projects · security-scanner
The platform audits itself.
A home lab accretes containers, dependencies, and config faster than any human reviews them. security-scanner turns that review into a scheduled job: every week it scans every image, repo, and the host itself, then renders the findings as a dashboard with a trend line — so security posture is a number that moves, not a feeling.
The product
Findings, triaged by trend
The severity tiles answer "how bad is now"; the fourteen-scan trend answers the better question — "which direction are we heading, and what caused that spike?"
- ScannersTrivy (containers & dependencies) · Gitleaks (secrets) · Dockle (image hygiene) · Lynis (host) · GitHub security alerts, aggregated into one store
- StackPython + server-rendered templates — a report is a document, not an app; the lightest tool that does the job
- CadenceWeekly full sweep on a scheduler, with findings triaged against a known false-positive list
Lessons
What it taught the platform
Bursty ≠ broken
A scanner that pegs the CPU once a week is healthy; a quiet service that averages two cores is not. Telling those apart properly produced the lifetime-average measurement in the monitoring pattern.
False positives need a ledger
An unexplained red tile gets ignored within a month. Every accepted finding carries a written reason, so the dashboard stays credible enough to act on.
Scanning your own stack is humbling
The first full sweep of any honest fleet finds four digits of findings. The discipline isn't zero — it's knowing which seventeen actually matter this week.