QScanner Release 5.1.0 

July 30, 2026

With the QScanner 5.1.0 release, the following features are offered.

Support for Serverless Lambda Function Scanning

Organizations increasingly rely on serverless architectures but lack a unified security-scanning solution for containerized and serverless workloads. This often leads to security blind spots and inconsistent risk assessments.

QScanner 5.1.0 introduces the function command, enabling security scanning of serverless functions across cloud environments. QScanner automatically detects the serverless function type (ZIP or container image) and performs the appropriate scan.

Currently, QScanner offers its scanning support to AWS Lambda Functions.

Key Benefits

QScanner Serverless function scanning offers the following benefits.

  • Expanded Cloud-Native Security Coverage – Scan AWS Lambda using the same QScanner workflow.
  • Automatic Function Type Detection – Automatically identifies ZIP-based and container image-based functions, simplifying security operations.
  • Consistent Security Posture – Apply the same vulnerability and security assessment practices across containers and serverless workloads.

To know how to configure your Serverless Lambda function scan, refer to Container Security Online Help.
Qualys Enterprise TruRisk™ Platform now includes a new Serverless Functions tab under the Container Security > Assets tab. Each entry represents a discovered serverless function, providing centralized visibility and management of serverless assets. 

Support for Code Scanning

With this release, QScanner introduces the code command, enabling security scanning of source code repositories before they are built and packaged. The command supports scanning both local source code and remote repositories, helping organizations identify vulnerable dependencies early in the software development lifecycle.
Traditional container image scanning identifies security issues after the application has been built. This delays remediation and increases the cost of fixing vulnerable dependencies. Organizations also need visibility into code assets that may not yet be packaged as containers.

Key Benefits

QScanner Code scanning offers the following benefits.

  • Shift-Left Security – Detect vulnerable dependencies during development, before build and deployment.
  • Support for Local and Remote Repositories – Scan source code directly from local workspaces or remote repositories such as GitHub.
  • Improved Traceability – Track findings at the repository, branch, and commit level for better ownership and remediation.
  • Faster Scan Performance – Intelligent asset identification and local caching reduce redundant data collection for previously scanned code assets.

To support code scanning, Qualys Enterprise TruRisk™ Platform now includes a new Code tab under the Container Security > Assets tab. Each entry represents a unique code asset and is identified using an Asset ID generated from:

  • Repository Name
  • Branch
  • Commit Hash

Currently, QScanner does not support the following entities with Serverless Lambda function and Code Scans.
- SBOM generation
- Secret detection
- Policy evaluation

AI Workload Compliance Scanning for Code Assets

While traditional security tools focus on containers, infrastructure, and application vulnerabilities, they provide limited visibility into AI agent implementations. As a result, organizations struggle to assess whether their AI systems comply with governance, security, and regulatory requirements before deployment.

QScanner now supports AI Workload Compliance scanning for code assets. This enhancement evaluates code repositories against AI-specific compliance controls to help organizations identify governance, security, and compliance gaps related to AI workloads.

With this release, QScanner supports the following regulations.

  • EU AI Act
  • PCI DSS 4.0
  • NIST AI RMF

QScanner evaluates AI agents against AI compliance controls, including:

  • Prompt security and prompt injection protections
  • Unsafe model and agent configurations
  • MCP (Model Context Protocol) connection validation
  • AI provider SDK usage (OpenAI, LangChain, Anthropic, and others)
  • Sensitive data exposure to external LLMs
  • Agent architecture governance controls
  • Security and operational best practices

Key Benefits

AI Workload Compliance scanning by QScanner offers the following benefits.

  • Automated AI Compliance Assessment – Eliminate manual reviews by automatically evaluating AI agent code against recognized compliance frameworks.
  • Shift-Left AI Governance – Identify compliance and governance gaps during development before AI applications reach production.
  • Actionable Compliance Insights – Receive detailed PASS, FAIL, and SKIPPED results for each compliance control with remediation guidance.
  • CI/CD Ready Validation – Integrate AI compliance checks directly into development and deployment pipelines.
  • Enterprise-Ready AI Development – Help ensure AI workloads are secure, auditable, and aligned with evolving regulatory expectations.

Compliance Reporting

QScanner provides the following posture-based reporting under Qualys Enterprise TruRisk™ Platform > Container Security > Assets > Code, for every evaluated control:

  • PASS – Control requirements are satisfied.
  • FAIL – A compliance or governance gap has been identified.
  • SKIPPED – Control could not be evaluated through static analysis.

The resulting report enables development, security, and governance teams to understand compliance posture and prioritize remediation activities.

Enhanced Secret Detection

QScanner 5.1.0 introduces multiple enhancements to improve secret detection accuracy, coverage, and usability. Together, these enhancements help organizations identify genuine secrets more effectively while reducing noise from benign matches.

