00 / Case study

ShipSafe

Pre-deployment security checks for modern DevOps.

All projects

Detects problems before they become production problems.

Problem

Security and configuration mistakes in Docker, Kubernetes and GitHub Actions workflows usually surface after deploy — in production — when they're expensive and risky to fix.

Solution

ShipSafe is a CLI that scans Docker, K8s and GitHub Actions repos before deploy, applying 15 rules to catch security and config issues. Run `shipsafe scan .` and fix findings before they ship.

Flow

RepositoryDetectionParsingContextRulesFindingsCLI Report

Coverage

5

Docker rules

5

Kubernetes rules

5

GitHub Actions rules

15 rules total across Docker, Kubernetes and GitHub Actions.

Terminal

shipsafe scan .
$ shipsafe scan .
 
Scanning repository...
 
  Docker  (5 rules)
    [HIGH] Dockerfile:1  running as root user
    [OK]   .dockerignore present
    [OK]   base image pinned
    [OK]   no secrets in ENV
    [OK]   non-root USER set
 
  Kubernetes  (5 rules)
    [OK] resource limits set
    [OK] liveness/readiness probes
    [OK] no privileged containers
    [OK] runAsNonRoot: true
    [OK] imagePullPolicy set
 
  GitHub Actions  (5 rules)
    [OK] no pull_request_target
    [OK] permissions least-privilege
    [OK] actions pinned by SHA
    [OK] no secrets in logs
    [OK] no sudo in steps
 
Summary: 1 issue found
  HIGH: 1
 
→ Fix: set a non-root USER in your Dockerfile

Testing

pytest suite covering rule logic, parsing and the CLI surface.

Roadmap

  • More rules across Docker, Kubernetes and GitHub Actions
  • Structured reporting
  • CI/CD integration
  • JSON & SARIF output