formatting

README.md

@@ -26,13 +26,14 @@ host only needs Docker. JSON reports are kept on disk for auditing.
    - `FAIL_ON` (default `HIGH`) – when the script should exit with code `1`
      (useful for CI).
 3. Notifications are sent. When `IMPORTANT_CONTAINERS` is set, each named
-   container gets its own complete CVE list (showing `C X/Y ...` where X is
-   fixable and Y is total per severity, plus `Total: fixable/total`), even if
-   there are no CVEs at or above `NOTIFY_MIN_SEVERITY`. Missing important
-   containers are reported, and every other container is summarised in chunks
-   as `fixable/total`. Without `IMPORTANT_CONTAINERS`, a single aggregated
-   notification lists each CVE with the affected packages, containers, and
-   images.
+   container gets its own complete CVE list plus a fenced monospaced table of
+   image/container severity counts (`C`, `H`, `M`, `L`), even if there are no
+   CVEs at or above `NOTIFY_MIN_SEVERITY`. Missing important containers are
+   reported, every other container is summarised in chunks using the same
+   table, and one final notification lists the important packages plus the
+   overall totals. Columns below `NOTIFY_MIN_SEVERITY` are omitted. Without
+   `IMPORTANT_CONTAINERS`, a single aggregated notification lists each CVE with
+   the affected packages, containers, and images.
 
 ## Quick start
 
@@ -255,17 +256,26 @@ leave `IMAGES` empty unless you also want to scan specific images explicitly.
 IMPORTANT_CONTAINERS=traefik web-frontend
 ```
 
-When the list is set, notifications are split into three groups:
+When the list is set, notifications are split into four groups:
 
 1. **One notification per important container**, titled
    `Vulnerability scan: <container> (<image>)`. It lists every CVE at or above
-   `NOTIFY_MIN_SEVERITY` with `C X/Y H X/Y M X/Y L X/Y` and `Total: fixable/total`.
+   `NOTIFY_MIN_SEVERITY`, with the image/container and severity counts shown in
+   a fenced monospaced table (`Image`, `Container`, `C`, `H`, `M`, `L`).
    A notification is still sent if there are none, showing totals at 0/0.
 2. **One notification for important containers that are missing** – either not
    running, or running an image that was not part of the scan.
 3. **One summary notification for every other container**, split every ~12
-   containers (with per-part and overall totals), listing image/container and
-   `fixable/total`.
+   containers, showing the same fenced table of image/container and
+   `fixable/total` severity counts.
+4. **One final summary notification** listing the important containers in the
+   same table, their packages, followed by the overall severity counts and
+   `fixable/total in N container(s)`.
+
+Severity columns below `NOTIFY_MIN_SEVERITY` are omitted from the tables (for
+example, only `C` and `H` are shown when it is `HIGH`). Image digests are
+shortened to their first six characters in notification text; report filenames
+keep the full reference.
 
 A container can appear in only the important list or the summary, never both.
 If an important container shares its image with other containers, the others