docker-bench-security
Check Docker deployment against CIS benchmarks
Changes since last week
no change.
Known vulnerabilities
No known advisories matched the declared dependencies.
Second opinion: OSV-Scanner
OSV-Scanner found 0 advisories in the same files; 0 of Grype's matches are confirmed by it (marked ✓ above). 0 advisories were reported only by OSV-Scanner.
Release integrity
Verdict: no Linux binary.
- Checksums file: yes
- Signatures: no
- SLSA provenance: yes
- SBOM published with the release: no
Verified means a signature, provenance, or attestation was checked against an identity in docker/docker-bench-security's own GitHub Actions workflows.
Repository security (OpenSSF Scorecard)
Score 6.7/10, assessed 2026-10-26 (OpenSSF public dataset). Scorecard viewer
All checks
| Check | Score | Reason |
|---|---|---|
| CII-Best-Practices | 0 | no effort to earn an OpenSSF best practices badge detected |
| Fuzzing | 0 | project is not fuzzed |
| Maintained | 0 | 0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0 |
| SAST | 0 | SAST tool is not run on all commits -- score normalized to 0 |
| Branch-Protection | 5 | branch protection is not maximal on development and all release branches |
| Code-Review | 6 | Found 8/13 approved changesets -- score normalized to 6 |
| Binary-Artifacts | 10 | no binaries found in the repo |
| Dangerous-Workflow | 10 | no dangerous workflow patterns detected |
| License | 10 | license file detected |
| Pinned-Dependencies | 10 | all dependencies are pinned |
| Security-Policy | 10 | security policy file detected |
| Signed-Releases | 10 | 3 out of the last 3 releases have a total of 3 signed artifacts. |
| Token-Permissions | 10 | GitHub workflow tokens follow principle of least privilege |
| Packaging | — | packaging workflow not detected |
GitHub Actions workflow audit (zizmor)
4 potential issues in 2 workflow files at this release: 1 high, 0 medium, 2 low severity (medium or high confidence only). Each is a pattern to review, not a confirmed vulnerability.
All findings
| Severity | Rule | Location | Note |
|---|---|---|---|
| High | unpinned-uses unpinned action reference | .github/workflows/slsa.yml:43 | this job |
| Low | template-injection code injection via template expansion | .github/workflows/slsa.yml:25 | this step |
| Low | template-injection code injection via template expansion | .github/workflows/slsa.yml:29 | this step |
| Informational | superfluous-actions action functionality is already included by the runner | .github/workflows/slsa.yml:71 | this step |
Dependencies (6)
By ecosystem: github 6.
Licenses (as declared in the SBOM): unknown 6.
github (6)
| Name | Version | License | Declared in |
|---|---|---|---|
actions/checkout | 27135e314dd1818f797af1db9dae03a9f045786b | .github/workflows/slsa.yml | |
actions/download-artifact | v2.1.1 | .github/workflows/slsa.yml | |
actions/upload-artifact | v3.1.2 | .github/workflows/slsa.yml | |
pozil/auto-assign-issue | v1.11.0 | .github/workflows/issues.yml | |
slsa-framework/slsa-github-generator/.github/workflows/generator_generic_slsa3.yml | v1.5.0 | .github/workflows/slsa.yml | |
softprops/action-gh-release | v0.1.15 | .github/workflows/slsa.yml |
History
| Week | Version | Dependencies | Critical | High | Medium | Low | Unknown | Changes |
|---|---|---|---|---|---|---|---|---|
| 2026-11-02 | v1.6.1 | 6 | 0 | 0 | 0 | 0 | 0 | — |
| 2026-11-01 | v1.6.1 | 6 | 0 | 0 | 0 | 0 | 0 | — |
SBOM minimum elements
Scored by sbomlyze on the generated source SBOM. A source SBOM usually lacks supplier and hash data, so these scores mostly reflect what the project's manifests declare.
| Standard | Score | Checks passed | Failed checks |
|---|---|---|---|
| NTIA 2021 | 71 | 5/7 | Supplier Name, Dependency Relationship |
| CISA 2025 | 50 | 5/10 | Software Producer, Dependency Relationship, License Information, Component Hash, SBOM Author |
| BSI TR-03183 | 44 | 4/9 | Component Creator, Distribution Licences, SHA-512 Hash, Dependency Relationship, SBOM Creator Contact |
Evidence
Downloads for this week: CycloneDX SBOM · Grype report
Permanent copy of the raw SBOM, Grype, OSV-Scanner, and govulncheck output and release checks: release report-2026-11-02, folder supply-chain-shard-*/docker__docker-bench-security/.
2 manifests and lockfiles scanned
.github/workflows/issues.yml, .github/workflows/slsa.yml
Full JSON for this project · Atom feed of weekly changes
Badges
shields.io endpoints refreshed with each weekly scan. They report this week's result for the latest release, nothing more.
[](https://rezmoss.github.io/awesome-security-pipeline/projects/docker/docker-bench-security/index.html)How this report is made
Every Sunday a GitHub Actions workflow resolves each catalog tool to its latest release and runs the checks below. Every tool is installed from its own latest release and verified against its published checksum or digest. Nothing from the scanned projects is built or executed; release binaries are analyzed as files.
| Tool | What it does here | Version this week |
|---|---|---|
| Syft | Generates a CycloneDX SBOM from each release's manifests and lockfiles. | 1.55.0 |
| Grype | Matches the SBOM against known vulnerabilities. | 0.121.0 |
| OSV-Scanner | Checks the same files against the OSV database to confirm or add matches. | 2.7.0 |
| govulncheck | For Go tools, finds which advisories have vulnerable code compiled into the released Linux binary. | 1.9.0 |
| zizmor | Audits the project's GitHub Actions workflows for injection, unpinned actions, and excessive permissions. | 1.31.1 |
| OpenSSF Scorecard | Scores repository security practices such as code review, branch protection, and pinned dependencies. | 5.6.0 |
| Cosign | Verifies Sigstore signatures on the release binary or its checksums file. | 3.1.4 |
| slsa-verifier | Verifies SLSA build provenance published with the release. | 2.7.1 |
| GitHub CLI attestations | Verifies GitHub artifact attestations for the release binary. | — |
| sbomlyze | Diffs each SBOM against last week and scores NTIA, CISA, and BSI minimum elements. Maintained by this repository's maintainer. | 0.6.0 |