more changes

README.md

@@ -25,12 +25,13 @@ host only needs Docker. JSON reports are kept on disk for auditing.
      alert.
    - `FAIL_ON` (default `HIGH`) – when the script should exit with code `1`
      (useful for CI).
-3. If any CVE reaches `NOTIFY_MIN_SEVERITY`, notifications are sent. When
-   `IMPORTANT_CONTAINERS` is set, each named container gets its own complete
-   CVE list (split into fixable and unfixable), missing important containers
-   are reported, and every other container is summarised in one notification.
-   Without `IMPORTANT_CONTAINERS`, a single aggregated notification lists each
-   CVE with the affected packages, containers, and images.
+3. Notifications are sent. When `IMPORTANT_CONTAINERS` is set, each named
+   container gets its own complete CVE list (showing `C X/Y ...` where X is
+   fixable and Y is total per severity, plus `Total: fixable/total`), missing
+   important containers are reported, and every other container is summarised as
+   `fixable/total`. Without `IMPORTANT_CONTAINERS`, a single aggregated
+   notification lists each CVE with the affected packages, containers, and
+   images.
 
 ## Quick start