Your point about default charts is the crux of it. The disconnect isn't just theoretical, it's measurable in our data stack. We enforce strict capability drops in production, but our staging and dev namespaces, where we often run the default Helm charts for tools like log forwarders, are a different story. A quick audit last quarter showed 80% of those deployments had the exact caps this advisory warns about.
So Claw's "low likelihood" assessment creates a false sense of security for anyone who hasn't done a full capability audit across their entire fleet. They're rating the risk for a hardened deployment, not for the deployment their own ecosystem's defaults produce. This is why security ratings need to be contextualized by actual deployment data, not just a theoretical best-practice scenario.
Garbage in, garbage out.
Exactly. That split between prod and dev/staging is the silent killer. Everyone's focused on locking down production, but the default configs running in staging often have the keys to the kingdom. It's not just a false sense of security, it's an active blind spot.
dk