Containers and infrastructure

Dockerfiles, Compose, Terraform and Kubernetes, checked for the misconfigurations that actually get exploited.

Containers

Dockerfile, Containerfile, Compose files and their variants.

Base images past end of life, running as root, remote ADD from an unverified URL, unpinned package installation, secrets baked into environment variables or build arguments, missing HEALTHCHECK, privileged containers, the Docker socket mounted into a container, and added capabilities that undo isolation.

An end-of-life base image is worth calling out specifically. FROM node:12 is not a vulnerability with a CVE number; it is a guarantee of unpatched vulnerabilities from here on, and it is the single most common finding in real Dockerfiles.

Infrastructure as code

Terraform and OpenTofu, Kubernetes manifests, Helm charts, and Nix.

Publicly readable storage, security groups open to the internet, IAM wildcards, unencrypted storage and databases, publicly accessible databases, missing backup retention, plaintext credentials in variables, containers without resource limits, and pods running privileged or as root.

Why in the editor

Infrastructure mistakes are cheap to fix while you are writing the resource and expensive after it is applied. A bucket made public in a pull request is a review comment; the same bucket in production is an incident with a disclosure obligation attached.

Kubernetes secrets

Values under data: in a Secret are base64, not encrypted. They are decoded and matched against the secret rules, because a credential in a manifest committed to git is a credential in git.

Scope

These run as you type, alongside the code rules. There are only a handful of rules in each family, so the cost is negligible.