Will It Vibe?imagePullPolicy is Never
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
imagePullPolicy: Never runs whatever image happens to be cached on the node, which can be a stale or unexpected build the manifest did not intend.
Why it matters
imagePullPolicy: Never tells the kubelet to use only an image already cached on the node and never to pull. If the expected image is not present, or a stale or unrelated build with the same name is cached, the pod runs the wrong code or fails to start. This is fragile outside of local single-node development. The finding is low severity and a heuristic.
How to fix it
Use imagePullPolicy: IfNotPresent for immutable version-tagged images or Always for images that may be updated, and make sure the image is pushed to a registry the cluster can reach. Reserve Never for local clusters like kind or minikube where you preload images intentionally.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo