Audit rules reference

This is the reference for every rule chant audit can report. Each finding in a report links to its rule here.

Each rule is tagged with its tier — merge-worthy (a security or correctness issue worth a PR) or report-only (hygiene) — and its fix kind — deterministic (a safe mechanical fix the report can apply as a diff) or guidance (needs a judgement call). Where an open-source tool checks the same thing, the rule says so under Prior art; the Prior art section at the end lists every tool the rules on this page credit.

GitHub Actions (GHA)

Also applied to Forgejo workflows, which are GitHub-dialect.

GHA006

Duplicate workflow name (report-only · guidance)

Give each workflow a unique name:.

GHA009

Empty matrix dimension (merge-worthy · guidance)

Remove the empty matrix axis or give it values; an empty axis produces zero jobs.

Prior art	actionlint Unexpected empty mappings (overlaps)

GHA011

needs references a non-existent job (merge-worthy · guidance)

Fix the needs: target to name a real job.

Prior art	actionlint Job dependencies validation (equivalent)

GHA013

Missing job permissions on a sensitive trigger (merge-worthy · guidance)

Add an explicit least-privilege permissions: block to jobs under pull_request_target/workflow_dispatch.

Authority	OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication
Prior art	poutine default_permissions_on_risky_events (overlaps) · zizmor excessive-permissions (overlaps) · OpenSSF Scorecard Token-Permissions (overlaps)

GHA017

No explicit permissions block (merge-worthy · deterministic)

Add a top-level permissions: \{ contents: read } and widen only where a job needs it.

Authority	OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication
Prior art	zizmor excessive-permissions (overlaps) · OpenSSF Scorecard Token-Permissions (overlaps)

GHA018

pull_request_target checks out untrusted code (merge-worthy · guidance)

Don’t check out / run PR head code under pull_request_target; split into a privileged + unprivileged workflow.

Authority	GitHub Security Lab — Preventing pwn requests
Prior art	OpenSSF Scorecard Dangerous-Workflow (overlaps) · octoscan dangerous-checkout (overlaps) · poutine untrusted_checkout_exec (overlaps)

GHA019

Circular needs chain (merge-worthy · guidance)

Break the cycle in the job dependency graph.

Prior art	actionlint Job dependencies validation (equivalent)

GHA021

actions/checkout not pinned to a SHA (merge-worthy · deterministic)

Pin actions/checkout to a full 40-char commit SHA.

Authority	OSSF Scorecard — Pinned-Dependencies · GitHub — Using third-party actions
Prior art	zizmor unpinned-uses (overlaps) · OpenSSF Scorecard Pinned-Dependencies (overlaps)

GHA022

Job without timeout-minutes (report-only · guidance)

Add timeout-minutes: to bound runaway jobs.

GHA023

Deprecated ::set-output (report-only · guidance)

Replace ::set-output with $GITHUB_OUTPUT.

Prior art	actionlint Check deprecated workflow commands (overlaps)

GHA024

Missing concurrency block (report-only · guidance)

Add a concurrency: group to deploy workflows.

Prior art	zizmor concurrency-limits (overlaps)

GHA025

Unrestricted pull_request_target (merge-worthy · guidance)

Gate pull_request_target jobs and avoid running untrusted code with elevated scope.

Authority	GitHub Security Lab — Preventing pwn requests
Prior art	zizmor dangerous-triggers (overlaps)

GHA026

Secret used without environment protection (report-only · guidance)

Move secret-consuming jobs behind a protected environment:.

Prior art	zizmor secrets-outside-env (equivalent)

GHA027

Cleanup step without if: always() (report-only · guidance)

Add if: always() to cleanup steps.

GHA028

Workflow with no triggers (merge-worthy · guidance)

Add an on: trigger; the workflow never runs without one.

Prior art	actionlint Missing required keys and key duplicates (overlaps)

GHA029

Action not pinned to a commit SHA (merge-worthy · deterministic)

Pin the action to a full commit SHA instead of a tag/branch.

Authority	OSSF Scorecard — Pinned-Dependencies · GitHub — Using third-party actions
Prior art	zizmor unpinned-uses (overlaps) · OpenSSF Scorecard Pinned-Dependencies (overlaps)

GHA030

Container image not pinned to a digest (merge-worthy · deterministic)

Pin the image to an immutable @sha256: digest.

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	zizmor unpinned-images (overlaps)

GHA031

Possible action impersonation (merge-worthy · guidance)

Verify the action owner/slug; it resembles a well-known action.

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	zizmor typosquat-uses (equivalent)

GHA032

Archived/abandoned or vulnerable action (merge-worthy · guidance)

Replace the archived action or one with a disclosed security issue.

Prior art	zizmor archived-uses (overlaps) · zizmor known-vulnerable-actions (overlaps)

GHA033

Blanket write-all permissions (merge-worthy · deterministic)

Replace write-all with the specific scopes the jobs need (default contents: read).

Authority	OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication
Prior art	zizmor excessive-permissions (overlaps) · OpenSSF Scorecard Token-Permissions (overlaps)

GHA034

Write permissions granted workflow-wide (merge-worthy · guidance)

Move write scopes to the single job that needs them; keep the workflow least-privilege.

Authority	OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication
Prior art	zizmor excessive-permissions (overlaps) · OpenSSF Scorecard Token-Permissions (overlaps)

GHA035

Elevated token on an untrusted-code trigger (merge-worthy · guidance)

Drop the elevated permissions: on triggers that can run untrusted code.

Authority	GitHub Security Lab — Preventing pwn requests · OSSF Scorecard — Token-Permissions

GHA036

Untrusted input interpolated into run: (merge-worthy · guidance)

Pass untrusted $\{\{ }} values via an env: var and reference "$VAR", never inline in the script.

Authority	GitHub — Understanding the risk of script injections
Prior art	zizmor template-injection (equivalent) · poutine injection (equivalent) · actionlint Script injection by potentially untrusted inputs (equivalent) · octoscan expression-injection (equivalent) · OpenSSF Scorecard Dangerous-Workflow (overlaps)

GHA037

Untrusted input written to GITHUB_ENV/GITHUB_PATH (merge-worthy · guidance)

Don’t write untrusted input to $GITHUB_ENV/$GITHUB_PATH; sanitize or avoid.

Authority	GitHub — Understanding the risk of script injections
Prior art	zizmor github-env (equivalent) · octoscan dangerous-write (overlaps)

GHA038

workflow_run checks out untrusted code in a privileged context (merge-worthy · guidance)

Avoid checking out untrusted code under workflow_run; treat it as privileged.

Authority	GitHub Security Lab — Preventing pwn requests
Prior art	OpenSSF Scorecard Dangerous-Workflow (overlaps) · octoscan dangerous-checkout (overlaps)

GHA039

Auth gate on a spoofable author field (merge-worthy · guidance)

Gate on a non-spoofable identity, not a commit-author field.

Authority	GitHub Security Lab — Preventing pwn requests
Prior art	zizmor bot-conditions (overlaps) · octoscan bot-check (overlaps) · poutine confused_deputy_auto_merge (overlaps)

GHA040

Self-hosted runner on an untrusted-code trigger (merge-worthy · guidance)

Don’t run untrusted-code triggers on self-hosted runners.

Authority	GitHub Security Lab — Preventing pwn requests
Prior art	poutine pr_runs_on_self_hosted (equivalent) · zizmor self-hosted-runner (overlaps) · octoscan runner-label (overlaps)

GHA041

Blanket secrets: inherit (merge-worthy · guidance)

Pass only the specific secrets the reusable workflow needs.

Authority	GitHub — Using secrets in GitHub Actions
Prior art	zizmor secrets-inherit (equivalent)

GHA042

Entire secrets context passed (merge-worthy · guidance)

Pass named secrets instead of the whole secrets context.

Authority	GitHub — Using secrets in GitHub Actions
Prior art	zizmor overprovisioned-secrets (equivalent) · poutine job_all_secrets (equivalent)

GHA043

Secret consumed without an environment gate (merge-worthy · guidance)

Put secret-consuming jobs behind a protected environment.

Authority	GitHub — Using secrets in GitHub Actions
Prior art	zizmor secrets-outside-env (equivalent)

GHA044

Hardcoded registry/container credential (merge-worthy · guidance)

Remove the hardcoded credential, move it to a secret, and rotate it (responsible disclosure first).

Authority	GitHub — Using secrets in GitHub Actions
Prior art	zizmor hardcoded-container-credentials (equivalent) · actionlint Hardcoded credentials (equivalent) · octoscan credentials (equivalent)

GHA045

Secret interpolated into run: (merge-worthy · guidance)

Reference secrets via env:, not inline in the shell command.

Authority	GitHub — Understanding the risk of script injections · GitHub — Using secrets in GitHub Actions

GHA046

Constant/unsound guard condition (merge-worthy · guidance)

Fix the always-true/false if: — it may neutralize a security gate.

Prior art	actionlint Constant conditions at if:“ (equivalent) · zizmor unsound-condition (overlaps) · poutine if_always_true (overlaps)

GHA047

Ineffective contains() guard (reversed args) (merge-worthy · guidance)

Swap the contains() arguments so the guard actually filters.

Prior art	zizmor unsound-contains (equivalent)

GHA048

Obfuscated guard condition (merge-worthy · guidance)

Simplify the indirect if: so its effect is reviewable.

Prior art	zizmor obfuscation (overlaps)

GHA049

Persisted checkout credentials reachable by an artifact (merge-worthy · guidance)

Use persist-credentials: false or exclude .git from uploaded artifacts.

Authority	GitHub — Using secrets in GitHub Actions
Prior art	zizmor artipacked (equivalent) · octoscan dangerous-artefact (overlaps)

GHA050

Cache populated in a privileged context (merge-worthy · guidance)

Don’t populate caches from untrusted code paths (poisoning risk).

Authority	GitHub Security Lab — Preventing pwn requests
Prior art	zizmor cache-poisoning (overlaps)

GHA051

Long-lived token instead of OIDC (report-only · guidance)

Migrate publish/release to OIDC short-lived credentials.

Prior art	zizmor use-trusted-publishing (overlaps)

GHA052

Software piped to a shell without verification (merge-worthy · guidance)

Verify a checksum/signature before executing fetched scripts.

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	poutine unverified_script_exec (equivalent) · OpenSSF Scorecard Pinned-Dependencies (overlaps)

GHA053

Re-enables unsafe set-env/add-path (merge-worthy · guidance)

Remove ACTIONS_ALLOW_UNSECURE_COMMANDS; use $GITHUB_ENV/$GITHUB_PATH.

Authority	GitHub — Understanding the risk of script injections
Prior art	zizmor insecure-commands (equivalent) · octoscan unsecure-commands (equivalent)

GHA054

Feature with a known security footgun (merge-worthy · guidance)

Replace the flagged feature with the safe alternative.

Prior art	zizmor misfeature (overlaps)

GHA055

Runtime install of a tool already on the runner (report-only · guidance)

Drop the redundant install to save time.

Prior art	zizmor superfluous-actions (overlaps)

GHA056

Workflow without a name (report-only · guidance)

Add a name: to the workflow.

Prior art	zizmor anonymous-definition (overlaps)

GHA057

Dependency update can execute untrusted code (merge-worthy · guidance)

Disable the option that lets dependency updates run external code.

Authority	GitHub Security Lab — Preventing pwn requests
Prior art	zizmor dependabot-execution (equivalent)

GHA058

Dependency update has no cooldown window (report-only · guidance)

Add a cooldown so new releases aren’t merged instantly.

Prior art	zizmor dependabot-cooldown (equivalent)

GHA059

Stale or missing pin annotation (merge-worthy · guidance)

Add or correct the trailing version comment on the SHA-pinned reference so it matches the digest.

Authority	OSSF Scorecard — Pinned-Dependencies · GitHub — Using third-party actions
Prior art	zizmor ref-version-mismatch (equivalent)

GHA060

Over-scoped generated token (merge-worthy · guidance)

Narrow the GitHub App token’s permission-* inputs to the scopes its consuming steps actually use, or remove the unused ones.

Authority	OSSF Scorecard — Token-Permissions · GitHub — Automatic token authentication
Prior art	zizmor github-app (overlaps)

GHA061

Action reference outside the configured usage policy (merge-worthy · guidance)

Replace the reference with one from the approved allowlist, or get it added if it should be trusted.

Prior art	zizmor forbidden-uses (equivalent)

GHA062

Pinned reference matches a known-vulnerability advisory (merge-worthy · guidance)

Bump the reference to a patched ref/commit named by the advisory.

Authority	OSSF Scorecard — Vulnerabilities
Prior art	zizmor known-vulnerable-actions (equivalent) · poutine known_vulnerability_in_build_component (equivalent) · octoscan known-vulnerability (equivalent) · OpenSSF Scorecard Vulnerabilities (overlaps)

GHA063

Dependency setup action without caching enabled (report-only · guidance)

Enable the setup action’s cache: option or add an actions/cache step.

