High school 3 student publishes Security Camp application answers; shrinking Docker image cut vulnerability alerts from 50 to 14(zenn.dev)

- A high school 3 student published an article with the answers used to apply to Security Camp 2026, a Japanese program for training security talent. The author says they completed the Product Security class and wrote the answers on May 11. - The supply chain attack question covers a case where an npm package maintainer account and token were compromised and malicious code was mixed into a legitimate package. It explains how credentials are stolen from infected environments and spread to other packages. - As countermeasures, the author proposes code review for workflow changes, read-only permissions by default, pinning to commit hashes, and using short-lived tokens (OIDC). The author also wrote that response procedures for a breach should be set in advance. - When the author converted the Dockerfile of a Go app to a multi-stage build (a method of separating the build image from the runtime image), Trivy scan alerts went from 50 to 14. The author said the remaining alerts should still be prioritized by checking factors such as whether they are used at runtime.