as a debugging aid — as the finding's justification.

This has a consequence people find annoying at first: ZTVS will report fewer things than a manifest scanner, because it declines to report what it cannot evidence. A package listed in a lockfile but absent from the filesystem is not a finding. It is a discrepancy, and it is reported as one.

What this does not give you#

Being precise about the boundary, because a security tool that overstates its guarantees is worse than one that does nothing:

  • ZTVS verifies what is present. It does not verify that what is present is what you intended.
  • Evidence proves the scanner's reasoning. It does not prove the scanner ran, or ran unmodified. That gap is what attestation addresses, and 0.0.1 does not have it.
  • Advisory data is still someone else's claim. ZTVS records which database and which snapshot it used, so the claim is at least attributable.

Why the strictness is the feature#

A scan you cannot argue with is worth more than a scan with a longer list. When a finding is disputed — and they are disputed constantly, usually by the team who owns the service — the argument should be about the evidence, not about whether the scanner is trustworthy.