When we scan container images for vulnerabilities earlier in the pipeline (before the image is pushed to Harness Artifact Registry), that scan data is lost on push. HAR's built-in scanner has to rescan from scratch to populate the "Vulnerabilities" tab on the artifact version, duplicating work we've already done and losing the original scan context (timing, tool, findings).

Request: an API or pipeline step that lets us post externally generated scan results directly into the Vulnerabilities section of a specific artifact version in HAR, rather than requiring HAR's own scanner to be the only source of that data.

• We already run security scans as part of our pipeline (before the container reaches the registry) and want that data to persist, not be discarded

• We also periodically rescan stored containers for newly disclosed CVEs, so ideally this would support posting updated/incremental results to an existing artifact version over time, not just a one-time import at push

• Reduces redundant scanning cost/time and gives us one consistent vulnerability view per artifact regardless of which scanner produced the data