Field guides
Make the next infrastructure review easier.
Practical review sequences for the files your team already maintains. Each guide separates what a configuration check can tell you from what still needs a runtime test.
01 / Kubernetes
Kubernetes Security Context Checklist
A practical Kubernetes review: container privileges, writable paths, resource requests, probes, and how to validate configuration changes.
Read the Kubernetes guide →02 / Docker
Dockerfile Production Security Checklist
Review Docker base images, build stages, process users, build secrets, and runtime behavior before approving a Dockerfile change.
Read the Docker guide →03 / Terraform
Terraform Security Review Checklist
A Terraform security review workflow covering plans, sensitive state, public network access, and the limits of static configuration checks.
Read the Terraform guide →Use a scan as the start of a review
A finding is most useful when an engineer can see the file, understand the consequence, and decide how to test a change. Start with a small set of related issues. Keep the original context alongside the proposed patch, and repeat the scan after the change.
For teams responsible for several organizations, the agency workflow explains how to keep client reviews distinct. The security page covers data processing, repository permissions, and the limits of automated fixes.
Put the review into practice.
Explore a report, then scan your own infrastructure files.