Know What’s in Your Containers

When multiple VEX?Vulnerability Exploitability eXchange - machine-readable statements about whether vulnerabilities are actually exploitable in your context sources disagree, Stella uses Belnap’s four-valued logic to compute the definitive state. Conflicts become visible, not hidden. ⊥ Unknown No information yet. Default state before any VEX?Vulnerability Exploitability eXchange - machine-readable statements about whether vulnerabilities are actually exploitable in your context statement applies. T Affected At least one issuer says this vulnerability affects you. F Not Affected At least one issuer says you’re not affected. ⊤ Conflict Multiple issuers disagree. Requires review or higher-authority override. Vendor says “not affected” but your runtime probe saw the function called? Result: Conflict (⊤) — the disagreement is visible, not silently suppressed. No silent suppression. No hidden assumptions. Uncertainty is tracked and surfaced.

Vendors, distributors, and your own security team may all publish VEX?Vulnerability Exploitability eXchange - machine-readable statements about whether vulnerabilities are actually exploitable in your context statements. Stella aggregates them with weighted consensus. Ingest VEX?Vulnerability Exploitability eXchange - machine-readable statements about whether vulnerabilities are actually exploitable in your context from software vendors, Linux distributors, and internal sources Sources are weighted by authority — your internal assessments can override external ones Conflicts trigger review workflows rather than being silently resolved One View of Truth Instead of juggling spreadsheets and emails, get a single authoritative view of which vulnerabilities actually affect your release.