Skip to main content
Vikat is maintained as a local-only repository with no CI/CD pipeline. Security checks are therefore run on demand rather than automatically on every change. The controls below are either enforced in the source tree, or are commands you should run before shipping an image.
This repository has no GitHub Actions, Dependabot, CodeQL, or automated SARIF reporting. Nothing scans your code unless you invoke it. Every scan on this page must be run manually.

​
Vulnerability Scanning - Snyk

The repository keeps a Snyk policy file (.snyk) that manages vulnerability ignores. Scans are not automated — run them with the Snyk CLI.
Scans all Go, Node, and Python dependencies for known vulnerabilities.
  • Covers every module across core/, framework/, transports/, plugins/, ui/, and tests/
  • Detection depth of 4 catches transitive dependencies

​
Container Image Security

​
Dockerfile Hardening

transports/Dockerfile applies the following, all verifiable in the file itself:

Multi-stage builds

Separate UI builder (Node), Go builder, and minimal Alpine runtime stages ensure no build tools or source code leak into the final image.

Digest-pinned base images

Every FROM is pinned to an immutable @sha256: digest, not a mutable tag — so a compromised or re-pushed tag cannot silently change the build.

Non-root execution

An unprivileged appuser is created with adduser -D and the container runs as it via USER appuser — never as root. The Red Hat image uses numeric USER 1001.

Binary stripping

Go binaries are compiled with -ldflags="-w -s" to strip debug symbols and DWARF information, reducing attack surface and image size.
Additional hardening measures:
  • Patched base layers - RUN apk upgrade --no-cache applies the latest Alpine security patches during build
  • Static builds - Compiled with -tags "sqlite_static" and -extldflags '-static' for fully static linking
  • Build verification - RUN test -f /app/main || exit 1 ensures the binary exists before proceeding
  • Minimal runtime - The Alpine runtime carries only essential libraries (musl, libgcc, ca-certificates)
The runtime base is standard Alpine. It is not a FIPS 140-2 validated image. If you require FIPS, swap the runtime FROM for a validated base and re-verify the OpenSSL provider.

​
Scanning Images Locally

Build the image, then scan it with Docker Scout:

​
Reproducible Builds

Toolchains and dependencies are pinned in the source tree so builds are deterministic: Go module checksums are enforced through each module’s go.sum, and the UI dependency tree is locked in ui/package-lock.json.

​
Controls removed with CI

The upstream project relied on GitHub-native automation that does not exist in this repository. If you need equivalent coverage, you must reintroduce it yourself: