Just wanted to thank y'all for this tight ship you're running, it's awesome to not have to worry about these images:

% trivy image authzed/spicedb:v1.37.1 
    Vulnerability scanning is enabled
    Secret scanning is enabled
    If your scanning is slow, please try '--scanners vuln' to disable secret scanning
    Please see also https://aquasecurity.github.io/trivy/v0.41/docs/secret/scanning/#recommendation for faster secret detection
    Detected OS: wolfi
    Detecting Wolfi vulnerabilities...
    Number of language-specific files: 2
    Detecting gobinary vulnerabilities...

authzed/spicedb:v1.37.1 (wolfi 20230201)

Total: 0 (UNKNOWN: 0, LOW: 0, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

we do our best ^.^ it helps is that 1. spicedb is a go binary that doesn't make syscalls (i.e. it's completely self-contained) and 2. we run Trivy as a part of our CI stuff