trivy
4 posts · all writing
A misconfiguration has no CVSS, which is why nobody fixes it
A privileged pod and a public bucket have no CVE and no CVSS, so every IaC tool invents a severity and the breach sorts below an unreachable dependency.
Most of your container CVEs aren't yours
Scan a 35-line Python app and get 292 findings. 219 come from the base image, and none are fixable by changing your code. What the actionable move is.
The license nobody gated on: copyleft in your tree
A CVE is embarrassing and fixable. A copyleft obligation you shipped for two years is neither, and you find out during due diligence. How to gate on it.
Describe your app, not your scanners
Teams wire up scanners instead of describing software, and it breaks at scale. One declarative descriptor covers Trivy, Semgrep and Gitleaks at once.