Spotted what might be an issue in agent-bot/Dockerfile around line 15.
The Dockerfile does not specify a USER, causing the application to run as root. Running with unnecessary root privileges increases the risk of privilege escalation; if an attacker compromises the process, they can gain full control over the container. This is a high‑severity issue (CWE‑250).
The code in question
CMD ["bun", "agent-bot/src/index.ts"]
Something like this might fix it:
--- a/agent-bot/Dockerfile
+++ b/agent-bot/Dockerfile
@@
- CMD ["bun", "agent-bot/src/index.ts"]
+ USER appuser
+ CMD ["bun", "agent-bot/src/index.ts"]
For reference: rule dockerfile.security.missing-user.missing-user, CWE-250 (Execution with Unnecessary Privileges). Rated high.
I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.
Spotted what might be an issue in
agent-bot/Dockerfilearound line 15.The Dockerfile does not specify a USER, causing the application to run as root. Running with unnecessary root privileges increases the risk of privilege escalation; if an attacker compromises the process, they can gain full control over the container. This is a high‑severity issue (CWE‑250).
The code in question
Something like this might fix it:
For reference: rule
dockerfile.security.missing-user.missing-user, CWE-250 (Execution with Unnecessary Privileges). Rated high.I may be wrong about this one — closing it costs you nothing if so.
Found with automated scanning (RedGem) and reviewed before opening. If it is not useful, closing it is completely fine.