← Scan another repo

github.com/apache/kafka

@ a6fef7fd25b0

Submitted 8/4/2026, 10:28:01 AM · Status: ok

Risk grade
F
100 / 100
Findings
92
0 critical23 high65 medium4 low0 info0 on CISA KEV0ATT&CK
Showing 92 of 92 findings

Findings

  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected generic-api-key: Detected a Generic API Key, potentially exposing access to various services and sensitive operations
    Detected a Generic API Key, potentially exposing access to various services and sensitive operations.
    gitleaks
  • Detected jwt: Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data
    Uncovered a JSON Web Token, which may lead to unauthorized access to web applications and sensitive user data.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Detected private-key: Identified a Private Key, which may compromise cryptographic security and sensitive data encryption
    Identified a Private Key, which may compromise cryptographic security and sensitive data encryption.
    gitleaks
  • Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret st
    Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/assertion/AssertionUtils.java:67
  • Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret st
    Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/main/java/org/apache/kafka/common/security/oauthbearer/internals/secured/assertion/AssertionUtils.java:69
  • Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret st
    Committed PEM private-key material (a "-----BEGIN ... PRIVATE KEY-----" block). Anyone with repo read access holds the key: rotate it, remove it from history, and load keys at runtime from a secret store / mounted volume instead. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/main/java/org/apache/kafka/common/security/ssl/DefaultSslEngineFactory.java:552
  • pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    pickle.load/loads on non-constant data executes arbitrary code on deserialize. Use JSON or a signed/whitelisted format for untrusted input. (Apache-2.0.)
    semgrep.github/scripts/develocity_reports.py:112
  • subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list an
    subprocess invoked through the shell (shell=True) or with a command string that is interpolated/concatenated/.split() instead of a fixed argv list — command injection risk. Pass a literal argv list and shell=False. (First-party socbox; Apache-2.0.)
    semgrepcommitter-tools/kafka-merge-pr.py:104
  • yaml.load without SafeLoader can instantiate arbitrary Python objects. Use yaml.safe_load() (or Loader=SafeLoader). (Apache-2.0.)
    yaml.load without SafeLoader can instantiate arbitrary Python objects. Use yaml.safe_load() (or Loader=SafeLoader). (Apache-2.0.)
    semgrepcommitter-tools/refresh_collaborators.py:124
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivytests/docker/Dockerfile:148
  • 'dnf clean all' missing
    Cached package data should be cleaned after installation to reduce image size.
    trivydocker/native/Dockerfile:33
  • 'microdnf clean all' missing
    Cached package data should be cleaned after installation to reduce image size.
    trivydocker/native/Dockerfile:33
  • 'RUN <package-manager> update' instruction alone
    The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.
    trivydocker/jvm/Dockerfile:71
  • 'RUN <package-manager> update' instruction alone
    The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.
    trivydocker/jvm/Dockerfile:31
  • 'RUN <package-manager> update' instruction alone
    The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.
    trivydocker/docker_official_images/3.7.0/jvm/Dockerfile:28
  • 'RUN <package-manager> update' instruction alone
    The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.
    trivydocker/docker_official_images/3.7.0/jvm/Dockerfile:62
  • 'RUN <package-manager> update' instruction alone
    The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement.
    trivydocker/native/Dockerfile:59
  • Ensure that APT isn't used
    Ensure that APT isn't used on /tests/docker/Dockerfile.RUN
    checkovtests/docker/Dockerfile:34
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /tests/docker/Dockerfile.
    checkovtests/docker/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/docker_official_images/3.7.0/jvm/Dockerfile.
    checkovdocker/docker_official_images/3.7.0/jvm/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/native/Dockerfile.
    checkovdocker/native/Dockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /docker/jvm/Dockerfile.
    checkovdocker/jvm/Dockerfile:1
  • Ensure that sudo isn't used
    Ensure that sudo isn't used on /tests/docker/Dockerfile.RUN
    checkovtests/docker/Dockerfile:34
  • Ensure the base image uses a non latest version tag
    Ensure the base image uses a non latest version tag on /tests/docker/Dockerfile.FROM
    checkovtests/docker/Dockerfile:17
  • Ensure the base image uses a non latest version tag
    Ensure the base image uses a non latest version tag on /docker/native/Dockerfile.FROM
    checkovdocker/native/Dockerfile:47
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Pull Request Linter)
    checkov.github/workflows/pr-linter.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Check and Test)
    checkov.github/workflows/build.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Pull Request Reviewed)
    checkov.github/workflows/pr-reviewed.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Fixup PR Labels)
    checkov.github/workflows/pr-labels-cron.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Workflow Requested)
    checkov.github/workflows/workflow-requested.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Docker Prepare Docker Official Image Source)
    checkov.github/workflows/prepare_docker_official_image_source.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Pull Request)
    checkov.github/workflows/pr-update.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Reviewers Trailer (on review))
