gabrielmoreira Security Scanning
When to Use
- Scanning a project directory for known vulnerabilities (CVEs)
- Scanning a container image before deployment
- Scanning Infrastructure-as-Code (Terraform, CloudFormation) for misconfigurations
- Linting shell scripts for bugs, pitfalls, and unsafe patterns
- Encrypting or decrypting secrets stored in YAML/JSON config files
- Checking dependencies for known security issues
Tools
| Tool | Purpose | Structured output |
|---|---|---|
| Trivy | Vulnerability scanner for filesystems, containers, IaC | --format json or --format sarif |
| ShellCheck | Static analysis and linting for shell scripts | -f json for JSON output |
| sops | Encrypt/decrypt secrets in YAML, JSON, ENV files | Outputs decrypted file to stdout |
Patterns
Scan project directory for vulnerabilities
trivy fs --format json --output results.json .
Scan project and show results in terminal
trivy fs --severity HIGH,CRITICAL .
Scan a container image
trivy image --format json --output scan.json nginx:latest
Scan Terraform files for misconfigurations
trivy config --format json .
Scan a lockfile (package-lock.json, requirements.txt, etc.)
trivy fs --scanners vuln --format json package-lock.json
Generate SARIF report for CI integration
trivy fs --format sarif --output report.sarif .
Lint a shell script with JSON output
shellcheck -f json script.sh
Lint all shell scripts in a directory
shellcheck -f json *.sh scripts/*.sh
Lint with specific severity threshold
shellcheck -S warning -f json script.sh
Encrypt a secrets file with sops (using age key)
sops --encrypt --age $(cat ~/.config/sops/age/keys.txt | grep "public key:" | awk '{print $NF}') secrets.yaml > secrets.enc.yaml
Decrypt a secrets file to stdout
sops --decrypt secrets.enc.yaml
Edit encrypted file in-place
sops secrets.enc.yaml
Decrypt a single value
sops --decrypt --extract '["database"]["password"]' secrets.enc.yaml
Pipelines
Scan and summarize critical findings
trivy fs --format json . | jq '[.Results[] | .Vulnerabilities[]? | select(.Severity == "CRITICAL") | {id: .VulnerabilityID, pkg: .PkgName, title: .Title}]'
Each stage: Trivy scans and outputs JSON, jq filters to critical vulnerabilities and extracts key fields.
Lint all shell scripts and count issues by severity
shellcheck -f json scripts/*.sh | jq 'group_by(.level) | map({level: .[0].level, count: length})'
Each stage: ShellCheck lints all scripts to JSON, jq groups and counts by severity level.
Scan image and fail if critical vulns found
trivy image --format json myapp:latest | jq -e '[.Results[] | .Vulnerabilities[]? | select(.Severity == "CRITICAL")] | length == 0'
Each stage: Trivy scans image, jq checks for critical vulns and exits non-zero if any found.
Prefer Over
- Prefer Trivy over manual
npm audit/pip audit— scans all ecosystems in one pass - Prefer ShellCheck over manual review for shell scripts — catches subtle quoting, globbing, and portability bugs
- Prefer sops over storing plaintext secrets — encryption at rest with version control compatibility
Do NOT Use When
- Reviewing business logic or application design flaws — these tools find known CVEs and script bugs, not logic errors
- Linting Python code — use Ruff (python-tooling skill) instead
- Linting JavaScript/TypeScript — use ESLint or Biome directly
- Managing runtime secrets (use Vault or environment variables for that)