See what's exposed.
Trace what it can reach.

This caption describes the interactive product demo on the page: a security engineer works in the Subimage graph explorer next to its AI agent. The engineer asks whether demo.subimage.io fronts a running container, and the agent draws the path from that hostname through the load balancer to the running containers, their images, and the GitHub repository that built them. The engineer also works the graph directly: selecting the demo-backend container opens its properties, showing that it is running, exposed to the internet through the load balancer, and which image digest it runs. Asked what the backend's task role can reach, the agent adds the role, the two secrets it can read, and the orders database and production bucket it can write. The engineer expands the demo/api secret's tags onto the canvas and selects the Environment=prod tag to inspect it. The finding becomes an issue with a triage rationale, is routed to the infrastructure team as a Linear ticket, and the agent opens a pull request that refreshes the container's pinned base image.