sca
3 posts · all writing
Most of your container CVEs aren't yours: base images and what to do about them
Scan a 35-line Python app and you get 292 findings. 219 of them, three quarters, come from the base image, and not one is fixable by changing your code. Why container scanning produces so much noise, what the actionable move actually is, and how VEX and reachability change the arithmetic.
You don't need twelve scanners, you need to know which four apply
Security tooling is usually adopted in one of two ways: nothing, or everything at once. Both fail for the same reason. Nobody decided which controls the thing you actually build requires. A short way to work that out from what your software is made of.
Scan any repo for vulnerabilities with zero config
Most security tools make you write config before you get a single result. Draugr scans a repo with no descriptor at all: draugr scan . runs SAST, SCA, secret and IaC checks over your code and ranks what it finds. Nothing to write first.