When to scan: before merge, before release, or at acceptance

Stop code issues and secrets before merge, scan images and packages before release, and export a covered report at acceptance. Rules can be installed offline.