Will It Vibe?ADD fetches from a remote URL
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
ADD with an http(s) URL downloads a remote file at build time with no checksum or signature check, so a changed or compromised URL silently alters the image.
Why it matters
ADD with an http(s) URL downloads a remote file during the build with no integrity check, so a change at that URL (benign or malicious) silently changes your image. It also does not cache well and hides failures.
How to fix it
Fetch the file in a RUN with curl or wget, verify it against a pinned checksum, then use it, or vendor the artifact into the repo. Reserve ADD for local files (via COPY) and local tar extraction. Pin the URL to an immutable, versioned artifact.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo