Trivy and DefectDojo in a Static-Site Pipeline
A static portfolio has a small attack surface, but the pipeline that builds it pulls npm packages and Docker images. Trivy filesystem scans and DefectDojo imports are how I practice the same security loop I use on real services — on a site I control end to end.
Woodpecker runs Gitleaks for secrets and Trivy for filesystem vulnerabilities. Reports land as JSON artifacts. A security gate fails the build when findings cross the bar you set — not when a scanner merely printed a warning into ignored logs.
The Gitleaks article goes deep on history leaks. Trivy covers dependency and config smell in the tree you are about to ship.