# Image CVE scanning in CI (trivy)

Add a trivy scan step to `.github/workflows/deploy.yml` after the image build+push: scan the pushed bex image (and dashboard image) for HIGH/CRITICAL CVEs — warn on HIGH, fail on CRITICAL (tune after a first baseline run). Sub-hour.

Adjacent hygiene, not duplicated: `w1/006` (Dependabot triage) covers the dependency graph; this covers the built artifact.

Source: `/pm-brainstorm for w7`, 2026-07-09 (w7 security-hardening track).
