docs: added screenshots and updated README and trust-page.md with image links (#27)

Co-authored-by: tcpninja <cnciso@proton.me>

Author: karlllewis

README.md

@@ -118,9 +118,13 @@ git commit -m "test: add fake token (should fail)"
 
 - **Vulnerabilities & IaC Findings:**
   Found under [Security → Code scanning alerts](../../security/code-scanning) in the GitHub UI.
+  All pushes are scanned in CI/CD:
+  ![GitHub Actions workflow passing with SBOM artifact](docs/screenshots/gh-actions-passing.jpg)
 
 - **SBOM (Software Bill of Materials):**
   Downloadable artifact (`sbom-spdx`) from the workflow run.
+  Each build publishes an SPDX SBOM Artifact:
+  ![SBOM artifact download in GitHub Actions](docs/screenshots/sbom-artifacts.jpg)
 
 - **Executive Summary:**
   `security-summary.md` artifact includes counts of HIGH/CRITICAL issues and SBOM status.
@@ -136,6 +140,8 @@ make scan   # Vulnerability + IaC scan
 make sbom   # SBOM generation (SPDX JSON)
 ```
 
+![Make Scan from local terminal](docs/screenshots/local-make-scan.jpg)
+
 ---
 
 ## Secure Examples
@@ -179,19 +185,20 @@ For executive stakeholders and security reviewers, we maintain a concise
 - Policy exception workflow
 - Security contact information
 
-- **Compliance mapping:** see [docs/compliance-mapping.md](./docs/compliance-mapping.md)
-- **Architecture overview:** see [docs/architecture.md](./docs/architecture.md)
+**Compliance mapping:** see [docs/compliance-mapping.md](./docs/compliance-mapping.md)
+**Architecture overview:** see [docs/architecture.md](./docs/architecture.md)
 
 ---
 
 ## Roadmap
 
-- [x] Repo scaffolded
-- [x] Pre-commit (Gitleaks)
-- [x] CI: Trivy vuln + SBOM
-- [x] Makefile for local parity
-- [x] Secure examples in repo; failing demo via permanent tag
-- [x] OpenSSF Scorecard (workflow)
-- [x] Compliance mapping & trust artifacts in README
-- [ ] “How to download SBOM” screenshots (docs/screenshots)
-- [ ] Policy-as-code (Kyverno) in v2
+**Completed (v1 baseline):**
+Scaffold, Gitleaks pre-commit, Trivy CI + SBOM, Makefile, Basic secure/insecure examples, OpenSSF Scorecard, compliance mapping & trust artifacts, initial screenshots.
+
+**Planned Enhancements:**
+- [ ] Automate Trust Badge updates (CI → shields.io)
+- [ ] Add IAM/Multicloud examples (secure vs insecure)
+- [ ] Expand pre-commit hooks (IaC lint, markdownlint)
+- [ ] Exec-friendly “Trust” page polish (auto-fill scan date)
+- [ ] More real-world IaC examples (Kubernetes, Terraform modules)
+- [ ] Demo video / GIF for Quickstart

docs/screenshots/gh-actions-passing.jpg

@@ -2,15 +2,19 @@
 
 **Last CI security scan:** ![Security Workflow](https://github.com/cloudnativeciso/secure-by-default-starter/actions/workflows/security.yml/badge.svg)
 **Latest SBOM artifact:** Available via **GitHub Actions → latest run → Artifacts → `sbom-spdx`**
+![Screenshot of SBOM artifact in GitHub Actions](../docs/screenshots/sbom-artifacts.jpg)
+
 **Guardrails in place:**
 - Secrets scanning (pre-commit Gitleaks)
 - CI vulnerability & IaC scanning (Trivy, fails on HIGH/CRITICAL)
 - SPDX SBOM generated for every run
 - OpenSSF Scorecard for secure SDLC hygiene
+![Screenshot of GitHub Actions security checks](../docs/screenshots/gh-actions-passing.jpg)
 
 **Policy exception process:**
 Tracked via GitHub Issues → **Security Exception Request** form
 (see `.github/ISSUE_TEMPLATE/security-exception.yml`)
+![Screenshot of Policy Exception Process](../docs/screenshots/policy-exception.jpg)
 
 **Contact:** [security@cloudnativeciso.com](mailto:security@cloudnativeciso.com)