Infrastructure-as-code review

When it applies

Reviewing the code that provisions cloud/infra. IaC misconfigurations become real, exploitable exposure the moment they apply — a single line can make a bucket public or an SG world-open — so this pairs directly with the offensive cloud-* skills.

Why it works

IaC is declarative and repeatable: the same insecure default gets deployed everywhere it's referenced. Scanning the definitions catches the exposure before it exists, and the patterns (public access, 0.0.0.0/0, plaintext secrets, missing encryption/logging) are consistent across providers.