Unfortunately using dpkg and yum to detect installed software means this isn&#x27;t a secure audit. Anyone can add known bad binaries after the fact and pretend to provide a &quot;secure&quot; base image.  I&#x27;d be skeptical of trusting anything quay.io says is secure based on this scan.