  • New Secret Detector Rules: 29 new secret detector rules are introduced. These new rules support the identification of PII, PCI, and PHI data within container images.
    To know more, refer to Qualys Container Security 1.44 Release Notes > Sensitive Data Detection & DSPM.
  • Validators in secret detection rules: Validators provide an additional verification step after a pattern is matched, helping determine whether the detected value is a valid secret before reporting a finding.
  • New built-in Allow rules to reduce false positives: You can access these new rules using Container Security APIs. These rules help eliminate known benign patterns that commonly trigger false-positive findings.
  • Extended secret scanning to document formats: QScanner can scan and detect secrets in various document formats such as PDF, DOC, DOCX, and HTML. This feature is disabled by default. You can enable it using Update an Allow Rule API. Contact Qualys Support to know more.   

Key Benefits

QScanner 5.1.0 offers the following benefits with the enhanced Secret Detection.

  • Improved Detection Accuracy – Validators provide an additional verification layer to help distinguish valid secrets from pattern matches.
  • Reduced False Positives – Built-in Allow rules automatically filter known benign patterns, reducing unnecessary findings.
  • Expanded Secret Coverage – Detects sensitive information in documents in addition to source code and configuration files.
  • Enhanced Security Visibility – Improves discovery of exposed credentials, tokens, keys, and other sensitive data across application assets and supporting documentation.
  • Faster Triage and Remediation – Reduces investigation effort, allowing teams to focus on genuine security risks.
  • Stronger Compliance and Governance – Helps organizations enforce security policies and prevent inadvertent exposure of sensitive information across their development ecosystem.

CycloneDX Report Format Support

QScanner now supports CycloneDX as a report format using the --report-format cyclonedx command. Previously, SARIF was the only industry-standard report format supported by QScanner and was primarily focused on vulnerability reporting. With this enhancement, you can now generate a single industry-standard report containing both software inventory information and associated vulnerabilities.

Organizations often require standardized reports that can be consumed by security, compliance, governance, and software supply chain tools. While SARIF provides vulnerability information, it does not offer a complete view of software components and dependencies, making it difficult to perform comprehensive software inventory and risk analysis.

Key Benefits

The new CycloneDX report format offers the following benefits.

  • Comprehensive Software Visibility – Generate a single report containing both inventory and vulnerability information.
  • Industry-Standard Compliance – Leverage the CycloneDX format for improved interoperability with security and SBOM ecosystems.
  • Enhanced Risk Analysis – Access vulnerability details, including CVEs, CVSS ratings, remediation guidance, and threat intelligence context.

The generated report follows the naming convention below:
<asset-id>-Report.cdx.json

Command to generate a CycloneDX report:
./qscanner --report-format cyclonedx <command> <target>

Support for Alibaba Cloud Linux OS 

Alibaba Cloud Linux is a Linux server operating system developed and maintained by Alibaba Cloud. It is designed and optimized for Alibaba Cloud infrastructure, including ECS (Elastic Compute Service) instances and cloud-native applications.
QScanner now supports vulnerability and security scanning of images based on Alibaba Cloud Linux OS. With this enhancement, QScanner enables you to leverage QScanner security capabilities for Alibaba Cloud Linux. 

Support for Chisel-based Images

QScanner 5.1.0 introduces support for scanning images built using Chisel manifests. Chisel is commonly used to create minimal Debian/Ubuntu-based container images by extracting only the files required for an application, resulting in smaller and more efficient deployment artifacts.
Traditional vulnerability scanners often rely on package manager metadata, such as dpkg, to identify installed software. However, Chisel-generated images typically do not contain the standard package management database, making software inventory collection and vulnerability assessment challenging.

Key Benefits

  • Expanded Coverage for Minimal Images – Enables security scanning of Chisel-based container images that do not include traditional package manager metadata.
  • Improved Visibility – Accurately identifies software components and dependencies in highly optimized container images.
  • Supports Modern Containerization Practices – Allows organizations adopting minimal and hardened container images to maintain security visibility.
  • Consistent Vulnerability Assessment – Provides the same security assessment capabilities for Chisel-based images as for traditional container images.

Support for Scanning of Locally built Multiarch images using Buildx on Docker v29

Modern applications are increasingly deployed across heterogeneous environments that require support for multiple CPU architectures. Security teams often need to validate each platform-specific image separately, making vulnerability assessment more complex and time-consuming.
With this release, QScanner supports scanning locally built multi-architecture container images created using Docker Buildx on Docker v29 and later. This enhancement enables security assessment of images that contain multiple platform variants (for example, AMD64 and ARM64) within a single image manifest.

Key Benefits

This enhancement offers the following benefits.

  • Improved Multi-Architecture Coverage – Scan locally built multi-architecture images using a single workflow.
  • Earlier Security Validation – Identify vulnerabilities before images are pushed to registries or deployed.
  • Simplified Developer Experience – Eliminate the need to manage separate scan processes for different architectures.
  • Enhanced CI/CD Efficiency – Integrate security checks into Buildx-based container build pipelines without additional steps.

Issue Addressed

The following issue has been fixed with this release.

Category Issue
Data Collection Image scan failed on the image with an inconsistent later history. With this release, QScanner improves scan reliability by supporting container images that contain inconsistent or inaccurate layer history metadata.

When QScanner detects inconsistencies between the image history and the actual image layers, it now displays a warning and continues the scan.

 

© 2026 Qualys, Inc. All rights reserved. Privacy Policy. Last updated: July, 2026