Semgrep found 1 drivermanager-hardcoded-secret finding:

• src/main/java/org/owasp/benchmark/helpers/HibernateUtil.java: L74

A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).

Semgrep found 7 avoid-latest-version findings:

• 1Dockerfile: L15, L19, L22
• 2Dockerfile: L15, L18, L21, L24

Images should be tagged with an explicit version to produce deterministic container images. The 'latest' tag may change the base container without warning.

Semgrep found 4 missing-image-version findings:

• 1Dockerfile: L3, L9
• 2Dockerfile: L3, L9

Images should be tagged with an explicit version to produce deterministic container images.

Semgrep found 6 dockerfile-should-pin-to-hash findings:

• 3Dockerfile: L3, L9, L15, L21, L27, L33

Images referenced from a Dockerfile FROM should always be pinned to an
exact SHA-256 hash. This gives us confidence that builds are repeatable
and changes to base images are always obvious in CI. This is essentially
Docker's equivalent of a "lockfile".

To fix, run docker pull $IMG:$TAG, then change FROM $IMG:$TAG to
FROM $IMG:$TAG@sha256[...] based on the current SHA-256 hash.

_{Created by dockerfile-should-pin-to-hash.}

Semgrep found 18 dockerfile-should-pin-to-hash findings:

• 3Dockerfile: L3, L9, L15, L21, L27, L33
• 1Dockerfile: L3, L9, L15, L19, L25, L31
• 2Dockerfile: L3, L9, L15, L21, L27, L33

Images referenced from a Dockerfile FROM should always be pinned to an
exact SHA-256 hash. This gives us confidence that builds are repeatable
and changes to base images are always obvious in CI. This is essentially
Docker's equivalent of a "lockfile".

To fix, run docker pull $IMG:$TAG, then change FROM $IMG:$TAG to
FROM $IMG:$TAG@sha256[...] based on the current SHA-256 hash.

_{Created by dockerfile-should-pin-to-hash.}