Security Scanning

Pushed an Image and Forgot About It? Harbor Artifact Repository: Permission Layering, Vulnerability Scanning, and 200GB Storage Governance

Overview 2 AM. Phone buzzed. Disk alert — 95%. Logged in and found the Harbor server’s /data/registry directory at 200GB, piled with 3,000+ tags. There was app:v0.0.3-beta from last year’s testing, app:feature-branch-xxx left over from failed builds, and ten copies of the same base image — each 800MB+. This isn’t an isolated case. I’ve seen the same script play out across multiple teams: once CI/CD is up and running, images get pushed but never cleaned....

False Positive Rate from 70% to 5%: A Four-Layer Security Gate Design and False Positive Management in CI/CD

Overview Plug a SAST tool into your Jenkins pipeline, let the scan finish with zero alerts, then tell your boss “we’ve adopted DevSecOps” — I’ve seen this playbook too many times. During a Level 2 cybersecurity protection audit for a ride-hailing project, the client’s security team required us to integrate security scanning into our CI/CD pipeline. The first version was textbook standard: SonarQube for code scanning + Trivy for image scanning, with the gate set to “block Critical....