GHA064

Expensive runner without justification (report-only · guidance)

Confirm the job needs that OS, or move it to a Linux runner.

GHA065

Unbounded matrix fan-out (report-only · guidance)

Trim the matrix with include/exclude, or cap it with max-parallel.

GHA066

Unbounded artifact retention (report-only · guidance)

Set a retention-days sized to how long the artifact is actually needed.

GHA067

Unconditional heavy step with no path filter (report-only · guidance)

Scope the trigger’s paths, or add an if: guard to the step.

GHA068

Pull-request workflow missing a concurrency group (report-only · guidance)

Add a concurrency group with cancel-in-progress: true.

Prior art	zizmor concurrency-limits (overlaps)

GHA069

Job permissions block drops the workflow’s id-token: write (merge-worthy · guidance)

Add id-token: write to the job’s permissions: block; keep the job block rather than removing it.

GitLab CI (WGL)

WGL010

Job references an undefined stage (merge-worthy · guidance)

Add the stage to stages: or fix the job’s stage:.

Prior art	GitLab CI/CD YAML reference stage: supported values are the default stages or stages listed in stages“ (equivalent)

WGL011

Job rules always evaluate to never (merge-worthy · guidance)

Fix the rules: so the job can run; it is currently unreachable.

WGL012

Deprecated property (report-only · guidance)

Replace the deprecated GitLab CI property.

Prior art	GitLab CI/CD YAML reference Deprecated keywords (only/except, globally-defined image/services/cache/before_script/after_script) (equivalent)

WGL013

Invalid needs target (merge-worthy · guidance)

Fix the dangling/self needs: reference.

Prior art	GitLab CI/CD YAML reference Error: 'job' does not exist in the pipeline (needs) (equivalent)

WGL014

Invalid extends target (merge-worthy · guidance)

Point extends: at a template that exists in the pipeline.

Prior art	GitLab CI/CD YAML reference extends: supported values are the name(s) of another job in the pipeline (equivalent)

WGL015

Circular needs chain (merge-worthy · guidance)

Break the cycle in the job dependency graph.

WGL016

Hardcoded secret in variables (merge-worthy · guidance)

Move the secret out of variables: into a masked/protected CI variable and rotate it.

Authority	GitHub — Using secrets in GitHub Actions
Prior art	GitLab CI/CD YAML reference CI/CD variable security (secrets belong in masked/protected variables, not in .gitlab-ci.yml) (overlaps)

WGL017

Insecure (non-HTTPS) registry (merge-worthy · guidance)

Use an HTTPS registry endpoint.

WGL018

Missing job timeout (report-only · guidance)

Add a timeout: to bound long-running jobs.

WGL019

Missing retry on deploy job (report-only · guidance)

Add a retry: strategy to deploy jobs.

WGL020

Duplicate job names (merge-worthy · guidance)

Rename so each job resolves to a unique name.

WGL021

Unused global variable (report-only · guidance)

Remove the unused global variables: entry.

WGL022

Missing artifacts expiry (report-only · guidance)

Add expire_in: to artifacts to avoid disk bloat.

WGL023

Overly broad rules (when: always) (report-only · guidance)

Add real conditions to the job’s rules:.

Prior art	GitLab CI/CD YAML reference Pipeline warning: Job may allow multiple pipelines to run for a single action (final when rule without conditions) (overlaps)

WGL024

Manual job without allow_failure (report-only · guidance)

Add allow_failure: true so a manual job doesn’t block the pipeline.

Prior art	GitLab CI/CD YAML reference allow_failure default: true for manual jobs, false for rules:when: manual (overlaps)

WGL025

Cache without a key (report-only · guidance)

Add a cache.key to avoid cross-job cache collisions.

Prior art	GitLab CI/CD YAML reference cache:key: all jobs with cachebut nocache:keyshare thedefault cache (overlaps)

WGL026

Privileged DinD service without TLS (merge-worthy · guidance)

Set DOCKER_TLS_CERTDIR for privileged Docker-in-Docker services.

Prior art	GitLab CI/CD YAML reference Docker-in-Docker with TLS enabled (recommended); DOCKER_TLS_CERTDIR (overlaps)

WGL027

Empty script (merge-worthy · guidance)

Give the job a non-empty script:; it currently does nothing.

WGL028

Redundant needs (report-only · guidance)

Drop needs: already implied by stage ordering.

WGL029

include/component resolved by a moving ref (merge-worthy · guidance)

Pin include:project/component to a tag or commit SHA, not a branch.

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	GitLab CI/CD YAML reference include:project ref guidance: use a specific SHA hash, protected branch/tag rules (overlaps) · GitLab CI/CD YAML reference CI/CD component security best practices: use pinned versions (commit SHA preferred), avoid latest“ (overlaps)

WGL030

Insecure or mutable include:remote (merge-worthy · guidance)

Use HTTPS and pin the remote include to an immutable ref.

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	GitLab CI/CD YAML reference include:remote: treat as a third-party dependency; verify integrity with include:integrity (overlaps)

WGL031

Container image not pinned to a digest (merge-worthy · deterministic)

Pin the image to an immutable @sha256: digest.

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	GitLab CI/CD YAML reference Use checksum to keep your image secure (image@sha256:digest) (overlaps)

WGL032

Possible include/component impersonation (merge-worthy · guidance)

Verify the include source; it resembles a well-known project.

Authority	OSSF Scorecard — Pinned-Dependencies

WGL033

OIDC id_token without a scoped audience (merge-worthy · guidance)

Set a specific aud: on the OIDC id_token.

Authority	GitHub — Security hardening with OpenID Connect
Prior art	GitLab CI/CD YAML reference id_tokens: the required aud sub-keyword configures the aud claim (overlaps)

WGL034

OIDC id_token mintable from a merge-request pipeline (merge-worthy · guidance)

Restrict OIDC token minting to protected pipelines.

Authority	GitHub — Security hardening with OpenID Connect · GitHub Security Lab — Preventing pwn requests

WGL035

Untrusted CI variable interpolated into a script (merge-worthy · guidance)

Pass untrusted variables via the environment and quote them; don’t inline.

Authority	GitHub — Understanding the risk of script injections
Prior art	poutine injection (overlaps)

WGL036

Privileged service reachable from merge-request pipelines (merge-worthy · guidance)

Block privileged/DinD services on merge-request pipelines.

Authority	GitHub Security Lab — Preventing pwn requests

WGL037

Security gate on an untrusted ref regex (merge-worthy · guidance)

Don’t gate security decisions on a regex over an untrusted ref variable.

Authority	GitHub Security Lab — Preventing pwn requests

WGL038

Secret reachable from a merge-request pipeline (merge-worthy · guidance)

Scope secret-like variables to protected branches/pipelines.

Authority	GitHub — Using secrets in GitHub Actions · GitHub Security Lab — Preventing pwn requests
Prior art	GitLab CI/CD YAML reference Protect a CI/CD variable (available only to protected branches/tags) (overlaps) · GitLab CI/CD YAML reference Merge request pipelines from forked projects can steal secrets in the parent project (overlaps)

WGL039

Secret printed to job logs (merge-worthy · guidance)

Stop echoing the secret-like variable; mask it.

Authority	GitHub — Using secrets in GitHub Actions
Prior art	GitLab CI/CD YAML reference CI/CD variable security: accidental-leak-job example (echo of $PASSWORD); mask sensitive variables (overlaps)

WGL040

Hardcoded credential in a registry login (merge-worthy · guidance)

Move the credential to a masked CI variable and rotate it.

Authority	GitHub — Using secrets in GitHub Actions

WGL041

Tautological rules:if condition (merge-worthy · guidance)

Fix the always-true rules:if; it may neutralize a gate.

WGL042

Unreachable rules after an unconditional match (report-only · guidance)

Remove the dead rules: entries after the catch-all.

WGL043

Match-anything regex gate in rules:if (merge-worthy · guidance)

Tighten the regex; a match-anything gate is no gate.

Authority	GitHub Security Lab — Preventing pwn requests

WGL044

Public artifacts expose build output (merge-worthy · guidance)

Mark sensitive artifacts non-public (public: false).

Prior art	GitLab CI/CD YAML reference artifacts:public (default true: downloadable by anonymous users in public pipelines) (overlaps)

WGL045

Artifact path may capture a credential file (merge-worthy · guidance)

Narrow the artifact path so it can’t capture credential files.

Authority	GitHub — Using secrets in GitHub Actions

WGL046

Cache populated in a merge-request pipeline (merge-worthy · guidance)

Don’t populate caches from merge-request pipelines (poisoning risk).

Authority	GitHub Security Lab — Preventing pwn requests
Prior art	GitLab CI/CD YAML reference Cache key names: protected and non-protected branches do not share the cache by default (overlaps)

WGL047

Software piped to a shell without verification (merge-worthy · guidance)

Verify a checksum/signature before executing fetched scripts.

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	poutine unverified_script_exec (equivalent)

WGL048

Pipeline without workflow:name (report-only · guidance)

Add a workflow:name for clearer pipeline naming.

Prior art	GitLab CI/CD YAML reference Use pipeline names (workflow:name) (overlaps)

WGL049

Dependency install without a cache (report-only · guidance)

Add a cache: covering the dependency directory.

WGL050

Merge-request job missing interruptible (report-only · guidance)

Add interruptible: true so a superseded pipeline can be cancelled.

Forgejo (WFJ)

WFJ010

Unresolved action reference on Forgejo (merge-worthy · guidance)

Use an action reference Forgejo can resolve (full URL or a mirrored action).

WFJ011

GitHub-hosted runner label with no Forgejo equivalent (merge-worthy · guidance)

Use a runner label your Forgejo instance provides.

Kubernetes (WK8 / ARGO / FLUX)

Run against Kubernetes manifests.

ARGO002

Argo Application references an undeclared AppProject (merge-worthy · guidance)

Declare the named AppProject or reference an existing project.

ARGO003

Argo Application targets an unregistered cluster (merge-worthy · guidance)

Point spec.destination at a registered cluster or the in-cluster target.

ARGO005

Argo source.path may not resolve (report-only · guidance)

Ensure the source path exists under the build root.

FLUX002

Flux Kustomization references an undeclared source (merge-worthy · guidance)

Declare the GitRepository/OCIRepository/Bucket, or point sourceRef at the bootstrap flux-system repo.

Prior art	Flux Kustomization API reference .spec.sourceRef (overlaps)

FLUX003

Flux Kustomization dependsOn names an undeclared Kustomization (report-only · guidance)

Fix the dependsOn name, or ignore if the dependency is declared in another repo.

Prior art	Flux Kustomization API reference .spec.dependsOn (overlaps)

WK8005

Hardcoded secret in env var (merge-worthy · guidance)

Use a secretKeyRef instead of a literal value, and rotate the secret.

Authority	Kubernetes — Good practices for Secrets
Prior art	Fairwinds Polaris sensitiveContainerEnvVar (overlaps) · KubeLinter env-var-secret (overlaps)

WK8006

Image uses :latest or no tag (merge-worthy · guidance)

Pin the image to an explicit version tag (ideally a digest).

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	KubeLinter latest-tag (equivalent) · Fairwinds Polaris tagNotSpecified (equivalent) · Checkov CKV_K8S_14 (equivalent)

WK8041

Hardcoded API key in env var (merge-worthy · guidance)

Move the key to a Secret and rotate it.

Authority	Kubernetes — Good practices for Secrets
Prior art	Fairwinds Polaris sensitiveContainerEnvVar (overlaps) · KubeLinter env-var-secret (overlaps) · Datree prevent-exposed-secrets-aws (overlaps)

WK8042

Private key stored in a ConfigMap (merge-worthy · guidance)

Store private keys in a Secret, not a ConfigMap.

Authority	Kubernetes — Good practices for Secrets
Prior art	Fairwinds Polaris sensitiveConfigmapContent (overlaps) · Datree prevent-exposed-secrets-privatekey (overlaps)

WK8101

Deployment selector does not match template labels (merge-worthy · guidance)

Align spec.selector with the pod template labels.

Prior art	KubeLinter mismatching-selector (equivalent) · kube-score deployment-pod-selector-labels-match-template-metadata-labels (equivalent)

WK8102

Resource missing metadata labels (report-only · guidance)

Add metadata labels for filtering and tooling.

WK8103

Container missing name (merge-worthy · guidance)

Add the required container name.

WK8104

Container ports not named (report-only · guidance)

Name ports for clearer Service/NetworkPolicy config.

WK8105

imagePullPolicy not explicit (report-only · guidance)

Set imagePullPolicy explicitly to avoid surprising defaults.

