# To-dos

- Extend `HEALTH_RUNTIME_FLOORS`, the container probe and `make security-runtimes` to `node`, `python`, `ruby` and `java`.
- Verify the web SAPI where an image splits it from the CLI. `web-app-lam` mounts the hardening ini into both `/etc/php/8.4/apache2/conf.d` and `/etc/php/8.4/cli/conf.d`, and the probe reads only the CLI copy, so a wrong Apache target would still pass.
- Run `make security-runtimes` in a scheduled CI workflow.
- Scan the pinned images for CVEs (Trivy or Grype) in the scheduled CI and report new criticals as issues.