DockSec

No entries match these filters. Clear filters

1. v2026.9.21 Sep 20, 2026 · issue 083

   DockSec v2026.9.21 adds --fix, AI exploit-chain correlation, EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. prioritization, Markdown CI reports, and PR comment mode.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.21 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.21

   └──▷ TRY IT
   Get actionable remediation commands in the same run as the scan, so you can fix issues without switching context.
   copy

   $ docksec scan --fix <target>

   Emit a Markdown report in CI so scan results render natively in GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. logs or as a PR annotation.
   copy

   $ docksec scan --format markdown <target>

   • Adds --fix flag that emits remediation commands alongside each finding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds --format markdown report output, sized for CI/CD pipeline logs and pull-request summaries.
   • Adds EPSS-based priority scoring to structured findings output, surfacing exploitability likelihood alongside severity.
   • Adds AI-driven finding correlation and exploit-chain analysis to group related issues into attack pathsattack pathsA possible sequence of steps an attacker could take to reach a valuable target. It connects weaknesses, permissions and reachable systems rather than treating each finding separately..
   • Adds PR comment mode that posts scan results directly as a pull-request comment.

   +2 more show less

   • Publishes the container image to GHCRGHCRGitHub Container Registry, GitHub's hosted service for storing and distributing OCI-compatible container images, giving cyber tools a versioned, access-controlled image store tied directly to a GitHub repository., providing a new distribution channel alongside the existing packaging.
   • Adds signed releases for supply-chain verification of DockSec artifacts.

   7 details in Everything

2. v2026.9.20 Sep 20, 2026 · issue 083

   DockSec: Adds AI-powered vulnerability correlation that identifies exploit chains across findings.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.20 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.20

   └──▷ TRY IT
   Scan and automatically generate fix commands for every finding so a developer can remediate without leaving the terminal.
   copy

   $ docksec scan --fix .

   • Replaces string-substitution HTML templates with Jinja2 for report rendering.
   • Adds signed releases and self-scanning CI with integration guides.
   • Adds signed releases and self-scanning CI with integration guides.

   1 more in Everything

3. v2026.9.20rc3 Prerelease Sep 20, 2026 · issue 083
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.20rc3 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.20rc3

   └──▷ TRY IT
   Run a scan and get actionable remediation commands printed alongside each finding — useful in a developer workflow where you want to fix issues immediately.
   copy

   $ docksec scan --fix <target>

   Generate a markdown report in CI/CD so findings render natively in pull request comments or pipeline summaries.
   copy

   $ docksec scan --format markdown <target>

4. v2026.9.20rc2 Prerelease Sep 20, 2026 · issue 083

   DockSec: Introduces EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching.-based priority scoring so findings are ranked by real-world exploit probability rather than raw severity volume.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.20rc2 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.20rc2

   └──▷ TRY IT
   Scan a Docker Compose project in CI and emit a markdown report that renders natively in pull-request comments.
   copy

   $ docksec scan --format markdown docker-compose.yml

   After scanning, apply the tool-suggested remediations directly instead of manually interpreting each finding.
   copy

   $ docksec scan --fix docker-compose.yml

5. v2026.9.20rc1 Prerelease Sep 20, 2026 · issue 083
   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.9.20rc1 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.9.20rc1

   └──▷ TRY IT
   Scan an image and immediately get a prioritized fix list ordered by EPSSEPSSExploit Prediction Scoring System, an estimate of the probability that a published vulnerability will be exploited in the next 30 days. It helps prioritize investigation and patching. score, with remediation commands printed inline.
   copy

   $ docksec scan myapp:latest --fix

   Emit a markdown report in CI so GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. or GitLab MR pipelines render findings natively in the job summary.
   copy

   $ docksec scan myapp:latest --format markdown > docksec-report.md

6. v2026.8.19 Aug 20, 2026 · release notes

   DockSec v2026.8.19 adds repo-level .docksec.yml configuration file

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.8.19 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.8.19

7. v2026.7.4 Jul 18, 2026 · release notes

   DockSec v2026.7.4 adds --log-file and verbose logging capabilities

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.7.4 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.7.4

   └──▷ USE IT
   Save detailed scan logs to a specific file for later analysis or debugging.
   shell copy

   docksec --log-file /var/log/docksec/scan.log scan

   • Adds the --log-file flag to specify an output file for CLI logs

   1 detail in Everything

8. v2026.7.3 Jul 3, 2026 · release notes

   DockSec v2026.7.3 adds SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. export, offline mode, install-skill CLI subcommand, and fix-command output.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.7.3 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.7.3

