You just wired Trivy into your pipeline. First real scan, on a Node.js API that does nothing more exotic than call three internal REST endpoints and write to Postgres. The output comes back: 43 CVEs. You brace for the worst and start reading through them, and here’s the thing — your …