trivy
4 posts · all writing
A misconfiguration has no CVSS, which is why nobody fixes it
A privileged pod and a public S3 bucket have no CVE, no CVSS score and no NVD entry, so every IaC tool invents its own severity, and findings that would be a breach get sorted below dependency CVEs that are unreachable. Why misconfiguration findings get ignored, and what to rank them by instead.
Most of your container CVEs aren't yours: base images and what to do about them
Scan a 35-line Python app and you get 292 findings. 219 of them, three quarters, come from the base image, and not one is fixable by changing your code. Why container scanning produces so much noise, what the actionable move actually is, and how VEX and reachability change the arithmetic.
The license nobody gated on: copyleft in your dependency tree
A CVE is embarrassing and fixable. A copyleft obligation you have been shipping for two years is neither, and you find out during due diligence. How to gate a build on license policy with Trivy or Mend, why permissive licenses should not be findings, and why this belongs on a different threshold from your CVEs.
Describe your app, not your scanners: one config for Trivy, Semgrep and Gitleaks
Security tooling breaks down at scale because teams wire up scanners instead of describing software. A declarative descriptor flips the model, and fixes the noise, the toil, and the cost.