A recent scan of 1,200 Laravel projects on GitHub showed that 42% shipped Docker images with at least one critical CVE, despite using the same official PHP base image. The gap isn’t the language; it’s the missing step in CI that verifies what ends up in production. ## 1. Add Trivy to the CI workflow

Trivy, an open‑source scanner from Aqua Security, can detect OS packages, language‑specific dependencies, and misconfigurations in a single pass. Adding it to a GitHub Actions pipeline costs nothing and runs in under a minute for a typical Laravel 11 codebase. Example workflow fragment :

name : CI on : [ push , pull_request ] jobs : build : runs-on : ubuntu-latest steps : - uses : actions/checkout@v4 - name : Set up PHP 8.3 uses : shivammathur/setup-php@v2 with : php-version : ' 8.3' extensions : mbstring, bcmath, xml - name : Install dependencies run : composer install --no-interaction --prefer-dist --no-dev - name : Build Docker image run : | docker build -t myapp:ci .…