Current Status

Jump to bottom

dev-mondoshawan edited this page May 18, 2026 · 1 revision

Current Status

Last updated: 2026-05-18

Platform

Core scan workflow and report generation are stable.
Docker runtime is hardened with a multi-stage image and reduced runtime footprint.
Container scanning policy now blocks non-base critical/high findings in CI.

Security Notes

Remaining container CVEs are currently inherited from base image supply chain packages.
Base-image policy and review cadence are documented in docs/SECURITY_CONTAINER_ALLOWLIST.md in the main repo.
Medusa is intentionally treated as optional in runtime containers until upstream dependency risk is resolved.

CI Guardrail Requirements

GitHub Actions billing/spend limit must be active.
Repository secrets must be configured:
- SNYK_TOKEN
- SNYK_ORG

Immediate Next Action

After billing and secrets are in place, run Counterscarp Security Audit on main and confirm:

tests and lint jobs execute,
container guardrail runs and enforces policy,
advisory scan artifact uploads successfully.