Checkov
Checkov is a static code analysis tool for infrastructure as code (IaC) and software composition analysis (SCA). It scans cloud infrastructure provisioned using various tools like Terraform, Cloudformation, Kubernetes, Dockerfile, and more to detect security and compliance misconfigurations. It also performs Software Composition Analysis (SCA) scanning for open source packages and images to identify Common Vulnerabilities and Exposures (CVEs). Checkov powers Prisma Cloud Application Security, a platform that streamlines cloud security throughout the development lifecycle by identifying, fixing, and preventing misconfigurations in cloud resources and infrastructure-as-code files.
FEATURES
EXPLORE BY TAGS
SIMILAR TOOLS
A web-based tool for instrumenting and analyzing Android applications using Flask, Jinja, and Redis.
A tool to profile web applications based on response time discrepancies.
cwe_checker is a suite of checks to detect common bug classes in ELF binaries using Ghidra for firmware analysis.
Static application security testing (SAST) tool for scanning source code against security and privacy risks.
Deliberately vulnerable web application for educational purposes.
A comprehensive web application security testing solution that offers built-in vulnerability assessment and management, as well as integration options with popular software development tools.
Hackazon is a free, vulnerable test site with an online storefront to train and test IT security professionals on various vulnerabilities like SQL Injection and cross-site scripting.
PINNED
Mandos
Fractional CISO service that helps B2B companies implement security leadership to win enterprise deals, achieve compliance, and develop strategic security programs.
Checkmarx SCA
A software composition analysis tool that identifies vulnerabilities, malicious code, and license risks in open source dependencies throughout the software development lifecycle.
Orca Security
A cloud-native application protection platform that provides agentless security monitoring, vulnerability management, and compliance capabilities across multi-cloud environments.
DryRun
A GitHub application that performs automated security code reviews by analyzing contextual security aspects of code changes during pull requests.