← Scan another repo

github.com/sherlock-project/sherlock

@ 9100f9d40a32

Submitted 8/4/2026, 10:25:55 AM · Status: ok

Risk grade
D
75 / 100
Findings
14
0 critical5 high7 medium2 low0 info0 on CISA KEV0ATT&CK
Showing 14 of 14 findings

Findings

  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivy.actor/Dockerfile:14
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivy.actor/Dockerfile:8
  • 'apt-get' missing '--no-install-recommends'
    'apt-get' install should use '--no-install-recommends' to minimize image size.
    trivy.actor/Dockerfile:4
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivyDockerfile:0
  • Image user should not be 'root'
    Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.
    trivy.actor/Dockerfile:0
  • Ensure that a user for the container has been created
    Ensure that a user for the container has been created on /Dockerfile.
    checkovDockerfile:1
  • Ensure that HEALTHCHECK instructions have been added to container images
    Ensure that HEALTHCHECK instructions have been added to container images on /Dockerfile.
    checkovDockerfile:1
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Exclusions Updater)
    checkov.github/workflows/exclusions.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Regression Testing)
    checkov.github/workflows/regression.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Update Site List)
    checkov.github/workflows/update-site-list.yml:0
  • Ensure top-level permissions are not set to write-all
    Ensure top-level permissions are not set to write-all on on(Modified Target Validation)
    checkov.github/workflows/validate_modified_targets.yml:13
  • ':latest' tag used
    When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.
    trivy.actor/Dockerfile:1
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivyDockerfile:0
  • No HEALTHCHECK defined
    You should add HEALTHCHECK instruction in your docker container images to perform the health check on running containers.
    trivy.actor/Dockerfile:0

This report is public.