Prior art	Fairwinds Polaris pullPolicyNotAlways (overlaps) · kube-score container-image-pull-policy (overlaps) · Checkov CKV_K8S_15 (overlaps)

WK8201

Container missing resource limits (report-only · guidance)

Set CPU and memory limits.

Prior art	Fairwinds Polaris cpuLimitsMissing (overlaps) · Checkov CKV_K8S_13 (overlaps) · kube-score container-resources (overlaps)

WK8202

Privileged container (merge-worthy · guidance)

Remove privileged: true; grant only the specific capabilities needed.

Authority	Kubernetes — Pod Security Standards
Prior art	KubeLinter privileged-container (equivalent) · Fairwinds Polaris runAsPrivileged (equivalent) · Checkov CKV_K8S_16 (equivalent)

WK8203

Root filesystem is writable (merge-worthy · guidance)

Set readOnlyRootFilesystem: true.

Authority	Kubernetes — Pod Security Standards
Prior art	KubeLinter no-read-only-root-fs (equivalent) · Fairwinds Polaris notReadOnlyRootFilesystem (equivalent) · Checkov CKV_K8S_22 (equivalent)

WK8204

Container may run as root (merge-worthy · guidance)

Set runAsNonRoot: true (and a non-zero runAsUser).

Authority	Kubernetes — Pod Security Standards
Prior art	Fairwinds Polaris runAsRootAllowed (equivalent) · Checkov CKV_K8S_23 (equivalent) · KubeLinter run-as-non-root (overlaps)

WK8205

Capabilities not dropped (merge-worthy · guidance)

drop: [ALL] and add back only what is required.

Authority	Kubernetes — Pod Security Standards
Prior art	[kubesec `containers[] .securityContext .capabilities .drop

WK8207

Pod uses host network (merge-worthy · guidance)

Remove hostNetwork; it bypasses network isolation.

Authority	Kubernetes — Pod Security Standards
Prior art	KubeLinter host-network (equivalent) · Fairwinds Polaris hostNetworkSet (equivalent) · Checkov CKV_K8S_19 (equivalent)

WK8208

Pod shares host PID namespace (merge-worthy · guidance)

Remove hostPID.

Authority	Kubernetes — Pod Security Standards
Prior art	KubeLinter host-pid (equivalent) · Fairwinds Polaris hostPIDSet (equivalent) · Checkov CKV_K8S_17 (equivalent)

WK8209

Pod shares host IPC namespace (merge-worthy · guidance)

Remove hostIPC.

Authority	Kubernetes — Pod Security Standards
Prior art	KubeLinter host-ipc (equivalent) · Fairwinds Polaris hostIPCSet (equivalent) · Checkov CKV_K8S_18 (equivalent)

WK8301

Container missing probes (report-only · guidance)

Add liveness and readiness probes.

Prior art	kube-score pod-probes (overlaps) · Fairwinds Polaris readinessProbeMissing (overlaps) · Checkov CKV_K8S_8 (overlaps)

WK8302

Deployment has a single replica (report-only · guidance)

Use replicas >= 2 for availability.

Prior art	Fairwinds Polaris deploymentMissingReplicas (equivalent) · kube-score deployment-replicas (equivalent) · Datree ensure-minimum-two-replicas (equivalent)

WK8303

No PodDisruptionBudget for an HA Deployment (report-only · guidance)

Add a PDB to protect availability during disruptions.

Prior art	kube-score deployment-has-poddisruptionbudget (overlaps) · Fairwinds Polaris missingPodDisruptionBudget (overlaps) · KICS Deployment Without PodDisruptionBudget (overlaps)

WK8304

SSL redirect without a certificate (report-only · guidance)

Provide a certificate and HTTPS listen-ports for the ssl-redirect annotation.

Prior art	Fairwinds Polaris tlsSettingsMissing (overlaps)

WK8305

Ingress backend port does not match the Service (merge-worthy · guidance)

Point the Ingress backend at a declared Service port.

Prior art	KubeLinter dangling-ingress (overlaps) · kube-score ingress-targets-service (overlaps)

WK8306

Container command starts with a flag (merge-worthy · guidance)

The first command element should be a binary, not a flag.

WK8401

shmSize exceeds the container memory limit (merge-worthy · guidance)

Lower shmSize or raise the memory limit so the pod can schedule.

WK8402

RayCluster missing spec.rayVersion (report-only · guidance)

Set spec.rayVersion so KubeRay picks the right autoscaler image.

WK8403

rayVersion does not match the head image tag (report-only · guidance)

Align spec.rayVersion with the Ray version in the head container image.

WK8404

GPU request without a matching toleration (merge-worthy · guidance)

Add a toleration for the nvidia.com/gpu taint (or a wildcard Exists toleration) so the pod can schedule onto a GPU node pool.

WK8405

Serving workload has no PodDisruptionBudget (report-only · guidance)

Add a PDB selecting the InferenceService/serving Deployment so a node drain can’t take down every replica at once.

Prior art	kube-score deployment-has-poddisruptionbudget (overlaps) · Fairwinds Polaris missingPodDisruptionBudget (overlaps)

WK8406

GPU container missing resource limits (merge-worthy · guidance)

Set CPU and memory limits on GPU-requesting containers to avoid starving the (scarce, expensive) GPU node.

Prior art	Checkov CKV_K8S_13 (overlaps) · kube-score container-resources (overlaps) · KubeLinter unset-memory-requirements (overlaps)

WK8407

Unpinned model version (merge-worthy · guidance)

Pin the InferenceService model storageUri to an explicit version segment (e.g. via the Model composite’s required version) instead of a floating tag.

WK8501

Custom resource spec has a field its CRD does not declare (merge-worthy · guidance)

Fix the field name; the API server prunes unknown fields and the controller never sees them.

Prior art	KubeLinter schema-validation (overlaps)

WK8502

Custom resource spec field has the wrong type or enum value (merge-worthy · guidance)

Match the CRD schema: use the declared scalar type and one of the enum values.

Prior art	KubeLinter schema-validation (overlaps)

WK8503

Workload consumes a Secret nothing in the output produces (merge-worthy · guidance)

Produce the Secret in the same build (Secret, ExternalSecret, InfisicalSecret, cert-manager Certificate), or declare its provenance with declareSecret() if it exists out of band.

Prior art	KubeLinter env-value-from (overlaps)

WK8504

committed-encrypted secret declaration does not resolve (merge-worthy · guidance)

Point file at the committed ciphertext, make its metadata.name match the declaration, and re-run sops -e -i so every data/stringData value is ENC[…].

Authority	Kubernetes — Good practices for Secrets

WK8505

committed-encrypted secret with no Flux decryption wiring (report-only · guidance)

Add decryption: “sops” to the FluxAppFor reconciling the path that carries the ciphertext sidecar, or ignore if that Kustomization is declared in a different build. This check sees one build root at a time, so it goes silent once the secret and the Kustomization live in different build roots (chant #1939).

Prior art	Flux Kustomization API reference .spec.decryption (overlaps)

WK8601

OpenTelemetry Collector runs tail_sampling on every node (merge-worthy · guidance)

Move tail_sampling from the DaemonSet agent to a gateway Deployment, and send traces to it through a loadbalancing exporter routed by traceID.

WK8602

Multi-replica tail sampling gateway reached without trace-aware load balancing (merge-worthy · guidance)

Send traces to the gateway through a loadbalancing exporter with routing_key traceID (k8s resolver, or dns on a headless Service), or run the gateway with one replica. It goes silent when the senders are in another build root (chant #1939).

WK8603

k8s_cluster receiver runs in every collector copy (merge-worthy · guidance)

Run the k8s_cluster receiver in a single-replica Deployment, or set its k8s_leader_elector to a k8s_leader_elector extension enabled in service.extensions.

WK8604

Collector config in a ConfigMap fails the otel config checks (merge-worthy · guidance)

Fix the collector config the ConfigMap carries: each finding keeps its OTEL1xx id and names the ConfigMap and key. Change the declared components and pipelines, not the rendered YAML.

WK8605

Collector config reads the node but its workload lacks the node name or host mounts (merge-worthy · guidance)

Set the node name variable from spec.nodeName with the downward API and mount the host paths hostmetrics and filelog read, read-only; OtelCollector adds them from the config.

WK8606

PrometheusRule groups fail the prometheus rule-file checks (merge-worthy · guidance)

Fix the rule group the PrometheusRule carries: each finding keeps its PROM1xx or PROM2xx id and names the PrometheusRule. Change the declared RuleGroup, not the rendered YAML.

WK8701

PrometheusRule selected by no Prometheus or ThanosRuler (merge-worthy · guidance)

Match the rule’s labels and namespace with ruleSelector and ruleNamespaceSelector; null selects nothing, {} selects all.

WK8702

Monitor selected by no Prometheus or PrometheusAgent (merge-worthy · guidance)

Match the ServiceMonitor, PodMonitor, Probe or ScrapeConfig with the selector and namespace selector for its kind; null selects nothing, {} selects all.

WK8703

AlertmanagerConfig selected by no Alertmanager (merge-worthy · guidance)

Match the config’s labels and namespace with alertmanagerConfigSelector and alertmanagerConfigNamespaceSelector; null selects nothing, {} selects all.

WK8704

Monitor selects no Service or pod, or names a port that is not there (merge-worthy · guidance)

Make the monitor’s selector match the labels on the Service or pod template, and name a port the Service or container declares.

WK8705

Prometheus selects no monitor at all (merge-worthy · guidance)

Set serviceMonitorSelector, podMonitorSelector, probeSelector and scrapeConfigSelector for the monitor kinds it should scrape; {} selects all in the selected namespaces.

Docker (DKRD)

Run against Dockerfiles and Compose files.

DKRD001

Service uses :latest or untagged image (merge-worthy · guidance)

Pin the image to an explicit version tag (ideally a digest).

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	hadolint DL3007 (overlaps) · Checkov CKV_DOCKER_7 (overlaps) · KICS image_version_using_latest (overlaps)

DKRD002

Named volume declared but unused (report-only · guidance)

Remove the unused volume or mount it in a service.

DKRD003

Service exposes SSH (port 22) (merge-worthy · guidance)

Don’t expose SSH from a container; use exec/ephemeral access instead.

Authority	Docker — Security best practices
Prior art	Checkov CKV_DOCKER_1 (overlaps) · KICS Exposing Port 22 (SSH) (overlaps)

DKRD010

apt-get install without —no-install-recommends (report-only · guidance)

Add —no-install-recommends to keep images small.

Prior art	hadolint DL3015 (equivalent) · KICS apt_get_not_avoiding_additional_packages (equivalent)

DKRD011

ADD used where COPY would do (report-only · guidance)

Prefer COPY unless fetching a URL or extracting an archive.

Prior art	hadolint DL3020 (equivalent) · Checkov CKV_DOCKER_4 (overlaps) · Dockle CIS-DI-0009 (overlaps)

DKRD012

Container runs as root: the final stage has no USER, or ends on USER root (merge-worthy · guidance)

Add a non-root USER instruction to the final stage, after the root setup steps.

Authority	Docker — Security best practices
Prior art	Checkov CKV_DOCKER_3 (equivalent) · KICS missing_user_instruction (equivalent) · Dockle CIS-DI-0001 (overlaps) · hadolint DL3002 (overlaps)

DKRD013

Whole build context copied before a dependency install (report-only · guidance)

Copy the dependency manifests, run the install, then copy the rest of the source.

DKRD014

Root-only RUN after a non-root USER (report-only · guidance)

Run package installs and user/ownership changes before switching USER.

DKRD015

More than one CMD or ENTRYPOINT in a stage (report-only · guidance)

Keep one CMD and one ENTRYPOINT per stage; only the last takes effect.

Prior art	hadolint DL4003 (overlaps) · hadolint DL4004 (overlaps)

DKRD016

COPY —from names no earlier stage (report-only · guidance)

Name a stage defined earlier in the Dockerfile, or a tagged image.

Prior art	hadolint DL3022 (overlaps)

DKRD017

ARG before FROM is never used (report-only · guidance)

Use the ARG in a FROM line, declare it again in the stage that needs it, or remove it.

DKRD018

Relative WORKDIR (report-only · guidance)

Use an absolute WORKDIR path.

Prior art	hadolint DL3000 (overlaps)

DKRD019

ADD of a remote URL without —checksum (report-only · guidance)

Add —checksum=sha256:<digest> to ADD of an http(s) URL.

DKRD020

apt-get update in its own RUN (report-only · guidance)

Run apt-get update and apt-get install in the same RUN.

Prior art	Checkov CKV_DOCKER_5 (overlaps)

AWS CloudFormation (WAW / COR / EXT)

Run against CloudFormation templates (JSON or YAML).

COR020

Circular resource dependency (merge-worthy · guidance)

Break the dependency cycle between resources.

Prior art	cfn-lint E3004 (equivalent)

EXT001

Extension constraint violation (merge-worthy · guidance)

Fix the cross-property constraint flagged by the cfn-lint extension schema.

