diff --git a/apps/cnquery/cmd/plugin.go b/apps/cnquery/cmd/plugin.go
index ec61406ed1..a689dc7f79 100644
--- a/apps/cnquery/cmd/plugin.go
+++ b/apps/cnquery/cmd/plugin.go
@@ -78,10 +78,21 @@ func (c *cnqueryPlugin) RunQuery(conf *run.RunQueryConfig, runtime *providers.Ru
 		return nil
 	}
 
+	var upstreamConfig *upstream.UpstreamConfig
+	serviceAccount := opts.GetServiceCredential()
+	if serviceAccount != nil {
+		upstreamConfig = &upstream.UpstreamConfig{
+			SpaceMrn:    opts.GetParentMrn(),
+			ApiEndpoint: opts.UpstreamApiEndpoint(),
+			Incognito:   conf.Incognito,
+			Creds:       serviceAccount,
+		}
+	}
+
 	err := runtime.Connect(&pp.ConnectReq{
 		Features: config.Features,
 		Asset:    conf.Inventory.Spec.Assets[0],
-		Upstream: nil,
+		Upstream: upstreamConfig,
 	})
 	if err != nil {
 		return err
@@ -91,17 +102,6 @@ func (c *cnqueryPlugin) RunQuery(conf *run.RunQueryConfig, runtime *providers.Ru
 		out.WriteString("[")
 	}
 
-	var upstreamConfig *upstream.UpstreamConfig
-	serviceAccount := opts.GetServiceCredential()
-	if serviceAccount != nil {
-		upstreamConfig = &upstream.UpstreamConfig{
-			SpaceMrn:    opts.GetParentMrn(),
-			ApiEndpoint: opts.UpstreamApiEndpoint(),
-			Incognito:   true,
-			Creds:       serviceAccount,
-		}
-	}
-
 	// FIXME: workaround for gcp-snapshot
 	// For a gcp-snapshot asset, we start with a GCP connection.
 	// This get's overridden by a filesystem connection. The filesystem connection is what we need for the scan
diff --git a/apps/cnquery/cmd/run.go b/apps/cnquery/cmd/run.go
index 1402ede635..f37984a487 100644
--- a/apps/cnquery/cmd/run.go
+++ b/apps/cnquery/cmd/run.go
@@ -52,6 +52,7 @@ var RunCmdRun = func(cmd *cobra.Command, runtime *providers.Runtime, cliRes *plu
 			Assets: []*inventory.Asset{cliRes.Asset},
 		},
 	}
+	conf.Incognito, _ = cmd.Flags().GetBool("incognito")
 
 	x := cnqueryPlugin{}
 	w := shared.IOWriter{Writer: os.Stdout}
diff --git a/providers/os/resources/platform_advisories.go b/providers/os/resources/platform_advisories.go
index af2f90be7f..4c24e9bcce 100644
--- a/providers/os/resources/platform_advisories.go
+++ b/providers/os/resources/platform_advisories.go
@@ -289,8 +289,8 @@ func (a *mqlPlatformCves) list() ([]interface{}, error) {
 			"state":      llx.StringData(cve.State.String()),
 			"summary":    llx.StringData(cve.Summary),
 			"unscored":   llx.BoolData(cve.Unscored),
-			"published":  llx.TimeData(*published),
-			"modified":   llx.TimeData(*modified),
+			"published":  llx.TimeDataPtr(published),
+			"modified":   llx.TimeDataPtr(modified),
 			"worstScore": llx.ResourceData(cvssScore, "audit.cvss"),
 		})
 		if err != nil {
diff --git a/shared/proto/cnquery.pb.go b/shared/proto/cnquery.pb.go
index 4bad3b9590..369017c19d 100644
--- a/shared/proto/cnquery.pb.go
+++ b/shared/proto/cnquery.pb.go
@@ -38,6 +38,7 @@ type RunQueryConfig struct {
 	DoRecord       bool                 `protobuf:"varint,7,opt,name=do_record,json=doRecord,proto3" json:"do_record,omitempty"`
 	Format         string               `protobuf:"bytes,8,opt,name=format,proto3" json:"format,omitempty"`
 	PlatformId     string               `protobuf:"bytes,9,opt,name=platform_id,json=platformId,proto3" json:"platform_id,omitempty"`
+	Incognito      bool                 `protobuf:"varint,10,opt,name=incognito,proto3" json:"incognito,omitempty"`
 }
 
 func (x *RunQueryConfig) Reset() {
@@ -135,6 +136,13 @@ func (x *RunQueryConfig) GetPlatformId() string {
 	return ""
 }
 
