First Seen
Feb 18, 2026
Last Scanned
Feb 20, 2026
Findings
3
Score
100/100
Findings (3)
Detects Docker or docker-compose commands passing credentials via environment variables
environment:
- DB_PASSWORD_FILE=Remove credential values from Docker environment flags (-e) and docker-compose environment sections. Use Docker secrets, .env files (in .dockerignore), or a secrets manager.
Likely FP if the Docker environment variable has an empty or placeholder value (e.g., -e API_KEY= or -e PASSWORD=changeme) in setup documentation.
Detects system-level package installation via brew, apt, yum, or dnf
apt-get install -y pPin system packages to specific versions where the package manager supports it. Document the exact packages required and prefer containerized environments to avoid system-wide changes.
Likely FP if the match is standard setup documentation listing well-known system packages (e.g., apt install git curl) that are prerequisites.
Detects pulling and running Docker images from external registries
docker pull imagePin Docker images to a specific digest (e.g., image@sha256:abc...) instead of using mutable tags like :latest. Use trusted base images from verified publishers.
Likely FP if the Docker command pulls a well-known official image (e.g., docker pull python:3.11) in setup documentation.