/iac-scan

Scan changed infrastructure/deploy config for security misconfigurations and exposed secrets. Static and read-only — analyzes the files directly.

Auto-run safety envelope: the auto-run path uses only local static linters that need no network and no auth — hadolint, tfsec, checkov (offline/local policy only), kube-score, actionlint, zizmor. That's why it's safe to auto-run, unlike /pentest (an authenticated, networked scanner that probes live targets). Anything that reaches the network — e.g. trivy pulling vulnerability DBs, or checkov fetching remote policies — is opt-in / recommend-only, never part of the auto-run. If only networked tools are available, run the signature checks instead and recommend the networked scan separately.

Hard rules