You push a new container image Thursday afternoon. Tests pass, the PR is approved, the pipeline goes green. You close your laptop feeling good about the week.

Friday morning, a Slack message from the security team is waiting: the release is blocked. There’s a critical CVE in a base image you …

It’s 4:45 on a Friday. You’re wrapping up a Dockerized microservice, testing a database connection string against a local instance before you push. The commit message is wip: db config. You type it fast, you’re thinking about the weekend, and you don’t notice that the …