[NewJazz]

They did a lot of what you describe, although perhaps not well enough.

[Shank]

It seems not enough again, as their Docker images have now been compromised (as of March 22nd, 2026): https://github.com/aquasecurity/trivy/security/advisories/GH...