Docs

Security Scanner

What this screen is for

Security Scanner reports known vulnerabilities in your container images, so that what you ship is a decision rather than an accident.

Before you start

To do this You need
Open the scanner signed in

Opening it

Tools › Security Scanner.

Direct URL: /developer-tools/trivy-report

📸 Screenshot Placeholder: The Trivy report for one image. Mark: (1) the image identifier, (2) the severity summary, (3) the findings table, (4) one finding expanded.

What is Security Scanner?

Security Scanner is a tool integrated into Fenwave that allows you to analyze the security of your applications. It identifies vulnerabilities in your code, dependencies, and Docker images.

Accessing Security Scanner

  1. Click on Tools in the sidebar
  2. Select Security Scanner

Main Features

Analysis Types

Type Description
SAST Static source code analysis
Dependency Scan Dependency vulnerabilities
Container Scan Docker image analysis
Secret Detection Exposed secrets detection

Integrations

Security Scanner integrates with:

  • SonarQube: Code quality analysis
  • Trivy: Container and IaC scanning
  • Snyk: Dependency vulnerabilities
  • GitLeaks: Secret detection

Usage

Running an Analysis

  1. Select the analysis type
  2. Choose the component to analyze
  3. Configure options (if needed)
  4. Start the analysis

Interpreting Results

Results are classified by severity:

Severity Description Action Required
🔴 Critical Critical vulnerability Immediate fix
🟠 High High vulnerability Fast fix
🟡 Medium Medium vulnerability Schedule fix
🟢 Low Low vulnerability Evaluate
⚪ Info Information Optional

Analysis Report

Each analysis generates a report with:

  • Summary: Overview of findings
  • Details: Description of each vulnerability
  • Remediation: Advice for fixing
  • CVE: References to known CVEs

Best Practices

Scan Frequency

  • Each PR: Automatic scan in CI
  • Daily: Dependency scanning
  • Weekly: Complete security scan
  • Post-Deployment: Validation in staging

Vulnerability Management

  1. Prioritize by severity: Critical and High first
  2. Evaluate context: Real exploitability
  3. Update regularly: Dependencies and images
  4. Document exceptions: If you accept a risk

Configuration

In Your Pipeline

Add security scanning to your CI:

# Example GitHub Actions
security-scan:
  runs-on: ubuntu-latest
  steps:
    - uses: actions/checkout@v4
    - name: Run Trivy vulnerability scanner
      uses: aquasecurity/trivy-action@master
      with:
        scan-type: 'fs'
        format: 'sarif'
        output: 'trivy-results.sarif'

Blocking Thresholds

Configure thresholds to block deployments:

# Example configuration
security:
  block_on_critical: true
  block_on_high: true
  max_medium: 10
  max_low: 50

Reports and History

Security Dashboard

Track security progress:

  • Vulnerability trends
  • Average fix time
  • Most vulnerable components
  • Policy compliance

Exports

Export reports as:

  • PDF for audits
  • JSON for integration
  • SARIF for GitHub Security

Scenario

Deciding whether an image is fit to ship.

  1. Open the report and sort by severity. Read the high findings; skim the rest.
  2. Separate findings in your dependencies from findings in the base image. Most are the base image, and they have a different, usually easier fix.
  3. Try a newer tag of the same base image first. It is one line and frequently clears most of the list.
  4. Bump your own dependencies for what remains.
  5. For findings with no available fix, decide explicitly and write the decision down. A silent pass is indistinguishable from not having looked.
  6. Rebuild and re-scan. Scanning the old image after a fix tells you nothing.

Expecting zero findings is what makes teams stop scanning. The goal is no unexamined high findings.

When it doesn’t work

Symptom Cause How to check Fix
Every image has findings Base images carry known CVEs The severity breakdown Normal; focus on high
A finding persists after fixing it The image was not rebuilt The image tag Rebuild, then re-scan
A finding has no fix available Not every CVE has a patched version The finding detail Decide and record it
No report for an image It has not been scanned — Build and scan it

Next