Prior art	cfn-lint (equivalent) · cfn-lint E3014 (equivalent) · cfn-lint E3021 (equivalent)

WAW010

Redundant DependsOn (report-only · guidance)

Remove DependsOn already implied by a Ref/GetAtt.

Prior art	cfn-lint W3005 (equivalent)

WAW011

Deprecated Lambda runtime (report-only · guidance)

Upgrade to a supported Lambda runtime.

Prior art	cfn-lint W2531 (equivalent) · Checkov CKV_AWS_363 (equivalent)

WAW013

Child stack exports nothing (merge-worthy · guidance)

Add stackOutput() exports the parent can reference.

WAW014

Nested stack outputs never referenced (report-only · guidance)

Reference the outputs or split into a separate build.

WAW015

Circular dependency between nested stacks (merge-worthy · guidance)

Break the cycle between nested stacks.

WAW016

Deprecated property (report-only · guidance)

Replace the deprecated CloudFormation property.

WAW017

Missing tags on a taggable resource (report-only · guidance)

Add tags for cost allocation and compliance.

Prior art	KICS Lambda Function Without Tags (extends) · KICS EFS Without Tags (extends)

WAW018

S3 bucket missing public access block (merge-worthy · guidance)

Add a PublicAccessBlockConfiguration blocking all public access.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	AWS Guard Rules Registry S3_BUCKET_LEVEL_PUBLIC_ACCESS_PROHIBITED (equivalent) · Checkov CKV_AWS_53 (extends) · Checkov CKV_AWS_56 (extends)

WAW019

Security group allows unrestricted ingress on a sensitive port (merge-worthy · guidance)

Restrict the CIDR on SSH/RDP/database ports to known sources.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	AWS Guard Rules Registry RESTRICTED_INCOMING_TRAFFIC (overlaps) · KICS EC2 Sensitive Port Is Publicly Exposed (overlaps) · Checkov CKV_AWS_24 (extends)

WAW020

IAM policy uses a wildcard Action (merge-worthy · guidance)

Scope the policy to specific actions (least privilege).

Authority	AWS — Security Pillar (Well-Architected)
Prior art	Checkov CKV_AWS_63 (equivalent) · cfn_nag F4 (overlaps) · AWS Guard Rules Registry IAM_ROLE_NO_WILDCARD_ACTIONS_ON_PERMISSIONS (overlaps)

WAW021

RDS storage not encrypted (merge-worthy · guidance)

Enable StorageEncrypted for encryption at rest.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag F27 (equivalent) · Checkov CKV_AWS_16 (equivalent) · AWS Guard Rules Registry RDS_STORAGE_ENCRYPTED (equivalent)

WAW022

Lambda has no VpcConfig (report-only · guidance)

Consider a VpcConfig for network isolation if the function needs VPC resources.

Prior art	cfn_nag W89 (equivalent) · Checkov CKV_AWS_117 (equivalent) · AWS Guard Rules Registry LAMBDA_INSIDE_VPC (equivalent)

WAW023

CloudFront has no WAF web ACL (report-only · guidance)

Consider attaching a WAF web ACL.

Prior art	Checkov CKV_AWS_68 (equivalent) · KICS CloudFront Without WAF (equivalent)

WAW024

ALB access logging disabled (report-only · guidance)

Enable access logging for audit trails.

Prior art	cfn_nag W52 (equivalent) · Checkov CKV_AWS_91 (equivalent) · KICS ELBv2 ALB Access Log Disabled (equivalent)

WAW025

SNS topic not encrypted (merge-worthy · guidance)

Set KmsMasterKeyId for encryption at rest.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag W47 (equivalent) · Checkov CKV_AWS_26 (equivalent) · AWS Guard Rules Registry SNS_ENCRYPTED_KMS (equivalent)

WAW026

SQS queue not encrypted (merge-worthy · guidance)

Enable SqsManagedSseEnabled or set KmsMasterKeyId.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	Checkov CKV_AWS_27 (equivalent) · KICS SQS With SSE Disabled (equivalent) · cfn_nag W48 (overlaps)

WAW027

DynamoDB point-in-time recovery disabled (report-only · guidance)

Enable PITR for recovery.

Prior art	cfn_nag W78 (equivalent) · Checkov CKV_AWS_28 (equivalent) · AWS Guard Rules Registry DYNAMODB_PITR_ENABLED (equivalent)

WAW028

EBS volume not encrypted (merge-worthy · guidance)

Enable encryption at rest.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag F1 (equivalent) · Checkov CKV_AWS_3 (equivalent) · AWS Guard Rules Registry ENCRYPTED_VOLUMES (equivalent)

WAW029

Invalid DependsOn target (merge-worthy · guidance)

Fix the dangling/self DependsOn reference.

Prior art	cfn-lint E3005 (equivalent)

WAW030

Missing DependsOn for a known ordering pattern (report-only · guidance)

Add the DependsOn the pattern requires.

WAW031

EKS Addon missing ServiceAccountRoleArn (report-only · guidance)

Set ServiceAccountRoleArn (IRSA) for addons that need it.

WAW032

EFS transit encryption disabled on Fargate (merge-worthy · guidance)

Enable transit encryption for the EFS volume.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	Checkov CKV_AWS_97 (equivalent) · KICS EFS Volume With Disabled Transit Encryption (equivalent)

WAW033

Solr heap exceeds Fargate task memory (merge-worthy · guidance)

Lower SOLR_HEAP or raise task memory.

WAW034

Fargate Solr task under-provisioned (report-only · guidance)

Allocate >= 2048MB for the Solr task.

WAW035

Solr container missing nofile ulimit (report-only · guidance)

Set a nofile ulimit >= 65535.

WAW036

Non-ASCII characters in resource properties (merge-worthy · guidance)

Remove non-ASCII characters rejected at changeset time.

WAW037

Null values in resource properties (merge-worthy · guidance)

Fix the invalid AttrRef producing null property values.

WAW038

RDS instance is publicly accessible (merge-worthy · guidance)

Set PubliclyAccessible: false and reach the database through the VPC.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag F22 (equivalent) · Checkov CKV_AWS_17 (equivalent) · KICS RDS DB Instance Publicly Accessible (equivalent)

WAW039

RDS automated backups disabled (merge-worthy · guidance)

Set a positive BackupRetentionPeriod.

Prior art	cfn_nag W75 (equivalent) · AWS Guard Rules Registry DB_INSTANCE_BACKUP_ENABLED (equivalent) · KICS RDS With Backup Disabled (equivalent)

WAW040

RDS deletion protection disabled (full tier) (merge-worthy · guidance)

Set DeletionProtection: true on the full/production tier.

Prior art	cfn_nag F80 (equivalent) · AWS Guard Rules Registry RDS_INSTANCE_DELETION_PROTECTION_ENABLED (equivalent) · KICS RDS DB Instance With Deletion Protection Disabled (equivalent)

WAW041

RDS Proxy does not require TLS (merge-worthy · guidance)

Set RequireTLS: true on the DB proxy.

Authority	AWS — Security Pillar (Well-Architected)

WAW042

S3 bucket missing a TLS-only bucket policy (merge-worthy · guidance)

Add a Deny statement keyed on aws:SecureTransport = false.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	AWS Guard Rules Registry S3_BUCKET_SSL_REQUESTS_ONLY (equivalent) · KICS S3 Bucket Without SSL In Write Actions (overlaps)

WAW043

KMS key rotation disabled (merge-worthy · guidance)

Set EnableKeyRotation: true on the customer-managed key.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag F19 (equivalent) · Checkov CKV_AWS_7 (equivalent) · AWS Guard Rules Registry CMK_BACKING_KEY_ROTATION_ENABLED (equivalent)

WAW044

ALB HTTP listener does not redirect to HTTPS (full tier) (merge-worthy · guidance)

Add a redirect DefaultAction (Protocol: HTTPS) to the HTTP listener on the full/production tier.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	Checkov CKV_AWS_2 (overlaps) · cfn_nag W56 (overlaps)

WAW045

ALB listener uses a weak or missing TLS policy (merge-worthy · guidance)

Set SslPolicy to a TLS 1.2+ predefined policy.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag W55 (equivalent) · Checkov CKV_AWS_103 (equivalent) · AWS Guard Rules Registry ELBV2_LISTENER_SSL_POLICY_RULE (equivalent)

WAW046

ECS container passes a secret via plaintext Environment (merge-worthy · guidance)

Move the value to Secrets (Secrets Manager/SSM Parameter Store).

Authority	AWS — Security Pillar (Well-Architected)

WAW047

ECS container runs privileged (merge-worthy · guidance)

Remove Privileged: true from the container definition.

Authority	AWS — Security Pillar (Well-Architected)

WAW048

ECS container missing log configuration (report-only · guidance)

Add a LogConfiguration (e.g. awslogs) to the container.

WAW049

Security group allows unrestricted ingress on a non-ALB port (merge-worthy · guidance)

Restrict the CIDR; only ALB:80/443 is exempt from this rule.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag W2 (overlaps) · AWS Guard Rules Registry EC2_SECURITY_GROUP_INGRESS_OPEN_TO_WORLD_RULE (overlaps) · KICS Unrestricted Security Group Ingress (overlaps)

WAW050

Cognito advanced security disabled (merge-worthy · guidance)

Set UserPoolAddOns.AdvancedSecurityMode to AUDIT or ENFORCED.

Authority	AWS — Security Pillar (Well-Architected)

WAW051

Cognito UserPoolClient allows the implicit OAuth grant (merge-worthy · guidance)

Drop “implicit” from AllowedOAuthFlows; use the code grant.

Authority	AWS — Security Pillar (Well-Architected)

WAW052

Cognito MFA not required (full tier) (merge-worthy · guidance)

Set MfaConfiguration: ON on the full/production tier.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag F78 (overlaps) · AWS Guard Rules Registry COGNITO_USER_POOL_MFA_CONFIGURATION_RULE (overlaps) · KICS Cognito UserPool Without MFA (overlaps)

WAW053

ECR repository does not scan images on push (merge-worthy · guidance)

Set ImageScanningConfiguration.ScanOnPush: true.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	cfn_nag W79 (equivalent) · Checkov CKV_AWS_163 (equivalent) · AWS Guard Rules Registry ECR_REPO_SCAN_ON_PUSH (equivalent)

WAW054

ECR repository allows mutable image tags (merge-worthy · guidance)

Set ImageTagMutability: IMMUTABLE.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	Checkov CKV_AWS_51 (equivalent) · KICS ECR Image Tag Not Immutable (equivalent)

WAW055

CloudWatch Logs log group has no retention period (report-only · guidance)

Set an explicit RetentionInDays.

Prior art	cfn_nag W86 (equivalent) · Checkov CKV_AWS_66 (equivalent) · AWS Guard Rules Registry CW_LOGGROUP_RETENTION_PERIOD_CHECK (equivalent)

WAW056

SCP guardrail has no Deny statement (merge-worthy · guidance)

Add a Deny statement — SCPs only filter permissions, so a Deny-less SCP guards nothing.

Authority	AWS — Security Pillar (Well-Architected)

WAW057

SCP guardrail attached to no targets (merge-worthy · guidance)

Attach the SCP to the organization root or an OU via TargetIds.

Authority	AWS — Security Pillar (Well-Architected)

WAW058

Organization audit trail dropped or scoped down (merge-worthy · guidance)

Keep an organization CloudTrail with IsLogging: true and IsMultiRegionTrail: true.

Authority	AWS — Security Pillar (Well-Architected)
Prior art	AWS Guard Rules Registry MULTI_REGION_CLOUD_TRAIL_ENABLED (overlaps) · Checkov CKV_AWS_67 (overlaps) · KICS CloudTrail Logging Disabled (overlaps)

WAW059

Wildcard Resource where the declared graph enumerates the touched set (report-only · guidance)

Tighten Resource from ”*” to the Fn::GetAtt Arn list of the declared resources the role’s consumers touch.

Prior art	cfn_nag W12 (overlaps) · cfn_nag W11 (overlaps) · AWS Guard Rules Registry IAM_POLICYDOCUMENT_NO_WILDCARD_RESOURCE (overlaps)

WAW060

IAM policy attached to no principal (report-only · guidance)

Attach the policy via Roles/Users/Groups or reference it from a principal’s ManagedPolicyArns — unattached it grants nothing.

WAW061

Subnet CidrBlock not contained in its VPC’s CidrBlock (merge-worthy · guidance)

Fix the subnet’s CidrBlock so it falls within the VPC’s CidrBlock range.

Prior art	cfn-lint E3059 (equivalent)

WAW062

Duplicate export name or explicit resource name within a template (merge-worthy · guidance)

Give each duplicated Export/name a distinct literal value.

