What is the Security Gate

Your scanner finds the vulnerabilities in an image, but it doesn’t tell you how long each one has been public. A critical CVE published yesterday and one published two months ago look the same in the report.

The Leavory Security Gate turns your team’s remediation policy (“criticals within 7 days, highs within 30”) into a rule that runs in every pipeline:

1. it reads the Trivy JSON report your pipeline already produces;
2. it looks up the publication date of each CVE or GHSA in the Leavory database (NVD → CVE.org → GHSA → OSV), with its signature verified;
3. it calculates how many days each one has been public;
4. it fails the build (or just warns) if any CRITICAL or HIGH is past the limit.

What stays in and what leaves your pipeline

• Nothing from the pipeline or the report is sent to Leavory. The step sends only your token, to get the database download link.
• The step runs from the public leavory/security-gate image, which contains only the Leavory binary: no shell and no root.
• The Security Gate never stops a pipeline because of its own failure. If the token is missing, if the image or the database can’t be downloaded, or if the report doesn’t exist, the check is skipped with a warning.

Requirements

Item	Detail
Agent	Linux with Docker. Microsoft’s ubuntu-latest already has it.
Report	Trivy output in JSON, in the same job.
Token	LEAVORY_TOKEN secret variable in the pipeline (how to create it).

Next steps

1. Create the token
2. Add the step to the pipeline
3. Read the result in the build