# Docker / compose security pre-scan

Files scanned: 2

Findings: 1 HIGH, 2 LOW, 1 INFO

- **HIGH** `SECRET-IN-ENV` docker-compose.yml:17 — literal credential value in POSTGRES_PASSWORD
- **LOW** `BASE-TAGPIN` Dockerfile:6 — base image node:24-slim — tag pin is mutable; digest pin is stronger
- **LOW** `BASE-TAGPIN` Dockerfile:31 — base image node:24-slim — tag pin is mutable; digest pin is stronger
- **INFO** `NO-HEALTHCHECK` Dockerfile:0 — no HEALTHCHECK — orchestrators cannot detect a wedged container

_Pre-scan, not an audit: a clean report is not proof an image is safe; image CVEs and runtime behavior are out of scope._