DevOps & CI/CD
Bug Report
We deleted the npm token in the Dockerfile, and it was still in the image history
A routine image scan flagged a private registry token inside a production image. The Dockerfile passed it as a build argument and removed the .npmrc in a later step, which does nothing for earlier layers or the build history. How we confirmed exposure, rotated, and rebuilt with BuildKit secret mounts.