IaC Misconfig Scan

Catch insecure infrastructure-as-code before it ships. Read-only: it flags misconfigurations with file:line, it doesn't change anything.

Prerequisites

• None. Pure Claude Code — reads IaC files directly, no MCP required.

Trigger

• "Scan my Dockerfile / Terraform / workflows for misconfigs"
• "Is my infrastructure-as-code secure?"
• "IaC security review"

Workflow

1. Find IaC files: Dockerfile, docker-compose*.yml, *.tf, and .github/workflows/*.yml.
2. Review each against the checks below; report file:line, severity, and the fix.