Prior art	cfn-lint E3019 (overlaps)

WAW063

IAM policy denies an action another attached policy on the same role allows (merge-worthy · guidance)

Remove or narrow the Deny, or move the Allow off this role — the explicit Deny always wins.

WAW064

Transit Gateway route table declares a Blackhole route (report-only · guidance)

Confirm the traffic drop is intentional; remove the route if it isn’t.

WAW065

Transit Gateway route table wiring is incomplete (report-only · guidance)

Add the missing TransitGatewayRouteTablePropagation, or wire the orphaned attachment into a route table.

WAW066

Private subnet’s route table has no working default route (merge-worthy · guidance)

Add a 0.0.0.0/0 route to a NAT gateway/Transit Gateway that exists in the template.

WAW067

Single-AZ NAT gateway serves multi-AZ private subnets (report-only · guidance)

Add one NAT gateway per Availability Zone and point each AZ’s subnets at its own.

WAW068

VPN Gateway or Transit Gateway has only one attached VPN Connection (report-only · guidance)

Attach a second VPNConnection (ideally to a separate Customer Gateway) for redundancy.

WAW069

Template references a condition it never declares (merge-worthy · guidance)

Declare the condition in the Conditions section (new Condition(…)), or fix the referenced name.

Prior art	cfn-lint E8002 (equivalent)

WAW070

Ref or Fn::GetAtt names something the template doesn’t declare (merge-worthy · guidance)

Reference a resource or parameter in this template. A value from another lexicon’s resource arrives as a parameter.

Prior art	cfn-lint E1012 (equivalent) · cfn-lint E1010 (overlaps)

WAW071

Tags are in the wrong property or the wrong shape for the resource type (merge-worthy · guidance)

Write the tags in the property the type uses and in the shape it takes, which is a list of Key and Value pairs for most types and a map for some, such as UserPoolTags on AWS::Cognito::UserPool.

Prior art	cfn-lint E3002 (overlaps) · cfn-lint E3012 (overlaps)

Azure ARM (AZR)

Run against ARM deployment templates (JSON).

AZR010

Redundant dependsOn (report-only · guidance)

Remove dependsOn already implied by reference()/resourceId().

Prior art	Bicep linter no-unnecessary-dependson (equivalent)

AZR011

Missing or invalid apiVersion (merge-worthy · guidance)

Set a valid YYYY-MM-DD apiVersion on every resource.

Prior art	ARM Template Toolkit (arm-ttk) apiVersions-Should-Be-Recent (overlaps)

AZR012

Deprecated API version (report-only · guidance)

Move to a current apiVersion.

Prior art	ARM Template Toolkit (arm-ttk) apiVersions-Should-Be-Recent (overlaps) · Bicep linter use-recent-api-versions (overlaps)

AZR013

Resource missing location (merge-worthy · guidance)

Add the required location property.

AZR014

Storage account allows public blob access (merge-worthy · guidance)

Set allowBlobPublicAccess to false.

Authority	Microsoft Cloud Security Benchmark
Prior art	PSRule for Azure Azure.Storage.BlobPublicAccess (equivalent) · Checkov CKV_AZURE_59 (equivalent)

AZR015

Storage account missing encryption (merge-worthy · guidance)

Enable encryption services for data at rest.

Authority	Microsoft Cloud Security Benchmark

AZR016

Key Vault soft-delete not enabled (report-only · guidance)

Enable soft-delete.

Prior art	PSRule for Azure Azure.KeyVault.SoftDelete (equivalent) · Checkov CKV_AZURE_111 (equivalent) · KICS Key Vault Not Recoverable (overlaps)

AZR017

Key Vault purge protection not enabled (report-only · guidance)

Enable purge protection.

Prior art	PSRule for Azure Azure.KeyVault.PurgeProtect (equivalent) · Checkov CKV_AZURE_110 (equivalent) · KICS Key Vault Not Recoverable (overlaps)

AZR018

SQL Server missing auditing (report-only · guidance)

Enable auditing for compliance and threat detection.

Prior art	PSRule for Azure Azure.SQL.Auditing (equivalent) · Checkov CKV_AZURE_23 (equivalent) · KICS SQL Server Database Without Auditing (equivalent)

AZR019

SQL database missing TDE (merge-worthy · guidance)

Enable Transparent Data Encryption.

Authority	Microsoft Cloud Security Benchmark
Prior art	PSRule for Azure Azure.SQL.TDE (equivalent)

AZR020

App Service missing managed identity (report-only · guidance)

Enable a system- or user-assigned identity.

Prior art	PSRule for Azure Azure.AppService.ManagedIdentity (equivalent) · Checkov CKV_AZURE_71 (equivalent)

AZR021

App Service not HTTPS-only (merge-worthy · guidance)

Set httpsOnly to true.

Authority	Microsoft Cloud Security Benchmark
Prior art	PSRule for Azure Azure.AppService.UseHTTPS (equivalent) · Checkov CKV_AZURE_14 (equivalent) · KICS Website Not Forcing HTTPS (equivalent)

AZR022

App Service min TLS below 1.2 (merge-worthy · guidance)

Set minTlsVersion to 1.2+.

Authority	Microsoft Cloud Security Benchmark
Prior art	PSRule for Azure Azure.AppService.MinTLS (equivalent) · Checkov CKV_AZURE_15 (equivalent) · KICS Web App Not Using TLS Last Version (equivalent)

AZR023

VM not using a managed disk (report-only · guidance)

Use a managed disk.

Prior art	PSRule for Azure Azure.VM.UseManagedDisks (equivalent) · Checkov CKV_AZURE_92 (equivalent)

AZR024

VM missing boot diagnostics (report-only · guidance)

Enable boot diagnostics.

AZR025

AKS cluster missing RBAC (report-only · guidance)

Enable Kubernetes RBAC.

Prior art	PSRule for Azure Azure.AKS.UseRBAC (equivalent) · Checkov CKV_AZURE_5 (equivalent) · KICS AKS Cluster RBAC Disabled (equivalent)

AZR026

AKS cluster missing network policy (report-only · guidance)

Configure a networkPolicy.

Prior art	PSRule for Azure Azure.AKS.NetworkPolicy (equivalent) · Checkov CKV_AZURE_7 (equivalent) · KICS AKS Cluster Network Policy Not Configured (equivalent)

AZR027

Container Registry admin user enabled (merge-worthy · guidance)

Disable the admin user; use Azure AD / service principals.

Authority	Microsoft Cloud Security Benchmark
Prior art	PSRule for Azure Azure.ACR.AdminUser (equivalent) · Checkov CKV_AZURE_137 (equivalent)

AZR028

Network interface missing NSG (report-only · guidance)

Associate an NSG to control traffic.

AZR029

Managed disk missing encryption (merge-worthy · guidance)

Enable encryption for data at rest.

Authority	Microsoft Cloud Security Benchmark
Prior art	Checkov CKV_AZURE_2 (equivalent) · KICS Azure Managed Disk Without Encryption (equivalent) · PSRule for Azure Azure.VM.ADE (overlaps)

AZR030

Resource at unsupported template scope (merge-worthy · guidance)

Move the resource to a project deployed at a scope its schema supports.

AZR031

Policy assignment not enforced (DoNotEnforce) (merge-worthy · guidance)

Set enforcementMode to Default so the assigned guardrail applies.

Authority	Microsoft Cloud Security Benchmark

AZR032

Custom policy definition assigned nowhere (merge-worthy · guidance)

Pair the policy definition with a policy assignment — unassigned it enforces nothing.

Authority	Microsoft Cloud Security Benchmark

AZR033

Subscriptions may leave the tenant (merge-worthy · guidance)

Set blockSubscriptionsLeavingTenant: true on the Microsoft.Subscription/policies resource.

Authority	Microsoft Cloud Security Benchmark

GCP Config Connector (WGC)

Run against Config Connector (cnrm.cloud.google.com) manifests.

WGC101

Storage/SQL without encryption configuration (merge-worthy · guidance)

Configure encryption (e.g. a CMEK key) for data at rest.

Authority	Google Cloud — Security best practices
Prior art	Google Cloud Policy Library GCPStorageCMEKEncryptionConstraintV1 (overlaps)

WGC102

Public IAM member (allUsers/allAuthenticatedUsers) (merge-worthy · guidance)

Remove allUsers/allAuthenticatedUsers bindings.

Authority	Google Cloud — Security best practices
Prior art	Checkov CKV_GCP_28 (overlaps) · KICS Cloud Storage Anonymous or Publicly Accessible (overlaps) · Google Cloud Policy Library GCPStorageBucketWorldReadableConstraintV1 (overlaps)

WGC103

Missing project-id annotation (report-only · guidance)

Add the cnrm.cloud.google.com/project-id annotation.

WGC104

Bucket without uniform bucket-level access (merge-worthy · guidance)

Enable uniformBucketLevelAccess.

Authority	Google Cloud — Security best practices
Prior art	Checkov CKV_GCP_29 (overlaps) · KICS Google Storage Bucket Level Access Disabled (overlaps) · Google Cloud Policy Library GCPStorageBucketPolicyOnlyConstraintV1 (overlaps)

WGC105

Cloud SQL open to 0.0.0.0/0 (merge-worthy · guidance)

Restrict authorizedNetworks to known sources.

Authority	Google Cloud — Security best practices
Prior art	Checkov CKV_GCP_11 (overlaps) · KICS SQL DB Instance Publicly Accessible (overlaps) · Google Cloud Policy Library GCPSQLWorldReadableConstraintV1 (overlaps)

WGC106

Missing deletion-policy annotation (report-only · guidance)

Add the cnrm.cloud.google.com/deletion-policy annotation.

WGC107

Bucket versioning disabled (report-only · guidance)

Enable object versioning.

Prior art	Checkov CKV_GCP_78 (overlaps) · KICS Cloud Storage Bucket Versioning Disabled (overlaps)

WGC108

Cloud SQL backups disabled (report-only · guidance)

Enable backup configuration.

Prior art	Checkov CKV_GCP_14 (overlaps) · KICS SQL DB Instance Backup Disabled (overlaps) · Google Cloud Policy Library GCPSQLBackupConstraintV1 (overlaps)

WGC109

Firewall open to 0.0.0.0/0 (merge-worthy · guidance)

Restrict sourceRanges to known sources.

Authority	Google Cloud — Security best practices
Prior art	Google Cloud Policy Library GCPRestrictedFirewallRulesConstraintV1 (overlaps) · Checkov CKV2_GCP_12 (overlaps)

WGC110

KMS key without rotation (merge-worthy · guidance)

Set a rotationPeriod on the CryptoKey.

Authority	Google Cloud — Security best practices
Prior art	Checkov CKV_GCP_43 (overlaps) · KICS High Google KMS Crypto Key Rotation Period (overlaps) · Google Cloud Policy Library GCPCMEKRotationConstraintV1 (overlaps)

WGC111

Reference to an undefined resource (merge-worthy · guidance)

Point the reference at a resource in the output.

WGC112

Missing or invalid apiVersion (merge-worthy · guidance)

Set a valid cnrm.cloud.google.com apiVersion.

WGC113

Alpha API version (report-only · guidance)

Move to a beta/GA API version.

WGC201

Missing managed-by label (report-only · guidance)

Add the app.kubernetes.io/managed-by label.

WGC202

Cluster without Workload Identity (merge-worthy · guidance)

Enable Workload Identity on the ContainerCluster.

Authority	Google Cloud — Security best practices
Prior art	Google Cloud Policy Library GCPGKEEnableWorkloadIdentityConstraintV1 (overlaps) · Checkov CKV_GCP_69 (overlaps)

WGC203

Node pool uses broad cloud-platform scope (merge-worthy · guidance)

Use narrowly-scoped OAuth scopes instead of cloud-platform.

Authority	Google Cloud — Security best practices
Prior art	Google Cloud Policy Library GCPGKEAllowedNodeSAConstraintV1 (overlaps) · Checkov CKV_GCP_31 (overlaps) · KICS VM With Full Cloud Access (overlaps)

WGC204

Compute instance without Shielded VM (report-only · guidance)

Enable Shielded VM configuration.

Prior art	Checkov CKV_GCP_39 (overlaps) · KICS Shielded VM Disabled (overlaps)

WGC301

No IAMAuditConfig found (report-only · guidance)

Configure audit logging via IAMAuditConfig.

Prior art	Google Cloud Policy Library GCPIAMAuditLogConstraint (overlaps) · Checkov CKV2_GCP_5 (overlaps)

WGC302

No Service (enabled APIs) found (report-only · guidance)

Declare the GCP APIs you depend on.

WGC303

No VPC Service Controls perimeter (report-only · guidance)

Consider an AccessContextManager ServicePerimeter.

Prior art	Google Cloud Policy Library GCPVPCSCEnsureProjectConstraintV1 (overlaps)

WGC401

Unknown field in resource spec (merge-worthy · guidance)

Remove the unknown spec field.

