Feature Proposal: Make it possible to communicate vulnerable user accounts, insecure passwords and hashing algorithms

In the age of Docker, Kubernetes and other solutions that allow virtualizations, these solutions often come with preinstalled software, libraries and more importantly - preconfigured user accounts with default passwords.

In think what's missing from the Bill of Vulnerabilities use case are the following things:

- which running service has a separate user account (`postgres`? `mysql` user? service running as `root`?)
- which user accounts can be abused for potential logins (does root have a password? does the account have a shell instead of `/usr/bin/nologin`?)
- which user password hash algorithm is used for `/etc/shadow` (`DES`? `MD5`? `MD6`? `SHA1`?)
- which user accounts have known default passwords (`mysql:mysql`, `postgres:postgres`, remember the [MongoDB hack](https://snyk.io/blog/mongodb-hack-and-secure-defaults/)? )
- which user accounts have compromised passwords (`haveibeenpwned`, `Breach Compilation`, `Collection #1` etc)