mirror of
https://github.com/Studio-Saelix/sencho.git
synced 2026-07-26 11:49:16 +00:00
Anso
3c116466d9
* refactor: drop the advisory policy-packs section and the findings cursor tooltip Two Security-page cleanups from review. - Remove the advisory policy-packs catalog from the Policies tab. It was information-only and disconnected from the scan_policies enforcement engine, so it read as duplicated. The tab now hosts only the enforcement manager, which is paid, so the Policies tab is hidden for Community (with a deep-link guard) and the Overview's enforcement hint is gated to match. The backend policy-packs catalog and route are kept as a dormant foundation. Delete the orphaned PolicyPacksTab component, its test, and the unused frontend pack types. - Drop the cursor-follow tooltip from the findings severity badge (Secrets and Compose risks), matching the Images table. - Clarify that Compose risks is a Trivy security-misconfig audit, distinct from Compose Doctor's deploy-readiness preflight, in the tab copy and the docs. * chore: re-run CI
75 lines
3.7 KiB
Plaintext
75 lines
3.7 KiB
Plaintext
---
|
|
title: "Security"
|
|
description: "The command center for your fleet's security posture: an overview dashboard, image and Compose findings, secrets, scan history, suppressions, and scanner setup, all in one place."
|
|
---
|
|
|
|
Security is a primary surface in Sencho. The **Security** page in the top navigation brings the
|
|
capabilities that power [vulnerability scanning](/features/vulnerability-scanning) into one command
|
|
center, so you can answer "what should I look at first?" without hunting through other pages. It is
|
|
scoped to the active node: the findings and scanner status you see reflect whichever node is selected.
|
|
|
|
The page is organized into tabs.
|
|
|
|
## Overview
|
|
|
|
The overview opens with a status masthead that reads your worst active severity at a glance,
|
|
**Secure**, **At risk**, or **Critical**, alongside the critical and high counts and the time of the
|
|
last successful scan. Below it, a signal rail summarizes the supporting numbers: scanned images,
|
|
fixable findings, secrets, Compose misconfigurations, stale scans, and failed scans. A status strip
|
|
shows scanner health (installed source and version, auto-update) and the active node's deploy
|
|
enforcement posture.
|
|
|
|
If a node does not report an overview (for example an older remote node), the page falls back to a
|
|
clear "overview unavailable" state and the other tabs keep working.
|
|
|
|
## Images
|
|
|
|
Image findings list every scanned image on the active node with its highest severity. Selecting an
|
|
image opens the full scan report, where you can review vulnerabilities, suppress a CVE, and export an
|
|
SBOM.
|
|
|
|
## Compose risks
|
|
|
|
Compose risks surface the security misconfigurations Trivy finds in your stack definitions rather than
|
|
image CVEs: privileged containers, Docker socket mounts, host networking, broad host bind mounts, public
|
|
database ports, and containers running as root. Each entry opens its scan report with the specific
|
|
findings and how to fix them. This is a security audit of the Compose file; for deploy-readiness checks
|
|
(port conflicts, missing bind paths, unset variables, no healthcheck), use
|
|
[Compose Doctor](/features/compose-doctor) from the stack page instead.
|
|
|
|
## Secrets
|
|
|
|
The secrets tab lists images where Trivy detected exposed credentials or keys, and opens straight to
|
|
the secret findings for a scan.
|
|
|
|
## Policies
|
|
|
|
The Policies tab manages deploy-enforcement scan policies: severity thresholds that block or warn on a
|
|
deploy, scoped by stack pattern. Enforcement is an Admiral capability; see
|
|
[scan policies](/features/vulnerability-scanning#scan-policies) for the full configuration.
|
|
|
|
## Suppressions
|
|
|
|
CVE suppressions and misconfiguration acknowledgements are managed here, the same controls available
|
|
in Settings. These are governed by the local instance, so this tab is shown when you are on the local
|
|
node; switch to the local node to manage them.
|
|
|
|
## History
|
|
|
|
The History tab opens the scan history sheet, listing completed scans grouped by image with search and
|
|
two-scan comparison. Closing the sheet leaves the tab in place so you can reopen it. The **Scan
|
|
history** button in the [Resources Hub](/features/resources) is a shortcut to the same place.
|
|
|
|
## Scanner setup
|
|
|
|
Scanner setup manages the Trivy binary for the active node: install the managed binary, update it when
|
|
a new release is available, and toggle automatic updates. Trivy is installed independently on each
|
|
node. See [Installing Trivy](/operations/trivy-setup) for the full setup options.
|
|
|
|
## What stays where
|
|
|
|
Resources keeps its per-image severity badges and scan actions, so you can still scan and inspect an
|
|
image from your inventory. Security is the place to review the whole picture; the deeper scanning
|
|
workflow (on-demand scans, scheduled fleet scans, scan policies, SBOM and SARIF export) is documented
|
|
under [Vulnerability scanning](/features/vulnerability-scanning).
|