Phase: Vulnerability Scanning

phase-pal-e-platform-vuln-scanning Phase

phase

Project

Plan Stub: Vulnerability Scanning

Status: Stub. Not yet a full plan. Created to track a maturity matrix gap. Promote to full plan when prioritized.

DORA Target: CFR (Change Failure Rate) — catch vulnerable dependencies and images before they reach production.

Scope

Add container image scanning and dependency scanning to the CI pipeline and container registry.

Enable Trivy scanner in Harbor (built-in, just needs activation)
Add Trivy scan step to Woodpecker pipelines (fail build on critical/high CVEs)
Configure scan-on-push for Harbor projects
Establish vulnerability SLA (critical: 24h, high: 7d, medium: 30d)

Dependencies

None — Harbor Trivy is built-in. Woodpecker pipeline changes are independent.

Maturity Matrix Rows

Networking & Security: "Vulnerability scanning" + Service Deployment: "Container registry scanning"

dora-framework — CFR improvement
platform-maturity-matrix — two rows in Needs Plan