See what's exposed.
Trace what it can reach.
Subimage (from the team behind Cartography) is an open-core security graph, investigation tool, and CNAPP for your infrastructure.
super-spider BETA
This is an interactive demo. Pause and explore!
used in production at:
Built for security engineers.
Security Investigation
Ask complex questions that static rules can't cover, and explore the evidence yourself.
Vulnerability Management
Detect, auto-triage, and fix vulnerabilities in your codebase, in built images, and at runtime.
Action Items 23
Vulnerable Packages 86
CVEs 152
Search action items...
Action
Severity
Affected Images
Update amazoncorretto:21 to fix 11
CVEs across 4
packages.
2C 3H 6M
6
Update node:22-alpine to fix 14
CVEs across 3
packages.
base image
1C 4H 9M
28
Update nginx:1.27-alpine to fix 8
CVEs across 2
packages.
1C 2H 5M
22
Update python:3.12-slim to fix 9
CVEs across 2
packages.
2H 5M 2L
16
Update ruby:3.3-slim to fix 7
CVEs across 2
packages.
2H 4M 1L
4
Update golang:1.23 to fix 6
CVEs across 1
package.
1H 3M 2L
11
Update postgres:16-alpine to fix 5
CVEs across 1
package.
base image
1H 2M 2L
7
Update redis:7.4 to fix 4
CVEs across 1
package.
3M 1L
9
Search vulnerabilities...
Package
CVEs
Installed version(s)
Fixed version(s)
Severity
xz
internet-exposed
5
5.6.1-r1
5.6.1-r2
1C 2M 2L
lodash
internet-exposed
affects 2 base images
3
4.17.154.17.20
4.17.21
2H 1M
minimist
internet-exposed
2
1.2.50.2.3
1.2.60.2.4
2H
zlib
2
1.3.1-r0
1.3.1-r1
1H 1M
cross-spawn
affects 6 base images
4
7.0.4
7.0.5
1H 3L
aiohttp
1
3.10.10
3.10.11
1H
PyJWT
1
2.10.02.10.12.11.0
2.12.0
1H
rack
internet-exposed
1
2.2.83.0.9
2.2.8.13.0.9.1
1H
rdoc
1
6.6.36.5.1
6.6.3.16.5.1.1 +2 more
1H
urllib3
1
2.2.11.26.18
2.2.21.26.19
1M
requests
1
2.31.0
2.32.0
1M
rexml
1
3.3.8
3.3.9
1M
perl-module-scandeps
1
1.36-r0
1.37-r0
1M
Search CVEs...
CVE ID
Severity
EPSS
Title
Published
CVE-2024-3094
KEV
CRITICAL
CVSS 8.3
N/A
malicious code in upstream release tarballs
xz
unknown
CVE-2021-23337
HIGH
CVSS N/A
N/A
command injection via template
lodash
unknown
CVE-2021-44906
HIGH
CVSS N/A
N/A
prototype pollution
minimist
unknown
CVE-2022-37434
HIGH
CVSS N/A
N/A
heap-based buffer over-read
zlib
unknown
CVE-2024-21538
HIGH
CVSS N/A
N/A
regular expression denial of service
cross-spawn
unknown
CVE-2024-37891
MEDIUM
CVSS N/A
N/A
proxy-authorization request header leak
urllib3
unknown
CVE-2024-35195
MEDIUM
CVSS N/A
N/A
credential leak on redirect
requests
unknown
Attack Paths
A deterministic engine that maps every route from the internet to your assets. Built for red and blue teams.
Internet Exposure
Load balancer
goodenough-lb-3331738.us-east-1.elb.amazonaws.com +10 exposes container
goodenough-frontend +50 to the internet
Vulnerability Exploitation
Vulnerability
CVE-2026-29786 +18 in the image of container
goodenough-frontend +4 can be exploited to gain code execution
Identity Usage
Task definition
goodenough-frontend +4 grants IAM role
goodenough-readonly +4 to any code executing in the container
Exfiltration
IAM role
goodenough-readonly +4 can write data to S3 bucket goodenough-prod-storage +5 in goodenoughlabs-prod +5
Identity & Access
Follow any user or service account across chained trust boundaries.
alex
Agents & MCP
Bring the graph to your own tools and workflows.
Connect via MCP
$
claude mcp add subimage https://demo.subimage.io/mcp
codex mcp add subimage --url https://demo.subimage.io/mcp
curl https://demo.subimage.io/mcp
Ingest constantly.
Subimage scans hourly and uses read-only access to pull data across cloud resources, identities, code, devices, and more.
Read-only access
You provision and own the role that ingests your data.
Bring your own data
Missing an integration? Extend the graph with declarative schemas. We're built on
Cartography, so there's no vendor lock-in.
Deploy on your terms
Stay in your environment. We support on-prem or cloud deployments.
Connect and investigate.
What we collect lands in one graph for analysis. A host, an identity, and a repository stay linked, so you can inspect relationships instead of reconciling tools.
Query it yourself
The graph is open to your team, not locked inside a report.
First-class visualization
Powered by a best-in-category graph traversal engine and explorer.
Issues you can act on
Our scanners identify real issues and take them as far as you ask: a
contextualized report, a remediation plan, a ticket to the owner, or the
pull request.
Operationalize.
We scan for issues, auto-prioritize them, and deliver tickets, reports, and suggested fixes to the workflows you already use.
Sources stay attached
Validate raw data and see how findings were derived.
Built for agents
Plug in your clanker of choice.
Flexible integrations & open APIs
Query directly, or connect with MCP, and automate your workflows.
Security on a platter.
Subimage delivers issues, tickets, and pull requests. You dive in when you want to.
Prioritized issues
Every security finding kicks off both our attack path engine and our triage agent in
parallel, so you get the best of both deterministic and agentic reasoning.
Triage Analyst
Investigates and scores issues
N2 Analyst
Updates issues on new context
Attack Path Engine
Deterministic blast radius
Tickets assigned to the right person
Subimage uses hints such as commit history, CODEOWNERS, and org charts to make the best
guess about who should be assigned to the ticket.
Linear
Auto-route tickets and ownership
Jira
Auto-route tickets and ownership
Slack
Auto-route notifications
Webhooks
Custom integration
MCP
Agentic integration
Remediation and auto-close
We deliver context, generate action items, and can automatically open pull requests.
Issues auto-close when the underlying signals resolve.
Investigation Agent
Creates pull requests
Action Items
Report built from static analysis