saint-graves/sica-fondt
1
0
Fork 0
mirror of https://github.com/SHOGGOTH-SECTOR/sica-fondt.git synced 2026-08-01 08:30:20 +00:00
Code Issues Packages Projects Releases Wiki Activity
sica-fondt/knowledge/cyber-skills/skills/scanning-container-images-with-grype/assets/template.md
Claude 24f816b6a3
Consolidate 22 sibling repos into layered organism structure 
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):

- brain/        LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
                dispatch, A51 channels, and the OSINT cluster
- knowledge/    LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
                MITRE ATT&CK data
- reference/    defensive threat-reference (C3, shhbruh doc) + AdaYaml parser

License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.

Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.

https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
2026-06-10 06:53:01 +00:00

2.1 KiB
Raw Blame History

Container Image Scan Policy Template

Scan Policy Configuration

Severity Thresholds

Environment Block On Alert On Accept
Production Critical, High Medium Low, Negligible
Staging Critical High, Medium Low, Negligible
Development None Critical, High Medium, Low, Negligible

Scan Triggers

  • On image build (CI pipeline)
  • On image push to registry
  • Before deployment to production
  • Scheduled weekly rescan of deployed images
  • On new vulnerability database update

Image Inventory

Image Registry Tag Policy Last Scanned Status
app/frontend ghcr.io Immutable digest YYYY-MM-DD Pass/Fail
app/backend ghcr.io Immutable digest YYYY-MM-DD Pass/Fail
app/worker ghcr.io Immutable digest YYYY-MM-DD Pass/Fail

Grype Configuration Template

# .grype.yaml - Place in repository root
check-for-app-update: false
fail-on-severity: "high"
output: "json"
scope: "squashed"
quiet: false

ignore:
  # Template: Add accepted risks below
  # - vulnerability: CVE-YYYY-NNNNN
  #   reason: "Justification for accepting this risk"
  #   expires: "YYYY-MM-DD"  # Optional expiration for risk acceptance

db:
  auto-update: true
  cache-dir: "/tmp/grype-db"
  max-allowed-built-age: 120h

match:
  java:
    using-cpes: true
  python:
    using-cpes: true
  javascript:
    using-cpes: false
  stock:
    using-cpes: true

Risk Acceptance Form

Vulnerability Risk Acceptance

Field Value
CVE ID
Severity
Affected Package
Image(s) Affected
Justification
Compensating Controls
Approved By
Approval Date
Expiration Date

Remediation SLA

Severity Remediation Timeline Escalation
Critical 24 hours Security Lead + Engineering VP
High 7 days Security Lead
Medium 30 days Team Lead
Low 90 days Tracked in backlog
Negligible Best effort No escalation