So we're supposed to trust our entire software supply chain to these automated scanners, and then this happens. Running Claw (v2.8.1) in our CI pipeline, and it's blissfully ignoring CVE-2024-12345 in `lodash` version 4.17.15. Yes, it's a real, known, scored vulnerability in the NVD database. The scanner's own docs list it as covered. Yet, our reports come back clean.
Context: Mid-sized platform engineering team, heavy on Kubernetes, moving towards a service mesh (Istio) rollout. Our stack is Node.js backend services, packaged as container images. We run Claw as a self-hosted instance on our K8s cluster—considered Grype and Trivy as cloud alternatives, but went self-hosted for air-gap reasons and to avoid vendor API rate limits. Big mistake, apparently.
Here's the kicker: the same image, when I run a manual `claw audit` with the `--debug` flag, still shows nothing. But if I pull the artifact and run a Grype scan locally, it lights up like a Christmas tree.
```bash
# Our Claw CI step (simplified)
- name: Run Claw Scan
image: our-registry/claw:2.8.1
commands:
- claw audit --format sarif --output report.sarif gcr.io/project/image:sha-abc123
# Local Grype for comparison
grype gcr.io/project/image:sha-abc123 -o table
# Output includes:
# lodash 4.17.15 CVE-2024-12345 High
```
We've updated the vulnerability database, ensured the self-hosted instance is pulling fresh feeds. The `.clawignore` file is empty, so no accidental exclusions.
Anyone else seen this kind of selective blindness? Are we just configuring it wrong, or is the "best practice" tool fundamentally flawed for certain dependency trees? Makes you wonder what else it's missing.