You push a new container image Thursday afternoon. Tests pass, the PR is approved, the pipeline goes green. You close your laptop feeling good about the week.

Friday morning, a Slack message from the security team is waiting: the release is blocked. There’s a critical CVE in a base image you …

It’s 4:45 on a Friday. You’re wrapping up a Dockerized microservice, testing a database connection string against a local instance before you push. The commit message is wip: db config. You type it fast, you’re thinking about the weekend, and you don’t notice that the …

You spend Tuesday afternoon running a vulnerability scan against your app’s container image. Zero critical CVEs, two mediums with patches already queued up. You feel good enough about it to merge the PR and let the pipeline ship it to production. Thursday morning, someone on the platform team …

Your pipeline is green. The Docker build finished in ninety seconds, docker push sent the new tag to your registry without a hiccup, and the deployment rolled out before your coffee got cold. Three weeks later, a message lands in the security channel: acme/api:2.4.1 has 45 known vulnerabilities, …

You wire Trivy into the pipeline on a Friday afternoon, feeling pretty good about yourself. Monday morning the first scan lands: 450 vulnerabilities. Twelve critical, sixty-one high, the rest a wall of yellow and blue you don’t have the patience to read. You post the report in the team …

You just wired Trivy into your pipeline. First real scan, on a Node.js API that does nothing more exotic than call three internal REST endpoints and write to Postgres. The output comes back: 43 CVEs. You brace for the worst and start reading through them, and here’s the thing — your …