The dev folks have an 'approved repository' workflow; when this team tried to deploy to QA the rouge container got flagged. Plus it failed the static analysis

The dev folks have an 'approved repository' workflow; when this team tried to deploy to QA the rouge container got flagged. Plus it failed the static analysis step in the pipeline. I assume a sufficiently clever dev could find a way around this, but it worked here. Maybe we just got lucky this time, but we did an asset audit when we found this one and didn't find anything that had slipped through. We're looking at deploying some tools (e.g. Dome9) that we think will close some of the loopholes and provide more automation. However, due to the complexity of these environments, I'm not sure there's a perfect solution.