Security
SAST, secret detection and container scanning run on every change. Every open finding gets a decision made by code; a new high or critical finding blocks the merge (Gatekeeper rule 8).
Open findings167on main, all three scanners
Real0none in the code we ship
In the base image164system packages, no fix available yet
Last checked27 Oct 12:55UTC, by the Live Patrol
Decisions
Vulnerability report ↗| Count | Decision | Meaning |
|---|---|---|
| 0 | real | High or critical, in code we ship: becomes a fix issue that Vallum builds. |
| 0 | accepted | Looked at and accepted, with the reason recorded in the Ledger. |
| 164 | image | In the base image's system packages, with no fixed version available yet. |
| 2 | not shipped | In tests or tooling that never reaches the running app. |
| 1 | fixed on main | Already fixed on main; it closes on the next scan. |
Scanners
run on every change- SAST
Reads the code for security bugs without running it. - Secret detection
Looks for passwords or keys committed by mistake. - Container scanning
Checks the image's packages for known vulnerabilities; step 0 judges it before any visitor.