aggregate by cve

README.md

@@ -19,12 +19,14 @@ host only needs Docker. JSON reports are kept on disk for auditing.
    `/reports/<image>.json`. Optional VEX sources are applied through Trivy's
    `--vex` flag, so findings marked as not affected are filtered out before
    counting and notifying (see [VEX](#vex)).
-2. It counts findings per severity and checks them against two thresholds:
-   - `NOTIFY_MIN_SEVERITY` (default `HIGH`) – when to send an Apprise alert.
+2. Findings are aggregated by CVE across all scanned images. Two thresholds
+   are checked against the aggregate counts:
+   - `NOTIFY_MIN_SEVERITY` (default `HIGH`) – when to send a single Apprise
+     alert.
    - `FAIL_ON` (default `HIGH`) – when the script should exit with code `1`
      (useful for CI).
-3. On a match it sends one notification per image listing the most relevant
-   CVEs, the affected package, the installed version, and the fixed version.
+3. If any CVE reaches `NOTIFY_MIN_SEVERITY`, one notification is sent listing
+   each CVE with the affected packages and the containers/images that use them.
 
 ## Quick start
 
@@ -64,11 +66,11 @@ For the last one the scanner asks the Docker Engine API on the Unix socket for
 `/containers/json` and scans each `Image` reference, de-duplicated and in
 listing order. Stopped containers are not included. The scanner's own container
 image is skipped so a scheduled run does not report on itself; set
-`INCLUDE_SELF=true` to include it. Scan log lines and Apprise notifications name the running container(s)
-that use each image, for example
-`Scanning nginx:1.27 (used by container web)` and
-`Vulnerability scan: nginx:1.27 [container: web]`. Explicitly passed images
-omit the container context.
+`INCLUDE_SELF=true` to include it. Scan logs still name the running container(s) that use each image (e.g.
+`Scanning nginx:1.27 (used by container web)`). Notifications are aggregated
+by CVE after all images are scanned: a single report lists each CVE with the
+containers and images it affects. Scan failures still notify per failed image
+with container context. Explicitly passed images omit container context.
 
 The socket is looked up in this order: