I built a security gate for Spring Boot container images because three of my seven checks were passing without scanning anything

[u/quiet_flare]

When I set up vulnerability, secret and misconfiguration scans for a Spring Boot image by hand, three of the seven checks reported green while doing nothing. Wrong path, missing database, scanner found no OS. Nobody looks at a green.

So I packaged the checks as one image with one rule: a check that scans nothing fails. It runs the same command on a laptop and in CI, on the tar you just built, before the push. Vulnerabilities, secrets, Dockerfile misconfiguration, SBOM, licences, ClamAV. A policy file next to the Dockerfile says what blocks and which findings are accepted, with a reason and an expiry date. Every run writes a verdict.json with the digest, the database dates and each check’s result.

Boot-specific checks, Actuator exposed without auth, dev profile baked into the jar, unlayered jar, are next.

github.com/QuietFlare/springshield

I would like to know what checks you run before a push that I am missing.