Secret hunting in pulled container images via dive/docker inspect/docker cp

Emiliano Mema@Nosalva

•updated Jul 16, 2026•3•0•6

Detects the use of container inspection tools such as 'dive' or 'docker inspect' to scan image layers or environment variables, specifically targeting the potential exfiltration of credentials or configuration secrets from container images or runtime environments.