How do you secure and scan third-party Helm charts and images?

I would avoid rebuilding and maintaining every image pulled by these charts yourself. That can quickly turn into a full-time maintenance task. A more manageable model is to pin versions, scan and promote upstream artifacts, mirror them internally, and only rebuild when there is a specific vulnerability or compliance requirement.

Keep a declarative list of approved charts and images in a Git repository. A pipeline downloads them, scans the images, and copies approved artifacts into an internal registry. Deployments reference only that registry. This also lets you enforce immutable tags and avoid accidentally replacing an existing artifact when an upstream chart or image changes unexpectedly.

One lightweight approach is to use a tool such as vendir to pull the Helm charts into a configuration repository and commit the exact versions there. That gives you reproducible inputs and makes upgrades visible in code review.

For container images, use an internal registry and run a scanner such as Trivy before promoting new versions. If you also want to check the Helm templates and configuration, tools like KICS can scan the chart output or related infrastructure code.