Infrastructure and pipelines
Dockerfile, Compose, nginx, Kubernetes, Terraform and GitHub Actions - the files that decide how your app is really exposed.
Application code is only half of how an app is attacked. The other half is in the files that ship it: a container running as root, a database port published to the host, a workflow that checks out untrusted code with a write token.
| Area | Examples |
|---|---|
| Docker | Runs as root, unpinned base image, secret baked into the image, remote script piped to a shell. |
| Containers | Privileged, docker socket mounted, host namespace shared, dangerous capabilities. |
| Kubernetes | Pod runs as root, privilege escalation allowed. |
| Networking | Database port published, ingress open to the world. |
| Cloud | Public object storage, publicly reachable database. |
| nginx | Version disclosure, directory listing, weak TLS protocols. |
| GitHub Actions | Untrusted checkout, script injection, over-permissioned token, unpinned action. |
| Config | Secrets in plaintext, debug mode enabled in production. |
Questions
Do you need access to my cloud account?
No. These findings come from the files in your repository, not from an API against your provider.
My Terraform lives in another repository. Can you read it?
Connect that repository to the same site and it is read with the rest.
Something here wrong, missing or out of date? Tell us and we will fix the page.