The framing that these are not splitting mistakes is what makes this useful — a team can get the architecture right and still fail in production for a different reason. The stateful-container pitfall is the sneakiest of the three to me: it works fine until an unrelated restart weeks later, so nobody connects the outage to the design choice. Scanning on every build as a CI/CD gate, rather than a periodic audit, is also the right call — a vulnerable image behaves exactly like a clean one until it is exploited. And the Kubernetes FAQ point is worth repeating: running an orchestrator is not the same as using it correctly.