WGC402

Missing required spec field (merge-worthy · guidance)

Add the required spec field.

WGC403

Spec field has wrong type/structure (merge-worthy · guidance)

Fix the field’s type/structure.

WGC501

Org Policy guardrail not enforced (merge-worthy · guidance)

Enable enforce on the rule (or remove the policy deliberately) — a disabled org policy constrains nothing.

Authority	Google Cloud — Security best practices

WGC502

Org Policy guardrail defines no rules (merge-worthy · guidance)

Add rules to the OrgPolicyPolicy — without them the constraint binds nothing.

Authority	Google Cloud — Security best practices

WGC503

Audit logging dropped or scoped down (merge-worthy · guidance)

Keep auditLogConfigs populated and remove exemptedMembers from the IAMAuditConfig.

Authority	Google Cloud — Security best practices
Prior art	Google Cloud Policy Library GCPIAMAuditLogConstraint (overlaps) · Checkov CKV2_GCP_5 (overlaps) · KICS IAM Audit Not Properly Configured (overlaps)

Helm (WHM)

Run against Helm charts (Chart.yaml + templates).

WHM005

Sub-chart wrapper with no templates (report-only · guidance)

Deploy the upstream chart directly instead of an empty wrapper.

Prior art	helm lint templatesDirExists (overlaps)

WHM101

Chart.yaml missing required fields (merge-worthy · guidance)

Set apiVersion (v2), name, and version in Chart.yaml.

Prior art	helm lint Chartfile (validateChartName, validateChartAPIVersion, validateChartVersion) (equivalent) · chart-testing (ct) ct lint --chart-yaml-schema (overlaps)

WHM102

Missing values.schema.json (report-only · guidance)

Add a values.schema.json to validate values.

WHM103

Invalid Go template syntax (merge-worthy · guidance)

Fix the unbalanced template braces.

Prior art	helm lint Templates (render error) (equivalent)

WHM104

Missing NOTES.txt (report-only · guidance)

Add templates/NOTES.txt for application charts.

WHM105

Missing _helpers.tpl (report-only · guidance)

Add templates/_helpers.tpl.

WHM201

Missing standard Helm labels (report-only · guidance)

Add the recommended app.kubernetes.io labels.

WHM202

Hook weights undefined (report-only · guidance)

Define hook weights when multiple hooks exist.

WHM203

Undocumented values (report-only · guidance)

Document values via schema or comments.

WHM204

Dependencies pinned, not ranged (report-only · guidance)

Use semver ranges for chart dependencies.

WHM301

No Helm test (report-only · guidance)

Add at least one Helm test for application charts.

WHM302

Container resources not set (report-only · guidance)

Set limits/requests via values or defaults.

Prior art	kube-score container-resources (overlaps) · KubeLinter unset-cpu-requirements (overlaps) · Fairwinds Polaris cpuRequestsMissing (overlaps)

WHM401

Container image uses :latest or no tag (merge-worthy · guidance)

Pin the image to an explicit version tag.

Authority	OSSF Scorecard — Pinned-Dependencies
Prior art	kube-score container-image-tag (equivalent) · KICS Invalid Image Tag (equivalent) · Datree ensure-image-pinned-version (equivalent)

WHM402

Container may run as root (merge-worthy · guidance)

Set runAsNonRoot in the security context.

Authority	Kubernetes — Pod Security Standards
Prior art	kubesec containers[] .securityContext .runAsNonRoot == true (equivalent) · KICS Container Running As Root (equivalent) · kube-score container-security-context-user-group-id (overlaps)

WHM403

Root filesystem writable (merge-worthy · guidance)

Set readOnlyRootFilesystem.

Authority	Kubernetes — Pod Security Standards
Prior art	kubesec containers[] .securityContext .readOnlyRootFilesystem == true (equivalent) · KICS Root Container Not Mounted Read-only (equivalent) · kube-score container-security-context-readonlyrootfilesystem (equivalent)

WHM404

Privileged container (merge-worthy · guidance)

Remove privileged mode.

Authority	Kubernetes — Pod Security Standards
Prior art	kubesec containers[] .securityContext .privileged == true (equivalent) · KICS Container Is Privileged (equivalent) · kube-score container-security-context-privileged (equivalent)

WHM405

Resource specs missing cpu/memory (report-only · guidance)

Set cpu and memory in limits/requests.

Prior art	Checkov CKV_K8S_10 (overlaps) · Checkov CKV_K8S_12 (overlaps) · kubesec containers[] .resources .limits .memory (overlaps)

WHM406

CRDs in crds/ are never upgraded (report-only · guidance)

Manage CRD upgrades outside Helm or via a separate chart.

WHM407

Inline Secret data (merge-worthy · guidance)

Use ExternalSecret/SealedSecret instead of inline Secret data.

Authority	Kubernetes — Good practices for Secrets
Prior art	KICS Using Kubernetes Native Secret Management (overlaps)

WHM501

Unused values key (report-only · guidance)

Remove values defined but never referenced.

WHM502

Deprecated/invalid Kubernetes API version (merge-worthy · guidance)

Update to a supported apiVersion.

Prior art	Pluto detect-files (equivalent) · helm lint validateNoDeprecations (equivalent) · kube-score stable-version (equivalent)

WHM503

Pinned render carries Secret data (merge-worthy · guidance)

Declare the value with runtimeSlot() or replace the Secret with HelmExternalSecret.

Authority	Kubernetes — Good practices for Secrets
Prior art	KICS Using Kubernetes Native Secret Management (overlaps)

WHM504

Dead value assignment (merge-worthy · guidance)

Remove supplied values that never survive coalescing (shadowed, disabled subchart, or unknown subchart).

fountain (FTN)

Run against fountain manifests (apiVersion: fountain.dev/v1) — standalone fountain apply YAML is parsed back into the entity graph, so the same rules fire on chant build and chant audit.

FTN001

Literal credential in a fountain declaration (merge-worthy · guidance)

Use a ${VAR} substitution reference or an environment secret; never a literal in source.

Authority	OWASP Top 10 for LLM Applications — LLM01: Prompt Injection

FTN010

Environment does not set networking_type explicitly (merge-worthy · guidance)

Set networking_type — an open sandbox by silence is not a reviewed decision.

Authority	Managoat: Environment, Vault and Agent primitives

FTN011

Environment uses networking_type: unrestricted (merge-worthy · guidance)

Prefer limited with an allowed_hosts allowlist; an empty list denies all egress.

Authority	Managoat: Environment, Vault and Agent primitives

FTN012

Cloud-credential-shaped key or value in Environment env_vars (merge-worthy · guidance)

env_vars is plaintext config — move credentials to a secret, or serve the capability outside the sandbox.

Authority	OWASP Top 10 for LLM Applications — LLM01: Prompt Injection

FTN013

Agent ${VAR} reference does not resolve against its environment (report-only · guidance)

Declare the key on the environment, or confirm a vault supplies it at conversation create.

FTN014

Vault key shadows a declared Environment key (report-only · guidance)

Vault values win on key collision silently — rename the key or confirm the override is intended.

FTN015

Secret-shaped MCP env key is a literal, not a ${VAR} reference (merge-worthy · guidance)

Reference the value with ${VAR} so it resolves at spawn instead of living in source.

Authority	OWASP Top 10 for LLM Applications — LLM01: Prompt Injection
Prior art	agent-audit auth-bypass/env-secret-in-config (overlaps) · mcp-audit (APIsec) Secrets Detection (overlaps)

FTN016

Agent runtime or model is not a valid value (merge-worthy · guidance)

Use a known runtime and a canonical provider/model_id.

FTN017

Two declarations of one kind resolve to the same fountain name (merge-worthy · guidance)

fountain reconciles by name, so rename one. Otherwise the second silently overwrites the first.

FTN023

Agent runtime “acp” is missing runtime_command, or another runtime carries one (merge-worthy · guidance)

Pair the acp runtime with the command it speaks the protocol over, and drop the field elsewhere.

FTN024

Environment setup_timeout_seconds is outside 1 to 900, or not a whole number (merge-worthy · guidance)

Use an integer from 1 to 900, or omit the field for fountain’s default of 120. Changing the value invalidates the environment’s checkpoints.

FTN025

A declaration uses a kind or value Managoat removed (merge-worthy · guidance)

Replace a Teammate, Schedule or Webhook, a persistent sandbox_mode, a daytona or runner provider, or the opencode runtime with what the message names. Managoat answers each with 404 or 422.

Terraform (TF)

Run against Terraform root modules (a directory of .tf files) parsed into the entity graph, so the same rules fire on chant build over terraform.roots and on chant audit (#2083).

TF001

Root module declares no remote backend (merge-worthy · guidance)

Add a backend "\<type>" block (s3, gcs, azurerm, http) or a cloud \{} block to the root module’s terraform block, then terraform init -migrate-state.

TF002

Provider implied by the root has no required_providers entry (merge-worthy · guidance)

Add the provider to the terraform block’s required_providers, with both source and version set, so a future provider release can’t silently change behavior.

Prior art	tflint-ruleset-terraform terraform_required_providers (equivalent) · HashiCorp reference Sentinel policies require-all-providers-have-version-constraint (equivalent) · AWS prescriptive guidance for Terraform Add automated version checks (equivalent)

TF003

Root module’s terraform block has no required_version (merge-worthy · guidance)

Set required_version = ">= \<lowest supported version>" in the terraform block.

Prior art	tflint-ruleset-terraform terraform_required_version (equivalent) · HashiCorp reference Sentinel policies restrict-terraform-versions (overlaps) · HashiCorp Terraform style guide Version pinning (overlaps)

TF004

Registry-sourced module block has no version (merge-worthy · guidance)

Add a version constraint to the module block (e.g. ~> 5.0).

Prior art	tflint-ruleset-terraform terraform_module_version (equivalent) · Checkov CKV_TF_2 (equivalent)

TF005

Git/hg module source is unpinned, or pinned to a mutable ref (merge-worthy · guidance)

Pin the module’s ?ref= to a tag or a full commit SHA.

Prior art	tflint-ruleset-terraform terraform_module_pinned_source (equivalent) · Checkov CKV_TF_1 (extends) · KICS 3a81fc06-566f-492a-91dd-7448e409e2cd (overlaps)

TF006

Default value on a sensitive variable (merge-worthy · guidance)

Delete the default and require the caller to supply the value at apply time, through a tfvars file kept out of version control, a TF_VAR_ entry in the environment, or a workspace input.

Prior art	tflint-ruleset-avm (Azure Verified Modules) avm_terraform_sensitive_variable_default_disallowed (equivalent)

TF007

Plaintext secret in a variable default or a locals value (merge-worthy · guidance)

Remove the literal, mark the variable sensitive = true, and read the value from a secret manager data source or an input at apply time, then rotate the credential, which is already in version control history.

Prior art	tfsec general-secrets-sensitive-in-variable (equivalent) · tfsec general-secrets-sensitive-in-local (equivalent)

TF008

Provider block configures a hardcoded credential (merge-worthy · guidance)

Delete the credential from the provider block and let the provider read it from the environment, a shared credentials file, or an OIDC role assumption. Rotate the credential.

Prior art	Checkov CKV_AWS_41 (overlaps) · KICS d7b9d850-3e06-4a75-852f-c46c2e92240b (overlaps) · Semgrep Registry rules terraform.aws.security.aws-provider-static-credentials (overlaps)

TF009

Credential-named variable is not marked sensitive (merge-worthy · guidance)

Add sensitive = true to the variable so its value is not printed in plan and apply output. The value is still stored in plaintext in state, so keep the state remote and encrypted.

Authority	HashiCorp Terraform style guide — Variables
Prior art	HashiCorp Terraform style guide Variables: for sensitive variables, such as passwords and private keys, set the sensitive parameter to true (equivalent)

TF010

Variable declares no type constraint (report-only · guidance)

Add a type to the variable (string, number, bool, list(string), object(\{...})).

Prior art	tflint-ruleset-terraform terraform_typed_variables (equivalent) · KICS fc5109bf-01fd-49fb-8bde-4492b543c34a (equivalent)

TF011

Undocumented variable (report-only · guidance)

Add a description saying what the value is for and what a valid one looks like.

Prior art	tflint-ruleset-terraform terraform_documented_variables (equivalent) · KICS 2a153952-2544-4687-bcc9-cc8fea814a9b (equivalent) · HashiCorp reference Sentinel policies validate-variables-have-descriptions (equivalent)

TF012

Undocumented output (report-only · guidance)

Write a description for the output, covering what the value is and what a caller can rely on it for.

Prior art	tflint-ruleset-terraform terraform_documented_outputs (equivalent) · KICS 59312e8a-a64e-41e7-a252-618533dd1ea8 (equivalent)

TF013

lifecycle ignore_changes is set to all (merge-worthy · guidance)

Replace ignore_changes = all with the list of attributes that genuinely change outside Terraform, so every other attribute is still reconciled.