    checkov.github/workflows/pr-reviewers-trailer-on-review.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Pull Request Labeled)
    checkov.github/workflows/pr-labeled.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Flaky Test Report)
    checkov.github/workflows/generate-reports.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Docker Image CVE Scanner)
    checkov.github/workflows/docker_scan.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Build and Push Release Candidate Docker Image)
    checkov.github/workflows/docker_rc_release.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Promote Release Candidate Docker Image)
    checkov.github/workflows/docker_promote.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Docker Official Image Build Test)
    checkov.github/workflows/docker_official_image_build_and_test.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Docker Build Test)
    checkov.github/workflows/docker_build_and_test.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Deflake a test)
    checkov.github/workflows/deflake.yml:13
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(CI Complete)
    checkov.github/workflows/ci-complete.yml:13
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Stale PRs)
    checkov.github/workflows/stale.yml:22
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Docker Prepare Docker Official Image Source)
    checkov.github/workflows/prepare_docker_official_image_source.yml:21
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Build and Push Release Candidate Docker Image)
    checkov.github/workflows/docker_rc_release.yml:21
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Promote Release Candidate Docker Image)
    checkov.github/workflows/docker_promote.yml:21
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Docker Official Image Build Test)
    checkov.github/workflows/docker_official_image_build_and_test.yml:21
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Docker Build Test)
    checkov.github/workflows/docker_build_and_test.yml:21
  • The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty.
    The build output cannot be affected by user parameters other than the build entry point and the top-level source location. GitHub Actions workflow_dispatch inputs MUST be empty. on on(Deflake a test)
    checkov.github/workflows/deflake.yml:20
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepserver/src/testFixtures/java/org/apache/kafka/security/JaasTestUtils.java:82
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepserver/src/testFixtures/java/org/apache/kafka/security/JaasTestUtils.java:89
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepserver/src/testFixtures/java/org/apache/kafka/security/JaasTestUtils.java:93
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepserver/src/testFixtures/java/org/apache/kafka/security/minikdc/MiniKdc.java:480
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepstorage/src/main/java/org/apache/kafka/server/log/remote/metadata/storage/serialization/RemoteLogMetadataSerde.java:103
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepserver/src/testFixtures/java/org/apache/kafka/security/JaasTestUtils.java:86
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/main/java/org/apache/kafka/common/config/SaslConfigs.java:190
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/main/java/org/apache/kafka/common/requests/ApiVersionsResponse.java:315
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/main/java/org/apache/kafka/common/requests/RequestContext.java:123
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/main/java/org/apache/kafka/common/requests/RequestHeader.java:165
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/main/java/org/apache/kafka/common/security/scram/internals/ScramSaslClient.java:129
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/testFixtures/java/org/apache/kafka/common/security/authenticator/TestJaasConfig.java:40
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepclients/src/testFixtures/java/org/apache/kafka/common/security/authenticator/TestJaasConfig.java:55
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepcommitter-tools/README.md:78
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepcommitter-tools/README.md:80
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepconfig/consumer.properties:116
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepconfig/producer.properties:111
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocker/examples/fixtures/client-secrets/client-sasl.properties:20
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocker/examples/fixtures/sasl/broker_jaas.conf:19
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:42
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:45
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:233
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:263
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:295
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:331
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:359
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:762
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepdocs/security/authentication-using-sasl.md:863
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepmetadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java:145
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgrepmetadata/src/main/java/org/apache/kafka/metadata/storage/ScramParser.java:235
  • Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)
    semgreprelease/release.py:237
  • ':latest' tag used
    When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.
    trivydocker/native/Dockerfile:47
  • 'RUN cd ...' to change directory
    Use WORKDIR instead of proliferating instructions like 'RUN cd … && do-something', which are hard to read, troubleshoot, and maintain.
    trivytests/docker/Dockerfile:149

This report is public.