Anthropic-Cybersecurity-Skills/skills/scanning-container-images-with-grype/assets/template.md

Container Image Scan Policy Template

Scan Policy Configuration

Severity Thresholds

Environment	Block On	Alert On	Accept
Production	Critical, High	Medium	Low, Negligible
Staging	Critical	High, Medium	Low, Negligible
Development	None	Critical, High	Medium, Low, Negligible

Scan Triggers

• On image build (CI pipeline)
• On image push to registry
• Before deployment to production
• Scheduled weekly rescan of deployed images
• On new vulnerability database update

Image Inventory

Image	Registry	Tag Policy	Last Scanned	Status
app/frontend	ghcr.io	Immutable digest	YYYY-MM-DD	Pass/Fail
app/backend	ghcr.io	Immutable digest	YYYY-MM-DD	Pass/Fail
app/worker	ghcr.io	Immutable digest	YYYY-MM-DD	Pass/Fail

Grype Configuration Template

# .grype.yaml - Place in repository root
check-for-app-update: false
fail-on-severity: "high"
output: "json"
scope: "squashed"
quiet: false

ignore:
  # Template: Add accepted risks below
  # - vulnerability: CVE-YYYY-NNNNN
  #   reason: "Justification for accepting this risk"
  #   expires: "YYYY-MM-DD"  # Optional expiration for risk acceptance

db:
  auto-update: true
  cache-dir: "/tmp/grype-db"
  max-allowed-built-age: 120h

match:
  java:
    using-cpes: true
  python:
    using-cpes: true
  javascript:
    using-cpes: false
  stock:
    using-cpes: true

Risk Acceptance Form

Vulnerability Risk Acceptance

Field	Value
CVE ID
Severity
Affected Package
Image(s) Affected
Justification
Compensating Controls
Approved By
Approval Date
Expiration Date

Remediation SLA

Severity	Remediation Timeline	Escalation
Critical	24 hours	Security Lead + Engineering VP
High	7 days	Security Lead
Medium	30 days	Team Lead
Low	90 days	Tracked in backlog
Negligible	Best effort	No escalation