A vulnerability management pipeline

#Brief

Scanners produce far more findings than any team can fix at once. Build the pipeline and the process that turns a scan into a short, prioritised, tracked list of fixes.

#What to build

1. Take an app with an old dependency set and a Dockerfile

2. Add CI steps that run a dependency audit (pip-audit, npm audit or similar) and an image scan (Trivy or Grype)

3. Write a script that deduplicates findings and ranks them with EPSS scores and the CISA KEV catalogue, plus your own context (internet-facing, sensitive)

4. Produce a remediation plan: what to fix now, soon and later, with owners and deadlines by risk

5. Apply the top fixes, rescan to verify, and document any risk you accept with an expiry date

#Deliverables

• Repository with .github/workflows/, prioritise/, PLAN.md and before-and-after scans

#How it is graded

Reviewers rerun your prioritisation and check that KEV and high-EPSS issues are at the top and that fixes verify.

#Stretch

Add a scheduled weekly scan that opens an issue when a new high-risk vulnerability appears in unchanged code.