Preferred channels (in order):

1. GitLab Issues (for non-sensitive issues): Open Issue
2. GitLab Service Desk: contact-project+zairakai-dockers-node-79965561-issue-@incoming.gitlab.com
3. Email: security@the-white-rabbits.fr

Include in your report:

• Vulnerability description
• Reproduction steps
• Potential impact
• Affected versions
• Suggested fix (if available)

• ✅ Non-root execution - Runs as non-privileged user
• ✅ Alpine Linux - Minimal attack surface
• ✅ No unnecessary packages - Production image is minimal
• ✅ Healthchecks - Validates environment on startup
• ✅ Read-only compatible - Works with read-only root filesystem

• ✅ Multi-stage builds - Optimized layers, minimal final image
• ✅ Official base images - Trusted sources only
• ✅ No hardcoded secrets - All credentials via environment variables
• ✅ Vulnerability scanning - Automated on every build

Every commit is automatically scanned for:

• SAST - Static Application Security Testing
• Dependency Scanning - Package vulnerabilities
• Secret Detection - Exposed credentials, API keys
• ShellCheck - Shell script security (100% compliance)

# Pin to specific version (reproducible builds)
docker pull zairakai/node:x.y.z

# Run with read-only filesystem
docker run --read-only zairakai/node:x.y.z

# Drop all capabilities
docker run --cap-drop=ALL zairakai/node:x.y.z

services:
  app:
    image: zairakai/node:x.y.z  # Pinned version
    read_only: true  # Read-only filesystem
    cap_drop:
      - ALL  # Drop all capabilities
    security_opt:
      - no-new-privileges:true  # Prevent privilege escalation

• OWASP Top 10 - Vulnerability prevention
• CIS Docker Benchmark - Container security
• GitLab Security Best Practices - CI/CD security
• NIST Cybersecurity Framework - Security principles

• Vulnerability Database: Auto-updated by GitLab scanners
• Security Policies: Reviewed quarterly
• Base Images: Updated with new LTS releases
• Dependencies: Reviewed and updated monthly

• Contributing
• Releases

Made with ❤️ by Zairakai