# Scan container images

Container scanning finds vulnerabilities and secrets in images that you build on Northflank. Enable scanning on a build or combined service to scan each new image before upload to the build registry.

### Requirements

- A build that uses a Dockerfile or buildpacks.

- Permission to update the service's build configuration. To read reports and software bills of materials, you also need the project permission Projects → Security → View Container Scan Reports.

### Enable scanning

> [!warning] Scan failures stop the build
>
> If the scan fails, the build fails before the image uploads to the build registry. A completed scan can still report vulnerabilities. Review the findings before deploying the image.

Scanning applies to new builds only.

1. Open your build or combined service.

2. Under the Build heading, select Build options.

3. Enable Scan image before upload.

4. Select Update build options.

5. [Start a new build](build-code-from-a-git-repository#manually-trigger-a-build), or wait for your next automatic build.

You can also enable Scan image before upload in Build options when you [create the service](build-code-from-a-git-repository#build-from-a-repository).

### Read scan results

1. Open Builds under the service's Build heading.

2. Select the build that you want to inspect.

3. Open Scan results.

Wait for the scan to complete and the report to become available. The report lists vulnerabilities and detected secrets, with severity counts. Use the findings to identify affected packages and review available fixes.

If the scan fails, read the error in Scan results and open the build's Logs tab for details. After resolving the error, start a new build to scan again.

### View the software bill of materials

A software bill of materials (SBOM) lists packages, versions, and licenses for the latest deployment. Use it to search for a dependency.

The deployed Northflank build must have completed scan results with package information. Open the deployment or combined service. Under Configure, expand More and select SBOM.