   └──▷ USE IT
   Export dependencies for a container image without requiring internet access.
   shell copy

   docksec scan --image myapp:latest --sbom --offline

   Install a custom vulnerability detection skill from a local directory.
   shell copy

   docksec install-skill ./skills/custom-vuln-skill

   • Adds --sbom flag to export Software Bill of MaterialsSoftware Bill of MaterialsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. in SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. JSON format
   • Introduces offline mode for scanning environments without network access
   • Adds install-skill CLI subcommand to install analysis skills from local paths or URLs
   • Enables fix-command output option to generate shell snippets for remediation

   4 details in Everything

9. v2026.7.1 Jul 2, 2026 · release notes

   Adds --severity, --fail-on, --format, --output-dir, --json, --sarif--sarifStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface., --baseline/--update-baseline for CI integration and structured reporting.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2026.7.1 https://github.com/OWASP/DockSec.git
   # already have the repo? check out this version:
   $ git checkout v2026.7.1

   └──▷ TRY IT
   Run a scan that only reports vulnerabilities above critical severity and fails the CI step if any are found.
   copy

   $ docksec scan --severity critical --fail-on 1

   Generate a SARIF report in a specific directory for upload to GitHub Security.
   copy

   $ docksec scan --format sarif --output-dir ./reports

   Update the baseline with current findings so future scans ratchet against this version.
   copy

   $ docksec scan --update-baseline

   • --severity flag added to control the vulnerability scan scope for images
   • --fail-on gate with CI-friendly exit codes (0/1/2/3)
   • --format and --output-dir flags to select report format and output directory
   • --json flag enables machine-readable JSON output on stdout
   • --sarif flag enables SARIF output format for findings

   +1 more show less

   • --baseline and --update-baseline flags added for ratchet mode

   6 details in Everything

10. v2026.6.12 Jun 12, 2026 · release notes

    DockSec v2026.6.12 adds GitHub Action support for Docker Compose files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.6.12 https://github.com/OWASP/DockSec.git
    # already have the repo? check out this version:
    $ git checkout v2026.6.12

    • Adds docker compose file scanning capability within the GitHub Action

    1 detail in Everything

11. v2026.6.11 Jun 12, 2026 · release notes

    DockSec v2026.6.11 adds Docker Compose security scanning and multi-service orchestration support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.6.11 https://github.com/OWASP/DockSec.git
    # already have the repo? check out this version:
    $ git checkout v2026.6.11

12. v2026.5.22.1 May 22, 2026 · release notes

    DockSec v2026.5.22.1 adds Smart Model Selection and refines scan_only behavior

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.5.22.1 https://github.com/OWASP/DockSec.git
    # already have the repo? check out this version:
    $ git checkout v2026.5.22.1

    └──▷ USE IT
    Run a scan that automatically picks the cheapest available model instead of defaulting to an expensive one.
    shell copy

    docksec scan --smart-model-selection

    • --smart-model-selection enables automatic selection of cost-effective models like claude-haiku-4-5 across providers.

    1 detail in Everything

13. v2026.5.22 May 22, 2026 · release notes

    DockSec v2026.5.22 adds centralized reporting and Dockerfile-only scan mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.5.22 https://github.com/OWASP/DockSec.git
    # already have the repo? check out this version:
    $ git checkout v2026.5.22

    └──▷ TRY IT
    Run a static analysis scan against a Dockerfile directly, storing results automatically in the new default directory.
    copy

    $ docksec --scan-only Dockerfile

    • Adds default ~/.docksec/results/ directory for organized scan reports
    • Enables high-speed static analysis with the enhanced --scan-only mode on Dockerfiles

    2 details in Everything

14. v2026.4.2 Apr 2, 2026 · release notes

    DockSec v2026.4.2 replaces hardcoded config scores with real Dockerfile analysis

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.4.2 https://github.com/OWASP/DockSec.git
    # already have the repo? check out this version:
    $ git checkout v2026.4.2

15. v2026.2.23 Feb 23, 2026 · release notes

    DockSec v2026.2.23 adds multi-LLMLLMA large language model, a neural network trained on large amounts of text to recognize patterns and generate language. Applications use it for tasks such as answering, summarizing and writing code. provider support including OpenAI, Anthropic, Google, and Ollama

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2026.2.23 https://github.com/OWASP/DockSec.git
    # already have the repo? check out this version:
    $ git checkout v2026.2.23