Prior art	tflint-ruleset-redeploy terraform_ignore_changes_all (equivalent)

TF014

Child module configures a provider block (merge-worthy · guidance)

Move the provider configuration to the root module and pass it into the module with providers = \{ ... }, leaving at most an alias-only block in the module.

Prior art	tflint-ruleset-avm (Azure Verified Modules) avm_terraform_provider_block_disallowed (equivalent) · Google Cloud Terraform best-practices series Build reusable modules: modules must not configure providers (equivalent) · AWS prescriptive guidance for Terraform Structure: declare provider configurations in the root module (equivalent)

TF015

Child module declares a backend or cloud block (merge-worthy · guidance)

Delete the backend/cloud block from the child module. State belongs to the root module that calls it, one state for the whole tree.

Prior art	Google Cloud Terraform best-practices series Build reusable modules: state configuration belongs to the root module (equivalent)

TF016

Attribute value is a quoted interpolation of a single expression (report-only · deterministic)

Drop the quotes and the $\{}: write x = var.y, not x = "$\{var.y}".

Prior art	tflint-ruleset-terraform terraform_deprecated_interpolation (overlaps)

TF017

Module block uses depends_on (report-only · guidance)

Remove depends_on from the module call and pass an attribute of the dependency into a module input, so Terraform derives the narrower edge itself.

Prior art	tflint-ruleset-redeploy terraform_module_depends_on (equivalent)

TF018

Output value is a whole resource or data source (report-only · guidance)

Return the attribute the caller needs (.id, .arn, .endpoint) instead of the whole block.

Prior art	tflint-ruleset-redeploy terraform_output_resource (equivalent)

TF019

Meta-argument explicitly set to its default of false (report-only · deterministic)

Deleting the line is the whole fix. sensitive, ephemeral, prevent_destroy and create_before_destroy are false unless set.

Prior art	tflint-ruleset-redeploy terraform_redundant_default (equivalent)

TF020

Declaration is never referenced in its module scope (report-only · guidance)

Delete the variable, local, data source or aliased provider, or reference it where it was meant to be used.

Prior art	tflint-ruleset-terraform terraform_unused_declarations (overlaps)

TF021

count builds instance identities from count.index where for_each is safer (report-only · guidance)

Switch to for_each over a map or set so each instance is addressed by a stable key, then terraform state mv the existing indexed instances onto their new keys.

Prior art	tflint-ruleset-redeploy terraform_prefer_for_each (overlaps) · choudoufu RuleCountIndex (overlaps) · HashiCorp Terraform style guide Resources: use for_each for a dynamic resource count (overlaps)

TF022

Credential-named resource attribute holds a plaintext literal (merge-worthy · guidance)

Replace the constant with a lookup, either an input the caller supplies or a data source pointed at whatever vault owns the credential, and rotate what was committed.

Prior art	tfsec general-secrets-no-plaintext-exposure (overlaps) · KICS a88baa34-e2ad-44ea-ad6f-8cac87bc7c71 (overlaps)

TF023

Terraform state committed to the repository (merge-worthy · guidance)

Delete the state file (or .terraform/) from version control, add it to .gitignore, move the state to a remote backend, and rotate every credential the file held.

Authority	HashiCorp Terraform style guide — .gitignore
Prior art	HashiCorp Terraform style guide .gitignore: do not commit terraform.tfstate, terraform.tfstate.* backups, or the .terraform directory (equivalent)

TF024

Live root declares a backend or cloud block, which choudoufu ignores (merge-worthy · guidance)

Keep a backend block if other roots read this estate’s outputs or the record store should be derived from its bucket; declare record_store to put records elsewhere. Remove a cloud block, which choudoufu drops entirely, or swap it for a backend block.

Prior art	choudoufu RuleStateBackend (equivalent)

TF025

Live root references a non-default terraform.workspace, which choudoufu refuses (merge-worthy · guidance)

Remove workspace from the root’s terraform.roots config, and remove any terraform.workspace reference from its HCL; choudoufu refuses any workspace but “default” on a live root.

TF026

Live root declares delete: “never” but its policy leaves undeclared_tagged at “delete” (merge-worthy · guidance)

Add undeclared_tagged = “keep” (or “untag” or “report”) to the live root’s policy block, or change terraform.roots.<name>.delete to “owned-only” or “gated” if an owned orphan should be deleted after all.

TF027

Live root’s policy block sets undeclared_untagged = “delete” (merge-worthy · guidance)

Remove undeclared_untagged = “delete” from the live root’s policy block. chant never proposes deleting a resource it does not own; narrow the estate’s own ownership answer (undeclared_tagged) instead of the account’s.

Prior art	choudoufu RulePolicyScope (extends)

TF028

Live root is watched by a TerraformWatchOp built without live: true (merge-worthy · guidance)

Set live: true on the TerraformWatchOp that names this root, so the Plan phase runs choudoufuLivePlan and reports the unowned and adoptable counts as well as drift. Drop the root’s estate instead if it is not a live root.

TF029

Live root names its estate both in chant.config and in its own HCL (merge-worthy · guidance)

Pick one. A root whose directory is shared across environments declares no estate in HCL and names it per root with terraform.roots.<name>.estate; a root with its own live block already has an estate and needs nothing in chant.config. The declaration wins today, so the config value is written down and never used.

TF030

Security group rule allows unrestricted ingress on a sensitive port (merge-worthy · guidance)

Restrict the CIDR on SSH, RDP, MySQL and PostgreSQL ports to the sources that need them, or reach the host through a bastion, a VPN or SSM Session Manager.

Authority	AWS Well-Architected Framework, Security Pillar
Prior art	Checkov CKV_AWS_24 (overlaps) · Checkov CKV_AWS_25 (overlaps) · tfsec aws-vpc-no-public-ingress-sgr (overlaps) · trivy-checks aws-ec2-no-public-ingress-sgr (overlaps) · KICS 381c3f2a-ef6f-4eff-99f7-b169cda3422c (overlaps) · HashiCorp reference Sentinel policies restrict-ingress-sg-rule-ssh (overlaps) · HashiCorp reference Sentinel policies restrict-ingress-sg-rule-rdp (overlaps)

TF031

IAM policy allows a wildcard Action or Resource (merge-worthy · guidance)

Name the actions the workload calls and the ARNs it touches. For the few actions that accept only Resource ”*” (ecr:GetAuthorizationToken, sts:GetCallerIdentity), keep that statement on its own and suppress it with # chant-ignore-block: TF031. A policy TF031 reports as not determined is built from an expression; it is not a finding.

Authority	AWS IAM security best practices (Apply least-privilege permissions)
Prior art	tfsec aws-iam-no-policy-wildcards (overlaps) · Checkov CKV_AWS_63 (overlaps) · Checkov CKV_AWS_49 (extends) · Checkov CKV_AWS_355 (overlaps) · Checkov CKV_AWS_356 (overlaps)

TF032

ECS container definition passes a credential as a plaintext environment value (merge-worthy · guidance)

Move the value from the container’s environment to its secrets, with a valueFrom naming a Secrets Manager secret or SSM parameter, and rotate the committed value.

Authority	Amazon ECS Developer Guide: Pass sensitive data to an Amazon ECS container
Prior art	tfsec aws-ecs-no-plaintext-secrets (overlaps) · trivy-checks aws-ecs-no-plaintext-secrets (overlaps)

TF033

RDS DB instance or cluster storage is not encrypted (merge-worthy · guidance)

Set storage_encrypted = true (and kms_key_id for a customer managed key). An existing database cannot be encrypted in place: restore an encrypted copy of a snapshot. An Aurora cluster, or a database created from a snapshot or replica, is reported as not determined, not as a finding.

Authority	Amazon RDS User Guide: Encrypting Amazon RDS resources
Prior art	tfsec aws-rds-encrypt-instance-storage-data (overlaps) · tfsec aws-rds-encrypt-cluster-storage-data (overlaps) · trivy-checks aws-rds-encrypt-instance-storage-data (overlaps) · trivy-checks aws-rds-encrypt-cluster-storage-data (overlaps) · Checkov CKV_AWS_16 (overlaps) · Checkov CKV_AWS_96 (overlaps) · KICS 08bd0760-8752-44e1-9779-7bb369b2b4e4 (overlaps)

TF034

SNS topic has no server-side encryption (merge-worthy · guidance)

Set kms_master_key_id to a customer managed KMS key, or to "alias/aws/sns" for the AWS managed one. No AWS default encrypts a topic that names no key.

Authority	Amazon SNS Developer Guide: Securing Amazon SNS data with server-side encryption
Prior art	tfsec aws-sns-enable-topic-encryption (equivalent) · trivy-checks aws-sns-enable-topic-encryption (equivalent) · Checkov CKV_AWS_26 (equivalent) · KICS 28545147-2fc6-42d5-a1f9-cf226658e591 (equivalent)

TF035

SQS queue turns server-side encryption off (merge-worthy · guidance)

Remove sqs_managed_sse_enabled = false (new queues are encrypted with SSE-SQS by default), set it to true, or set kms_master_key_id. A queue that sets neither attribute is encrypted and is not reported.

Authority	Amazon SQS Developer Guide: Encryption at rest in Amazon SQS
Prior art	tfsec aws-sqs-enable-queue-encryption (overlaps) · trivy-checks aws-sqs-enable-queue-encryption (overlaps) · Checkov CKV_AWS_27 (overlaps) · KICS 6e8849c1-3aa7-40e3-9063-b85ee300f29f (overlaps)

TF036

EBS volume does not ask for encryption (merge-worthy · guidance)

Set encrypted = true (and kms_key_id for a customer managed key). A volume that leaves encrypted unset depends on the Region’s EBS encryption by default and is reported as not determined, not as a finding.

Authority	Amazon EBS User Guide: Amazon EBS encryption
Prior art	trivy-checks aws-ec2-enable-volume-encryption (overlaps) · Checkov CKV_AWS_3 (overlaps) · KICS cc997676-481b-4e93-aa81-d19f8c5e9b12 (overlaps)

TF037

ECR repository allows mutable image tags (merge-worthy · guidance)

Set image_tag_mutability = "IMMUTABLE", or "IMMUTABLE_WITH_EXCLUSION" with an image_tag_mutability_exclusion_filter naming the few moving tags (latest) that must stay mutable. The provider default is MUTABLE.

Authority	Amazon ECR User Guide: Preventing image tags from being overwritten
Prior art	tfsec aws-ecr-enforce-immutable-repository (overlaps) · trivy-checks aws-ecr-enforce-immutable-repository (overlaps) · Checkov CKV_AWS_51 (overlaps) · KICS d1846b12-20c5-4d45-8798-fc35b79268eb (overlaps)

TF038

OCI module source has no tag or digest, or a mutable tag (merge-worthy · guidance)

Pin the oci:// source with ?digest=sha256:... (a digest cannot move) or an exact version tag (?tag=1.4.0). A source with no tag pulls latest.

TF039

Registry module version is a range, not an exact version (report-only · guidance)

Set an exact version (version = "1.4.0") for projects that pin modules. Off by default.

TF040

Root has no committed .terraform.lock.hcl (report-only · guidance)

Run terraform init in the root and commit the .terraform.lock.hcl it writes. Off by default; checked only where the root’s directory is known.

TF041

Terragrunt dependency lets mock_outputs stand in for apply (merge-worthy · guidance)

Set mock_outputs_allowed_terraform_commands = ["validate", "plan"] on every dependency that sets mock_outputs. Terragrunt reads a missing or empty list as every command, apply included.

TF042

Terragrunt dependency sets skip_outputs together with mock_outputs (merge-worthy · guidance)

Drop skip_outputs, or pass the values as inputs. With skip_outputs = true the upstream outputs are never read, so every run uses the mocks.

TF043

Terragrunt terraform.source names no version (git ref, tfr version or oci tag) (merge-worthy · guidance)

Pin the source: ?ref= for git, ?version= for tfr://, ?digest= or ?tag= for oci://.

TF044

Terragrunt config keeps state in a local backend (merge-worthy · guidance)

Use a shared backend (S3, GCS) in remote_state. State written by backend = "local" stays on the runner and is lost with it.

TF045

No Terragrunt config sets terragrunt_version_constraint (report-only · guidance)

Set terragrunt_version_constraint = ">= 1.1.0" in the root config. Off by default; judged only across the configs scanned.

TF046

Live root resolves to the local record store in a CI run (report-only · guidance)

Keep or add a backend block of type s3, gcs or azurerm with a literal bucket, so choudoufu derives the record store from it, or declare record_store in the live block or estate.chdf.hcl. The rule is off by default and terragucci turns it on for its users; an emulator or test lane that keeps the local store on purpose sets CHANT_ALLOW_LOCAL_RECORD_STORE=1.

