Security scans

[JL-Tests]

Hi syft Team,

FYI security scans with semgrep (image capture and csv attached for code and supply chain findings) and gosec (Html report zipped and attached).

Semgrep_Code_Findings_2025_04_17.csv

Semgrep_Supply_Chain_Findings_2025_04_17.csv

gosec-syft-results.zip

JL

[kzantow]

Just a note that some of these are reported against test data, the pictured Dockerfile issues, for example.

[joshbressers]

I'm going to close this. These are hardening measures that we may want to do someday, but this issue is not where it will happen. Running tools and dumping the results into an issue is irresponsible and annoying.

We would love to see some PRs opened to resolve these issues.