Who ships the most grade-A products, across the broadest active catalog. One grade per (publisher × project) product;
scope limited to projects with at least one image pushed in the last 60 days. The 48h grace keeps a
fresh push from being docked for a CVE that landed in the last two days.
v2 (current): the product's grade is the best variant in the window. Rank = (3·A + B − 0.5·F) ÷ products_60d × ln(1 + products_60d).
Grade bands:
A ≥ 85 B ≥ 70 C ≥ 55 D ≥ 40 F < 40
· full rubric →
· methodology + changelog →
What we actually scan: only images pushed within the last 8 weeks. Older tags are deliberately out of scope — we don't grade abandoned images, and we don't let a single publisher's thousand-tag history consume the whole scan budget while other publishers' fresh images wait. Right now that's 1,668 eligible, 1,430 out of scope.
Scan priority inside the window: freshest first, with namespace round-robin inside each 1-week age bucket. Week-1 images from every publisher get scanned before any week-2 image anywhere; within week 1, every namespace gets interleaved slots so no one owns the queue.
Grades exclude the unscanned. Every rank, trust_score, avg, and grade distribution on this page is computed over scanned images only. Publishers below 3 scanned images get a small informational chip so you can judge sample size, but they still compete on the ranked table.
Why so many publishers show 0 or very few scans: we enumerated 3,098 total images; 1,668 are eligible under the 8-week rule, 1,162 are scored so far. Each scan is 15–30s (syft + grype + skopeo + cosign), parallelism capped at 2 workers on a 4 GB droplet, syft fails ~10–15 % of attempts. Effective rate: ~120 scans/hour. The backlog clears in a weekend, not a day.
Who runs the scans: we do. Skopeo pulls the bytes, syft extracts an SBOM, grype matches it against the fresh Anchore vulnerability database on our droplet, cosign verifies signatures. We don't trust Docker Scout's grades, vendor self-reports, or third-party scanners.
Every scan is downloadable. Click any image ref to open its page: every scan we've run with timestamps + Grype DB vintage, the per-signal rubric breakdown, and the raw grype JSON. Nothing you see on ce.rodeo is derived from a value we don't also hand you unchanged.
Cadence: hourly re-match against the latest Grype DB · every 4h a fresh Grype pull from Anchore · daily 05:00 UTC a backlog walk fresh-first with namespace round-robin · Sundays 04:00 UTC a sanity sweep that re-pulls every eligible image from scratch. Full story at /about; per-signal rubric at /about/grades.