The container and the application are scanned by Microsoft during the release to Azure Marketplace. You can also scan the container by using Azure Security Center and enable Container Scans. Typically the base container is updated once a month.