+func (x *RunQueryConfig) GetIncognito() bool {
+	if x != nil {
+		return x.Incognito
+	}
+	return false
+}
+
 type Empty struct {
 	state         protoimpl.MessageState
 	sizeCache     protoimpl.SizeCache
@@ -227,7 +235,7 @@ var file_cnquery_proto_rawDesc = []byte{
 	0x05, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x1a, 0x2a, 0x70, 0x72, 0x6f, 0x76, 0x69, 0x64, 0x65, 0x72,
 	0x73, 0x2d, 0x73, 0x64, 0x6b, 0x2f, 0x76, 0x31, 0x2f, 0x69, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f,
 	0x72, 0x79, 0x2f, 0x69, 0x6e, 0x76, 0x65, 0x6e, 0x74, 0x6f, 0x72, 0x79, 0x2e, 0x70, 0x72, 0x6f,
-	0x74, 0x6f, 0x22, 0xb6, 0x02, 0x0a, 0x0e, 0x52, 0x75, 0x6e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x43,
+	0x74, 0x6f, 0x22, 0xd4, 0x02, 0x0a, 0x0e, 0x52, 0x75, 0x6e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x43,
 	0x6f, 0x6e, 0x66, 0x69, 0x67, 0x12, 0x18, 0x0a, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64,
 	0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x07, 0x63, 0x6f, 0x6d, 0x6d, 0x61, 0x6e, 0x64, 0x12,
 	0x27, 0x0a, 0x0f, 0x63, 0x61, 0x6c, 0x6c, 0x62, 0x61, 0x63, 0x6b, 0x5f, 0x73, 0x65, 0x72, 0x76,
@@ -246,20 +254,21 @@ var file_cnquery_proto_rawDesc = []byte{
 	0x72, 0x64, 0x12, 0x16, 0x0a, 0x06, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x18, 0x08, 0x20, 0x01,
 	0x28, 0x09, 0x52, 0x06, 0x66, 0x6f, 0x72, 0x6d, 0x61, 0x74, 0x12, 0x1f, 0x0a, 0x0b, 0x70, 0x6c,
 	0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x5f, 0x69, 0x64, 0x18, 0x09, 0x20, 0x01, 0x28, 0x09, 0x52,
-	0x0a, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x49, 0x64, 0x22, 0x07, 0x0a, 0x05, 0x45,
-	0x6d, 0x70, 0x74, 0x79, 0x22, 0x1c, 0x0a, 0x06, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x12, 0x12,
-	0x0a, 0x04, 0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x64, 0x61,
-	0x74, 0x61, 0x32, 0x3a, 0x0a, 0x07, 0x43, 0x4e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x2f, 0x0a,
-	0x08, 0x52, 0x75, 0x6e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x2e, 0x52, 0x75, 0x6e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67,
-	0x1a, 0x0c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x32, 0x34,
-	0x0a, 0x0c, 0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x48, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x12, 0x24,
-	0x0a, 0x05, 0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x0d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
-	0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x1a, 0x0c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45,
-	0x6d, 0x70, 0x74, 0x79, 0x42, 0x24, 0x5a, 0x22, 0x67, 0x6f, 0x2e, 0x6d, 0x6f, 0x6e, 0x64, 0x6f,
-	0x6f, 0x2e, 0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6e, 0x71, 0x75, 0x65, 0x72, 0x79, 0x2f, 0x73, 0x68,
-	0x61, 0x72, 0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74,
-	0x6f, 0x33,
+	0x0a, 0x70, 0x6c, 0x61, 0x74, 0x66, 0x6f, 0x72, 0x6d, 0x49, 0x64, 0x12, 0x1c, 0x0a, 0x09, 0x69,
+	0x6e, 0x63, 0x6f, 0x67, 0x6e, 0x69, 0x74, 0x6f, 0x18, 0x0a, 0x20, 0x01, 0x28, 0x08, 0x52, 0x09,
+	0x69, 0x6e, 0x63, 0x6f, 0x67, 0x6e, 0x69, 0x74, 0x6f, 0x22, 0x07, 0x0a, 0x05, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x22, 0x1c, 0x0a, 0x06, 0x53, 0x74, 0x72, 0x69, 0x6e, 0x67, 0x12, 0x12, 0x0a, 0x04,
+	0x64, 0x61, 0x74, 0x61, 0x18, 0x01, 0x20, 0x01, 0x28, 0x09, 0x52, 0x04, 0x64, 0x61, 0x74, 0x61,
+	0x32, 0x3a, 0x0a, 0x07, 0x43, 0x4e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x2f, 0x0a, 0x08, 0x52,
+	0x75, 0x6e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x12, 0x15, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e,
+	0x52, 0x75, 0x6e, 0x51, 0x75, 0x65, 0x72, 0x79, 0x43, 0x6f, 0x6e, 0x66, 0x69, 0x67, 0x1a, 0x0c,
+	0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45, 0x6d, 0x70, 0x74, 0x79, 0x32, 0x34, 0x0a, 0x0c,
+	0x4f, 0x75, 0x74, 0x70, 0x75, 0x74, 0x48, 0x65, 0x6c, 0x70, 0x65, 0x72, 0x12, 0x24, 0x0a, 0x05,
+	0x57, 0x72, 0x69, 0x74, 0x65, 0x12, 0x0d, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x53, 0x74,
+	0x72, 0x69, 0x6e, 0x67, 0x1a, 0x0c, 0x2e, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x2e, 0x45, 0x6d, 0x70,
+	0x74, 0x79, 0x42, 0x24, 0x5a, 0x22, 0x67, 0x6f, 0x2e, 0x6d, 0x6f, 0x6e, 0x64, 0x6f, 0x6f, 0x2e,
+	0x63, 0x6f, 0x6d, 0x2f, 0x63, 0x6e, 0x71, 0x75, 0x65, 0x72, 0x79, 0x2f, 0x73, 0x68, 0x61, 0x72,
+	0x65, 0x64, 0x2f, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x62, 0x06, 0x70, 0x72, 0x6f, 0x74, 0x6f, 0x33,
 }
 
 var (
diff --git a/shared/proto/cnquery.proto b/shared/proto/cnquery.proto
index 1438429f85..7b8ba11727 100644
--- a/shared/proto/cnquery.proto
+++ b/shared/proto/cnquery.proto
@@ -19,6 +19,7 @@ message RunQueryConfig {
   bool do_record = 7;
   string format = 8;
   string platform_id = 9;
+  bool incognito = 10;
 }
 
 message Empty {}