Reading this without JavaScript?
Every screen here is rendered in-browser from the URL fragment, so a
deep link shows no content without JavaScript. Read the JSON feed
directly instead. All paths are relative to this page and every one is
OPTIONAL — the feed is built by a separate job and this site can
deploy ahead of it, so treat a 404 as “this feed build does not
publish it yet,” never as an error or as “clean.”
- Entry point (scanned Kubernetes versions, cohorts, AKS releases):
data/_index.json
- One Kubernetes version (images grouped by CVE count):
data/k8s/<version>.json
- One CVE across both axes (Kubernetes snapshot + AKS release history):
data/cve/<CVE>.json
- One AKS release (home of images not mapped to any Kubernetes version):
data/release/<version>.json
- Slim CVE triage index (CVE → affected Kubernetes minors):
data/cve-index.json
- Per-image detail (resolve the repo through the index, never guess
the filename):
data/image/index.json then
data/image/<slug>.json
- Controlled vocabulary (states, attribution, first-fix provenance):
data/glossary.json
- Generated endpoint inventory with real byte sizes:
data/manifest.json
- Agent overview and the full JSON contract:
llms.txt.
Two axes are never blended: the Kubernetes snapshot
(basis: k8s_snapshot, frozen point-in-time) and the AKS
release history (basis: release_history, continuously
rescanned) are different evidence and may legitimately disagree. Counts
are only comparable within a scan cohort (see each version's
comparable_with).