security-scanlisted

# Security Scanning Scan a repository (and its images) for vulnerabilities, misconfigurations, secrets, and license issues. Layers **Trivy** (config: `dot_config/trivy/trivy.yaml` — `HIGH`/`CRITICAL`, `ignore-unfixed`, scanners: vuln/misconfig/secret/license) over **gitleaks** for deep git-history secret detection, complementing the language-native scanners (`govulncheck`, `pip-audit`). ## Workflow 1. **Repository scan** (dependencies, misconfig, secrets, licenses in one pass): ```bash trivy --config trivy.yaml fs . # always pass --config: an exported TRIVY_CONFIG outranks ./trivy.yaml — see Gotchas ``` 1. **Targeted config scan** (Dockerfiles, Kubernetes manifests, Terraform — optional if already done via `trivy fs`): ```bash trivy --config trivy.yaml config . ``` 1. **Secrets in git history** (deeper than a working-tree scan — catches committed-then-deleted secrets): ```bash mise run check:leaks # recent commits (this repo caps at the last 10) mise run check:leaks --staged # pre-commit scope gitleaks git --verbose # full history — the actual audit ``` 1. **Container image scan** (after a build — see [containerize](../containerize/SKILL.md)): ```bash trivy --config trivy.yaml image <registry>/<image>:<tag> ``` 1. **Language-native depth** (already wired into `mise run check` as `check:vuln`): - Go: `go tool govulncheck ./...` - Python: `uv run pip-audit` 1. **Triage**: summarize findings by severity, separa