security-scan-trivy

Run Trivy against your filesystem, container image, or repository, then review the report starting with Critical and High severity findings. Lower severities can be addressed after the top risks are remediated or formally accepted.

Address Critical and High severity vulnerabilities first, since they carry the greatest exploit risk. Medium and Low findings can be scheduled later or accepted with documented justification.

Record each accepted vulnerability as an explicit exception that includes the reason for acceptance and an expiration deadline. This keeps risk decisions auditable and ensures exceptions are revisited rather than forgotten.

Introduce Trivy in stages: first run it in warning-only mode so teams can see findings without breaking builds, then switch to failing the pipeline once the baseline is clean. This avoids disrupting delivery during adoption.

Fail the build only after the warning phase has stabilized and existing Critical and High findings are resolved or formally excepted. Failing immediately on first rollout typically causes alert fatigue and workarounds.