TF047

Live root pins a module version the known-module catalog has no row for, or one with refusals (report-only · guidance)

Run choudoufu live-check on the root to see each refused site, or pin a version whose examples are clear in the static tier of choudoufu’s module table (https://intentius.io/choudoufu/aws/compatibility/#modules). Off by default; terragucci turns it on for its users.

Secrets & credentials (SEC)

Lexicon-independent — scans the raw text of every scanned file for likely credentials, regardless of which audit lexicons are installed. Matched values are always redacted; see suppressing false positives.

SEC001

AWS access key ID found (merge-worthy · guidance)

Remove the key from source, rotate it in IAM, and load it from a secret store or environment variable instead.

Authority	GitHub — About secret scanning
Prior art	gitleaks aws-access-token (equivalent) · TruffleHog aws (overlaps) · detect-secrets AWSKeyDetector (equivalent)

SEC002

AWS secret access key found (merge-worthy · guidance)

Remove the key from source, rotate it in IAM, and load it from a secret store or environment variable instead.

Authority	GitHub — About secret scanning
Prior art	gitleaks generic-api-key (overlaps) · TruffleHog aws (overlaps) · detect-secrets AWSKeyDetector (overlaps)

SEC003

GitHub token found (merge-worthy · guidance)

Remove the token from source and revoke it at github.com/settings/tokens; use a GitHub Actions secret instead.

Authority	GitHub — About secret scanning
Prior art	gitleaks github-pat (overlaps) · TruffleHog github (equivalent) · detect-secrets GitHubTokenDetector (overlaps)

SEC004

Slack token found (merge-worthy · guidance)

Remove the token from source and revoke it in the Slack app’s OAuth settings.

Authority	GitHub — About secret scanning
Prior art	gitleaks slack-bot-token (overlaps) · TruffleHog slack (overlaps) · detect-secrets SlackDetector (overlaps)

SEC005

Google API key found (merge-worthy · guidance)

Remove the key from source and regenerate it in the Google Cloud Console credentials page.

Authority	GitHub — About secret scanning
Prior art	gitleaks gcp-api-key (equivalent) · TruffleHog googlegemini (overlaps)

SEC006

Stripe live secret key found (merge-worthy · guidance)

Remove the key from source and roll it in the Stripe dashboard immediately — this is a live-mode key.

Authority	GitHub — About secret scanning
Prior art	gitleaks stripe-access-token (overlaps) · TruffleHog stripe (overlaps) · detect-secrets StripeDetector (overlaps)

SEC007

Private key block found (merge-worthy · guidance)

Remove the private key from source, rotate the keypair, and load the key from a secret store instead.

Authority	GitHub — About secret scanning
Prior art	gitleaks private-key (equivalent) · TruffleHog privatekey (equivalent) · detect-secrets PrivateKeyDetector (equivalent)

SEC008

Bearer/authorization token found (merge-worthy · guidance)

Remove the token from source; if it’s long-lived, revoke and reissue it via the issuing service.

Authority	GitHub — About secret scanning
Prior art	gitleaks curl-auth-header (overlaps)

SEC009

Credentials embedded in a connection string (merge-worthy · guidance)

Move the username/password out of the URI into a secret store, and rotate the credential.

Authority	GitHub — About secret scanning
Prior art	detect-secrets BasicAuthDetector (equivalent) · TruffleHog uri (overlaps) · gitleaks curl-auth-user (overlaps)

SEC010

High-entropy string — possible secret (merge-worthy · guidance)

Confirm whether this is a live credential; if so, remove it from source and rotate it. If it’s a false positive, suppress with a chant-audit-ignore comment or an allowlist entry.

Authority	GitHub — About secret scanning
Prior art	detect-secrets Base64HighEntropyString (overlaps) · detect-secrets HexHighEntropyString (overlaps) · gitleaks generic-api-key (overlaps)

Wrangler config (WRG)

Lexicon-independent, audit-only (#446) — scans wrangler.toml, Cloudflare Workers’ native deploy config, which the engine cannot otherwise parse (it is not YAML/JSON). No authoring surface: chant does not write Wrangler config, it only reads it for these checks.

WRG001

*Production environment exposed on .workers.dev (merge-worthy · guidance)

Remove workers_dev (or set it to false) for this environment and rely on its custom domain/route instead of the shared public subdomain.

Authority	Cloudflare Workers — workers.dev

WRG002

Credential-shaped key stored in [vars] (merge-worthy · guidance)

Move the value out of [vars] and into wrangler secret put \<name> so it isn’t committed to source or visible in wrangler dev/the dashboard.

Authority	Cloudflare Workers — Secrets

WRG003

Observability explicitly disabled (report-only · guidance)

Set observability.enabled = true (or remove the override) so Workers Logs are recorded for this deployment.

WRG004

Unscoped wildcard route (merge-worthy · guidance)

Scope the route pattern to the intended zone (e.g. “example.com/”) instead of a bare "" or ”/” that matches every zone on the account.

Authority	Cloudflare Workers — Routes

WRG005

Non-production environment shares a data store with production (merge-worthy · guidance)

Give the non-production environment its own KV namespace/R2 bucket/D1 database id instead of reusing production’s.

Authority	Cloudflare Workers — Wrangler environments

WRG006

Static assets served from the project root (merge-worthy · guidance)

Point [site].bucket / [assets].directory at a dedicated public output folder, not the project root, so non-public files (config, source maps, .git) aren’t served.

Authority	Cloudflare Workers — Static assets

nginx config (NGX)

Lexicon-independent, audit-only (#1979) — parses nginx’s native directive/block config (nginx.conf and .conf files under nginx-ish directories, confirmed by content). No authoring surface: chant does not write nginx config, it only reads it for these checks.

NGX001

Deprecated TLS protocol enabled (merge-worthy · guidance)

Remove SSLv2/SSLv3/TLSv1/TLSv1.1 from ssl_protocols and serve TLSv1.2 and TLSv1.3 only.

Authority	Mozilla — Server Side TLS
Prior art	gixy-ng (maintained Gixy fork) weak_ssl_tls (overlaps)

NGX002

Weak cipher suite enabled (merge-worthy · guidance)

Remove the RC4/DES/MD5/NULL/EXPORT-class entries from ssl_ciphers and use a modern cipher list (e.g. Mozilla’s intermediate configuration).

Authority	Mozilla — Server Side TLS
Prior art	gixy-ng (maintained Gixy fork) weak_ssl_tls (overlaps)

NGX003

Directory listing enabled (merge-worthy · guidance)

Remove autoindex on (or scope it to a directory that is genuinely meant to be enumerated) so file listings aren’t served to anyone who asks.

Authority	CWE-548 — Exposure of Information Through Directory Listing

NGX004

alias path traversal (merge-worthy · guidance)

End the location prefix with ”/” so it matches the trailing slash of the alias target — without it, a request for “<prefix>../” escapes the aliased directory.

Authority	Gixy — alias traversal
Prior art	Gixy alias_traversal (equivalent) · gixy-ng (maintained Gixy fork) alias_traversal (equivalent)

NGX005

Status endpoint with no access restriction (merge-worthy · guidance)

Restrict the stub_status location with allow/deny (or auth_basic/auth_request) so connection metrics aren’t public reconnaissance.

Authority	nginx — ngx_http_stub_status_module
Prior art	gixy-ng (maintained Gixy fork) status_page_exposed (overlaps)

NGX006

Server version disclosure (report-only · guidance)

Add server_tokens off; in the http block so nginx stops advertising its exact version in the Server header and error pages.

Prior art	gixy-ng (maintained Gixy fork) version_disclosure (equivalent)

NGX007

Access logging disabled at server scope (report-only · guidance)

Re-enable access_log at http/server scope (silencing a single noisy location is fine) so requests are recorded for incident investigation.

Agent configuration (AGT)

Run by chant audit --agents against the agent configuration on a machine — instruction files, MCP servers, skills, plugins, and permissions at system, user, and project scope. Unlike every other family here, these do not fire on repository YAML.

AGT001

MCP server runs an unpinned package (merge-worthy · guidance)

Pin the package spec to an exact version (server@1.2.3), so a new upstream release can’t execute on this machine unreviewed.

Authority	OSSF Scorecard — Pinned-Dependencies

AGT002

Literal credential in agent config (merge-worthy · guidance)

Replace the value with an environment reference ($\{TOKEN}) and keep the secret in a secret store — agent config files sync, back up, and get shared.

Authority	CWE-798 — Use of Hard-coded Credentials
Prior art	agent-audit auth-bypass/env-secret-in-config (equivalent) · mcp-audit (APIsec) Secrets Detection (overlaps) · Snyk Agent Scan (formerly mcp-scan) W008 (overlaps)

AGT003

MCP server reached over cleartext HTTP (merge-worthy · guidance)

Use an https:// endpoint. Tool arguments and results — including data the agent read locally — otherwise cross the network in the clear.

Authority	CWE-319 — Cleartext Transmission of Sensitive Information

AGT004

Remote skill or plugin is unpinned (merge-worthy · guidance)

Pin the source to a tag or commit sha, so the instructions the agent follows can’t change upstream without a local edit.

Authority	OSSF Scorecard — Pinned-Dependencies

AGT005

Tool permission granted without constraint (merge-worthy · guidance)

Scope the grant to the specific commands you run (Bash(git status:*)), and re-enable the confirmation prompt for dangerous operations.

AGT006

User-scope config applies to every project (report-only · guidance)

Move project-specific instructions, MCP servers, and skills to that project’s own config so they don’t follow you into unrelated repos.

AGT007

MCP server declared in multiple files (report-only · guidance)

Delete the shadowed declarations. The harness silently picks one, so the file you read may not be the one that decides what runs.

AGT008

Instruction file exceeds the attention budget (report-only · guidance)

Move situational guidance into skills that load on demand, so the always-on instructions stay short enough to be followed reliably.

Prior art

chant’s rules were written against the output chant emits, but much of what they check was checked first by a dedicated tool. Each rule above that has a counterpart names it under Prior art, with the upstream rule id and how the two relate.

• equivalent is the same condition at the same scope.
• overlaps shares the core condition, with one side narrower or broader, or expressed for a different dialect of the same control.
• extends means chant checks a strict superset of the upstream rule.

This is credit rather than authority, and it never changes a rule’s tier or category. A credit counts once per upstream rule cited, so a chant rule that names two zizmor audits adds two.

Tool	Kind	Licence	Credits
Checkov	scanner	Apache-2.0	79
KICS	scanner	Apache-2.0	56
zizmor	scanner	MIT	38
cfn_nag	scanner	MIT	20
GitLab CI/CD YAML reference	specification	CC-BY-SA-4.0	20
AWS Guard Rules Registry	scanner	Apache-2.0	19
Fairwinds Polaris	scanner	Apache-2.0	18
KubeLinter	scanner	Apache-2.0	17
kube-score	scanner	MIT	15
cfn-lint	scanner	MIT-0	14
PSRule for Azure	scanner	MIT	13
Google Cloud Policy Library	scanner	Apache-2.0	12
poutine	scanner	Apache-2.0	11
OpenSSF Scorecard	scanner	Apache-2.0	11
tfsec	scanner	MIT	11
gitleaks	scanner	MIT	10
octoscan	scanner	GPL-3.0	10
detect-secrets	scanner	Apache-2.0	9
tflint-ruleset-terraform	scanner	MPL-2.0	9
actionlint	scanner	MIT	8
hadolint	scanner	GPL-3.0	8
trivy-checks	scanner	MIT	8
TruffleHog	scanner	AGPL-3.0	8
gixy-ng (maintained Gixy fork)	scanner	MPL-2.0	5
kubesec	scanner	Apache-2.0	5
HashiCorp reference Sentinel policies	specification	MPL-2.0	5
tflint-ruleset-redeploy	scanner	0BSD	5
Datree	scanner	Apache-2.0	4
HashiCorp Terraform style guide	specification	n/a	4
helm lint	vendor-validator	Apache-2.0	4
choudoufu	scanner	MPL-2.0	3
Flux Kustomization API reference	specification	n/a	3
agent-audit	scanner	MIT	2
ARM Template Toolkit (arm-ttk)	scanner	MIT	2
AWS prescriptive guidance for Terraform	specification	n/a	2
Bicep linter	scanner	MIT	2
Dockle	scanner	Apache-2.0	2
Google Cloud Terraform best-practices series	specification	n/a	2
mcp-audit (APIsec)	scanner	MIT	2
tflint-ruleset-avm (Azure Verified Modules)	scanner	MIT	2
Snyk Agent Scan (formerly mcp-scan)	scanner	Apache-2.0	1
chart-testing (ct)	vendor-validator	Apache-2.0	1
Gixy	scanner	MPL-2.0	1
Pluto	scanner	Apache-2.0	1
Semgrep Registry rules	scanner	Semgrep Rules License v1.0 (proprietary, not an SPDX id)	1