trivy-fs-scan: enforce by default; 'false' is the emergency escape #5

Merged

peet merged 1 commits from fs-scan-enforce-default into main

2026-08-30 19:36:33 +02:00

Author	SHA1	Message	Date
peetandClaude Fable 5	53db2936de	trivy-fs-scan: enforce by default; 'false' is the emergency escape Feedback from the first rollout: a default-off gate is the wrong way around — the default must be active and enforced, with the opt-out as an explicit, documented per-invocation emergency flag (same posture as the image-scan gate). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg	2026-08-30 19:34:44 +02:00

Author

SHA1

Message

Date

peetandClaude Fable 5

53db2936de

trivy-fs-scan: enforce by default; 'false' is the emergency escape

Feedback from the first rollout: a default-off gate is the wrong way
around — the default must be active and enforced, with the opt-out as an
explicit, documented per-invocation emergency flag (same posture as the
image-scan gate).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01P5NjXQ3jmyVjimHQxnyKhg

2026-08-30 19:34:44 +02:00