andypitcher/ponytail-sec
8 stars · Last commit 2026-09-15
The smallest change that ruins an attacker's day.
README preview
<p align="center">
<img src="assets/logo.png" width="220" alt="ponytail-sec, the lazy senior security engineer">
</p>
<h1 align="center">ponytail-sec</h1>
<p align="center">
<em>The smallest change that ruins an attacker's day.</em>
</p>
<p align="center">
<a href="https://securityscorecards.dev/viewer/?uri=github.com/andypitcher/ponytail-sec">
<img src="https://api.securityscorecards.dev/projects/github.com/andypitcher/ponytail-sec/badge" alt="OpenSSF Scorecard">
</a>
</p>
---
ponytail's security sibling. Instead of flooding you with findings, it hunts
the one dropped capability, the one `readOnlyRootFilesystem: true`, the one