Security report is confusing

I created a helm chart for SFTPGo and published it in a repository on Artifact Hub:

https://artifacthub.io/packages/helm/sagikazarmark/sftpgo/0.0.7

There are two flavors of images published for SFTPGo:

• Debian based
• Alpine based

Both images are added to the chart as annotations in Chart.yaml.

As one could expect, the Debian version is full of packages with reported security vulnerabilities whereas the Alpine version is all green.

When looking at the Security report, it’s a little bit confusing though, because it shows all those red signs and without a few clicks it’s not immediately obvious that there are alternative images which should be “safe” to use.

Publishing images for multiple distributions is a common practice and the “default” is often Debian and not Alpine, so it’s even more important to share that information. I don’t have any ideas how to do that though, I just wanted to raise an issue about it.

Here are some screenshots that show what I tried to describe above:

[sagikazarmark]

Thanks for the explanation! Makes sense

[sagikazarmark]

@tegioz the new screenshot looks great, thanks!

The security badge could maybe say

128 vulnerabilities found
(in 2 images)

Or an information icon next to the summary text saying the same in a popup, pointing to the full report for details.