Will It Vibe?allowPrivilegeEscalation enabled
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
allowPrivilegeEscalation: true lets a process gain more privileges than its parent (for example via setuid binaries).
Why it matters
allowPrivilegeEscalation: true lets a process gain more privileges than the one that launched it, for example through a setuid binary. That is a common stepping stone from a limited container process to root inside the container, which then makes a host breakout easier. The secure default costs nothing for most workloads.
How to fix it
Set allowPrivilegeEscalation: false in the container securityContext. Pair it with runAsNonRoot: true and capabilities.drop: ["ALL"] so the process cannot climb back up. Confirm the workload still starts, since a small number of images rely on setuid helpers and will need those reworked.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo