Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.
This report summarizes scanner evidence for bridgecrewio/checkov, a Python project with 9,059 GitHub stars. SynthScan examined 628,001 lines of code across 9504 source files, recording 5110 pattern matches distributed across 22 syntactic categories. The legacy adjusted pattern signal is 10.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3327 finding(s).
Are imports declared and package/API names verified? 1190 finding(s).
Are wrappers, guards, and repeated structures necessary? 2927 finding(s).
Which changes need focused human review? 5110 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 5110 distinct pattern matches across 22 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.py | 16 | def transform_graph_yaml_to_json(self) -> None: | CODE |
| LOW | dangerfile.ts | 44 | async function failIfLoggingLineContainsSensitiveData() { | CODE |
| LOW | performance_tests/test_checkov_performance.py | 56 | def test_terraform_performance(benchmark): | CODE |
| LOW | performance_tests/test_checkov_performance.py | 81 | def test_cloudformation_performance(benchmark): | CODE |
| LOW | integration_tests/test_checkov_sarif_report.py | 23 | def validate_report_not_empty(self, report): | CODE |
| LOW | integration_tests/test_checkov_config.py | 63 | def test_no_config_file_argument(self): | CODE |
| LOW | integration_tests/test_checkov_ext_module_cloning.py | 12 | def test_private_github_modules_api_key(self): | CODE |
| LOW | integration_tests/test_checkov_ext_module_cloning.py | 20 | def test_private_tfc_modules_api_key(self): | CODE |
| LOW | integration_tests/test_checkov_junit_report.py | 9 | def test_terragoat_junit_report(self): | CODE |
| LOW⚡ | …tegration_tests/test_checkov_cli_integration_report.py | 11 | def test_terragoat_report_dir_api_key(self): | CODE |
| LOW⚡ | …tegration_tests/test_checkov_cli_integration_report.py | 15 | def test_terragoat_report_dir_no_upload_api_key(self): | CODE |
| LOW⚡ | …tegration_tests/test_checkov_cli_integration_report.py | 19 | def test_terragoat_report_file_api_key(self): | CODE |
| LOW | …tegration_tests/test_checkov_cli_integration_report.py | 31 | def test_bitbucket_pipelines_report_api_key(self): | CODE |
| LOW | integration_tests/test_checkov_json_report.py | 16 | def test_kustomizegoat_report(self): | CODE |
| LOW | integration_tests/test_checkov_json_report.py | 35 | def test_checkov_report_terragoat_with_skip(self): | CODE |
| LOW | integration_tests/test_checkov_json_report.py | 56 | def validate_report_not_empty(self, report): | CODE |
| LOW | integration_tests/test_checkov_cyclonedx_report.py | 18 | def validate_report_not_empty(self, report): | CODE |
| LOW | tests/test_runner_filter.py | 56 | def test_runner_filter_constructor_framework( | CODE |
| LOW | tests/test_main.py | 39 | def test_run_with_outer_registry_and_framework_flag(): | CODE |
| LOW | tests/test_main.py | 86 | def test_run_with_severity_filter_and_api_key(caplog: LogCaptureFixture): | CODE |
| LOW | tests/test_main.py | 109 | def test_run_with_severity_filter_without_api_key(caplog: LogCaptureFixture): | CODE |
| LOW | tests/test_main.py | 129 | def test_run_with_severity_skip_filter_without_api_key(caplog: LogCaptureFixture): | CODE |
| LOW | tests/test_main.py | 165 | def test_run_without_custom_severity(): | CODE |
| LOW | tests/test_main.py | 181 | def test_optional_download_external_modules(): | CODE |
| LOW | tests/terraform/test_scanner_registry.py | 27 | def test_non_colliding_check_ids(self): | CODE |
| LOW | tests/terraform/test_scanner_registry.py | 36 | def test_non_colliding_graph_check_ids(self): | CODE |
| LOW | tests/terraform/util/test_doc_generator.py | 13 | def test_get_checks_returned_check_number(): | CODE |
| LOW | tests/terraform/util/test_doc_generator.py | 80 | def test_get_checks_returned_frameworks(input_frameworks: list[str] | None, expected_frameworks: set[str]): | CODE |
| LOW | tests/terraform/util/test_doc_generator.py | 90 | def test_get_checks_graph_registries(): | CODE |
| LOW | tests/terraform/checks/test_base_resource_check.py | 7 | def test_contains_unrendered_variable(self): | CODE |
| LOW | tests/terraform/checks/module/registry/test_registry.py | 22 | def test_registry_external_check_load(self): | CODE |
| LOW⚡ | …ks/resource/test_base_resource_negative_value_check.py | 70 | def test_string_mismatch_static(self): | CODE |
| LOW⚡ | …ks/resource/test_base_resource_negative_value_check.py | 75 | def test_string_contains_var_any(self): | CODE |
| LOW⚡ | …ks/resource/test_base_resource_negative_value_check.py | 80 | def test_string_contains_var_static(self): | CODE |
| LOW⚡ | …form/checks/resource/test_base_resource_value_check.py | 70 | def test_string_mismatch_static(self): | CODE |
| LOW⚡ | …form/checks/resource/test_base_resource_value_check.py | 75 | def test_string_contains_var_any(self): | CODE |
| LOW⚡ | …form/checks/resource/test_base_resource_value_check.py | 80 | def test_string_contains_var_static(self): | CODE |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 43 | def test_failure_compute_secgroup_port_range(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 85 | def test_pass_compute_secgroup_different_port(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 110 | def test_pass_compute_secgroup_no_cidr(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 128 | def test_pass_compute_secgroup_null_cidr(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 146 | def test_pass_compute_secgroup_cidr(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 164 | def test_pass_compute_secgroup_icmp(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 184 | def test_failure_networking_secgroup(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 209 | def test_failure_networking_secgroup_port_range(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 225 | def test_pass_networking_secgroup(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 242 | def test_pass_networking_secgroup_icmp(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 258 | def test_unknown_networking_secgroup_egress(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 274 | def test_pass_networking_secgroup_source_sg(self): | STRING |
| LOW | …e/openstack/test_SecurityGroupUnrestrictedIngress22.py | 290 | def test_pass_networking_secgroup_different_port(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 43 | def test_failure_compute_secgroup_port_range(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 85 | def test_pass_compute_secgroup_different_port(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 110 | def test_pass_compute_secgroup_no_cidr(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 128 | def test_pass_compute_secgroup_null_cidr(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 146 | def test_pass_compute_secgroup_cidr(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 164 | def test_pass_compute_secgroup_icmp(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 184 | def test_failure_networking_secgroup(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 209 | def test_failure_networking_secgroup_port_range(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 225 | def test_pass_networking_secgroup(self): | STRING |
| LOW | …openstack/test_SecurityGroupUnrestrictedIngress3389.py | 242 | def test_pass_networking_secgroup_icmp(self): | STRING |
| 2261 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_contributor_metrics.py | 1 | CODE | |
| LOW | tests/test_main.py | 1 | CODE | |
| LOW | tests/terraform/test_scanner_registry.py | 5 | CODE | |
| LOW | tests/terraform/util/test_doc_generator.py | 1 | CODE | |
| LOW | …e/test_AzureBatchAccountEndpointAccessDefaultAction.py | 1 | CODE | |
| LOW | …ks/resource/azure/test_GithubActionsOIDCTrustPolicy.py | 1 | CODE | |
| LOW | …m/checks/resource/aws/test_S3AbortIncompleteUploads.py | 1 | CODE | |
| LOW | …aform/checks/resource/aws/test_DocDBBackupRetention.py | 7 | CODE | |
| LOW | …form/runner/extra_tf_plan_checks/secret_not_deleted.py | 1 | CODE | |
| LOW | …tf_plan_checks/security_group_rule_protocol_changed.py | 1 | CODE | |
| LOW | …sts/terraform/runner/py_check_tf_plan/check_tf_plan.py | 1 | CODE | |
| LOW | tests/terraform/runner/py_graph_check/py_graph_check.py | 1 | CODE | |
| LOW | tests/terraform/graph/graph_builder/test_local_graph.py | 10 | CODE | |
| LOW | tests/terraform/graph/graph_builder/test_local_graph.py | 10 | CODE | |
| LOW | tests/terraform/graph/graph_builder/test_local_graph.py | 10 | CODE | |
| LOW | tests/terraform/graph/graph_builder/test_oci_policy.py | 4 | CODE | |
| LOW | …ts/terraform/graph/graph_builder/test_graph_builder.py | 9 | CODE | |
| LOW | tests/terraform/graph/checks/test_yaml_policies.py | 1 | CODE | |
| LOW | …ts/terraform/graph/checks/test_custom_yaml_policies.py | 1 | CODE | |
| LOW | tests/terraform/graph/runner/test_graph_builder.py | 1 | CODE | |
| LOW | tests/terraform/parser/test_new_parser_modules.py | 5 | CODE | |
| LOW | tests/terraform/context_parsers/test_base_parser.py | 9 | CODE | |
| LOW | tests/terraform/context_parsers/test_base_parser.py | 10 | CODE | |
| LOW | tests/terraform/context_parsers/test_base_parser.py | 11 | CODE | |
| LOW | tests/terraform/image_referencer/provider/test_gcp.py | 1 | CODE | |
| LOW | tests/terraform/module_loading/test_tf_module_finder.py | 6 | CODE | |
| LOW | tests/terraform/module_loading/test_runner.py | 1 | CODE | |
| LOW | tests/unit/test_github_failed_only.py | 11 | CODE | |
| LOW | tests/unit/test_github_failed_only.py | 13 | CODE | |
| LOW | tests/sca_image/conftest.py | 1 | CODE | |
| LOW | tests/sca_image/test_validate_image_id.py | 1 | CODE | |
| LOW | tests/sca_image/test_validate_image_id.py | 5 | CODE | |
| LOW | tests/sca_image/test_output_reports.py | 2 | CODE | |
| LOW | tests/sca_image/test_output_reports.py | 7 | CODE | |
| LOW | tests/sca_image/test_runner.py | 1 | CODE | |
| LOW | tests/sca_image/test_runner.py | 4 | CODE | |
| LOW | tests/sca_image/mocks.py | 1 | CODE | |
| LOW | tests/sca_image/mocks.py | 3 | CODE | |
| LOW | tests/dockerfile/graph_builder/test_local_graph.py | 8 | CODE | |
| LOW | …/dockerfile/graph_builder/checks/test_yaml_policies.py | 1 | CODE | |
| LOW | tests/serverless/graph_builder/test_local_graph.py | 4 | CODE | |
| LOW | tests/serverless/runner/test_runner.py | 9 | CODE | |
| LOW | tests/secrets/test_secrets_verification.py | 1 | CODE | |
| LOW | tests/secrets/test_secret_git_history.py | 1 | CODE | |
| LOW | tests/secrets/test_runner.py | 423 | CODE | |
| LOW | tests/secrets/git_history/test_utils.py | 1 | CODE | |
| LOW | tests/policies_3d/conftest.py | 1 | CODE | |
| LOW | tests/policies_3d/conftest.py | 7 | CODE | |
| LOW | tests/policies_3d/test_output.py | 1 | CODE | |
| LOW | tests/policies_3d/test_runner.py | 1 | CODE | |
| LOW | tests/azure_pipelines/conftest.py | 1 | CODE | |
| LOW | tests/openapi/checks/test_python_policies.py | 1 | CODE | |
| LOW | tests/ansible/checks/test_python_policies.py | 1 | CODE | |
| LOW | tests/common/conftest.py | 1 | CODE | |
| LOW | tests/common/check_assertion_utils.py | 1 | CODE | |
| LOW | …tegration_features/test_vulnerabilities_integration.py | 1 | CODE | |
| LOW | …/common/integration_features/test_fixes_integration.py | 1 | CODE | |
| LOW | tests/common/graph/checks/test_yaml_policies_base.py | 1 | CODE | |
| LOW | tests/common/output/conftest.py | 1 | CODE | |
| LOW | tests/common/output/test_common.py | 1 | CODE | |
| 1069 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …tegration_tests/test_checkov_platform_only_policies.py | 14 | CODE | |
| LOW | …y/example_external_dir/extra_checks/S3PCIPrivateACL.py | 15 | CODE | |
| LOW | tests/terraform/runner/test_runner.py | 345 | CODE | |
| LOW | tests/terraform/runner/test_runner.py | 360 | CODE | |
| LOW | tests/terraform/runner/test_runner.py | 1293 | CODE | |
| LOW | tests/terraform/graph/graph_builder/test_local_graph.py | 143 | CODE | |
| LOW | tests/terraform/graph/graph_builder/test_local_graph.py | 214 | CODE | |
| LOW | …ts/terraform/graph/graph_builder/test_graph_builder.py | 200 | CODE | |
| LOW | …ts/terraform/graph/checks/test_yaml_connected_nodes.py | 99 | CODE | |
| LOW | tests/terraform/graph/checks_infra/test_base.py | 39 | CODE | |
| LOW | …aform/graph/variable_rendering/test_render_scenario.py | 280 | CODE | |
| LOW | …aform/graph/variable_rendering/test_render_scenario.py | 326 | CODE | |
| LOW | …aform/graph/variable_rendering/test_render_scenario.py | 200 | CODE | |
| LOW | …aform/graph/variable_rendering/test_render_scenario.py | 230 | CODE | |
| LOW | …aform/graph/variable_rendering/test_render_scenario.py | 243 | CODE | |
| LOW | tests/dockerfile/test_runner.py | 292 | CODE | |
| LOW | tests/serverless/runner/test_runner.py | 147 | CODE | |
| LOW | tests/common/graph/checks/test_yaml_policies_base.py | 113 | CODE | |
| LOW | tests/common/output/test_sarif_report.py | 436 | CODE | |
| LOW | tests/arm/runner/test_runner.py | 136 | CODE | |
| LOW | tests/kubernetes/runner/test_runner.py | 151 | CODE | |
| LOW | tests/cloudformation/runner/test_runner.py | 219 | CODE | |
| LOW | …cloudformation/graph/graph_builder/test_local_graph.py | 219 | CODE | |
| LOW | …rmation/graph/checks/test_yaml_policies_with_runner.py | 7 | CODE | |
| LOW | tests/helm/test_runner.py | 181 | CODE | |
| LOW | cdk_integration_tests/utils.py | 10 | CODE | |
| LOW | checkov/docs_generator.py | 87 | CODE | |
| LOW | checkov/docs_generator.py | 98 | CODE | |
| LOW | checkov/main.py | 170 | CODE | |
| LOW | checkov/main.py | 255 | CODE | |
| LOW | checkov/terraform/runner.py | 62 | CODE | |
| LOW | checkov/terraform/runner.py | 257 | CODE | |
| LOW | checkov/terraform/runner.py | 325 | CODE | |
| LOW | checkov/terraform/runner.py | 462 | CODE | |
| LOW | checkov/terraform/base_runner.py | 166 | CODE | |
| LOW | checkov/terraform/tf_parser.py | 205 | CODE | |
| LOW | checkov/terraform/tf_parser.py | 374 | CODE | |
| LOW | checkov/terraform/tf_parser.py | 472 | CODE | |
| LOW | checkov/terraform/tf_parser.py | 552 | CODE | |
| LOW | checkov/terraform/parser_utils.py | 20 | CODE | |
| LOW | checkov/terraform/plan_runner.py | 215 | CODE | |
| LOW | checkov/terraform/plan_utils.py | 16 | CODE | |
| LOW | checkov/terraform/plan_utils.py | 63 | CODE | |
| LOW | checkov/terraform/parser_functions.py | 197 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 108 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 236 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 254 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 333 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 403 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 454 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 480 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 500 | CODE | |
| LOW | checkov/terraform/plan_parser.py | 563 | CODE | |
| LOW | checkov/terraform/graph_builder/local_graph.py | 150 | CODE | |
| LOW | checkov/terraform/graph_builder/local_graph.py | 210 | CODE | |
| LOW | checkov/terraform/graph_builder/local_graph.py | 312 | CODE | |
| LOW | checkov/terraform/graph_builder/local_graph.py | 423 | CODE | |
| LOW | checkov/terraform/graph_builder/local_graph.py | 459 | CODE | |
| LOW | checkov/terraform/graph_builder/local_graph.py | 506 | CODE | |
| LOW | checkov/terraform/graph_builder/local_graph.py | 757 | CODE | |
| 557 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …odule_version_check/extra_checks/ModuleVersionCheck.py | 0 | some test for module source :param conf: module call :return: <checkresult> | STRING |
| HIGH | …le_version_check/extra_checks/ModuleSourceHashCheck.py | 0 | some test for module source :param conf: module call :return: <checkresult> | STRING |
| HIGH | …istry/example_external_dir/extra_checks/ModuleCheck.py | 0 | some test for module source :param conf: module call :return: <checkresult> | STRING |
| HIGH | …ce/azure/test_PostgreSQLServerSSLEnforcementEnabled.py | 0 | resource "azurerm_mysql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.locati | STRING |
| HIGH | …cks/resource/azure/test_PostgresSQLGeoBackupEnabled.py | 0 | resource "azurerm_mysql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.locati | STRING |
| HIGH | …rce/azure/test_PostgreSQLServerPublicAccessDisabled.py | 0 | resource "azurerm_mysql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.locati | STRING |
| HIGH | …cks/resource/azure/test_PostgreSQLEncryptionEnabled.py | 0 | resource "azurerm_mysql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.locati | STRING |
| HIGH | …m/checks/resource/azure/test_MySQLEncryptionEnabled.py | 0 | resource "azurerm_mysql_server" "example" { name = "example-psqlserver" location = azurerm_resource_group.example.locati | STRING |
| HIGH | …rce/azure/test_KeyVaultEnablesFirewallRulesSettings.py | 0 | resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location res | STRING |
| HIGH | …/resource/azure/test_KeyVaultEnablesPurgeProtection.py | 0 | resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location res | STRING |
| HIGH | …hecks/resource/azure/test_KeyVaultEnablesSoftDelete.py | 0 | resource "azurerm_key_vault" "example" { name = "examplekeyvault" location = azurerm_resource_group.example.location res | STRING |
| HIGH | …ks/resource/azure/test_MariaDBSSLEnforcementEnabled.py | 0 | resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_gro | STRING |
| HIGH | …cks/resource/azure/test_MariaDBPublicAccessDisabled.py | 0 | resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_gro | STRING |
| HIGH | …/checks/resource/azure/test_MariaDBGeoBackupEnabled.py | 0 | resource "azurerm_mariadb_server" "example" { name = var.server_name location = var.resource_group.location resource_gro | STRING |
| HIGH | …ce/azure/test_PostgreSQLServerLogConnectionsEnabled.py | 0 | resource "azurerm_postgresql_configuration" "example" { name = "connection_throttling" resource_group_name = data.azurer | STRING |
| HIGH | …rce/azure/test_PostgreSQLServerLogCheckpointEnabled.py | 0 | resource "azurerm_postgresql_configuration" "example" { name = "connection_throttling" resource_group_name = data.azurer | STRING |
| HIGH | …re/test_PostgreSQLServerConnectionThrottlingEnabled.py | 0 | resource "azurerm_postgresql_configuration" "example" { name = "connection_throttling" resource_group_name = data.azurer | STRING |
| HIGH | …ce/azure/test_PostgreSQLServerLogConnectionsEnabled.py | 0 | resource "azurerm_postgresql_configuration" "example" { name = "backslash_quote" resource_group_name = azurerm_resource_ | STRING |
| HIGH | …rce/azure/test_PostgreSQLServerLogCheckpointEnabled.py | 0 | resource "azurerm_postgresql_configuration" "example" { name = "backslash_quote" resource_group_name = azurerm_resource_ | STRING |
| HIGH | …re/test_PostgreSQLServerConnectionThrottlingEnabled.py | 0 | resource "azurerm_postgresql_configuration" "example" { name = "backslash_quote" resource_group_name = azurerm_resource_ | STRING |
| HIGH | …cks/resource/azure/test_SecurityCenterContactEmails.py | 0 | resource "azurerm_security_center_contact" "example" { email = "contact@example.com" phone = "+1-555-555-5555" alert_not | STRING |
| HIGH | …checks/resource/azure/test_SecurityCenterEmailAlert.py | 0 | resource "azurerm_security_center_contact" "example" { email = "contact@example.com" phone = "+1-555-555-5555" alert_not | STRING |
| HIGH | …/resource/azure/test_SecurityCenterEmailAlertAdmins.py | 0 | resource "azurerm_security_center_contact" "example" { email = "contact@example.com" phone = "+1-555-555-5555" alert_not | STRING |
| HIGH | …cks/resource/azure/test_SQLServerEmailAlertsEnabled.py | 0 | resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.n | STRING |
| HIGH | …s/resource/azure/test_SQLServerThreatDetectionTypes.py | 0 | resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.n | STRING |
| HIGH | …urce/azure/test_SQLServerEmailAlertsToAdminsEnabled.py | 0 | resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.n | STRING |
| HIGH | …cks/resource/azure/test_SQLServerEmailAlertsEnabled.py | 0 | resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.n | STRING |
| HIGH | …s/resource/azure/test_SQLServerThreatDetectionTypes.py | 0 | resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.n | STRING |
| HIGH | …urce/azure/test_SQLServerEmailAlertsToAdminsEnabled.py | 0 | resource "azurerm_mssql_server_security_alert_policy" "example" { resource_group_name = azurerm_resource_group.example.n | STRING |
| HIGH | …esource/azure/test_PostgresSQLTreatDetectionEnabled.py | 0 | resource "azurerm_mysql_server" "examplea" { name = "example-mysqlserver" location = azurerm_resource_group.example.loca | STRING |
| HIGH | …ecks/resource/azure/test_MySQLTreatDetectionEnabled.py | 0 | resource "azurerm_mysql_server" "examplea" { name = "example-mysqlserver" location = azurerm_resource_group.example.loca | STRING |
| HIGH | …checks/resource/azure/test_MySQLServerMinTLSVersion.py | 0 | resource "azurerm_mysql_server" "examplea" { name = "example-mysqlserver" location = azurerm_resource_group.example.loca | STRING |
| HIGH | …esource/azure/test_MySQLServerSSLEnforcementEnabled.py | 0 | resource "azurerm_mysql_server" "examplea" { name = "example-mysqlserver" location = azurerm_resource_group.example.loca | STRING |
| HIGH | …hecks/resource/azure/test_AKSEnablesPrivateClusters.py | 0 | resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.locati | STRING |
| HIGH | …hecks/resource/azure/test_AKSUsesAzurePoliciesAddon.py | 0 | resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.locati | STRING |
| HIGH | …checks/resource/azure/test_AKSUsesDiskEncryptionSet.py | 0 | resource "azurerm_kubernetes_cluster" "example" { name = "example-aks1" location = azurerm_resource_group.example.locati | STRING |
| HIGH | …m/checks/resource/gcp/test_GoogleComputeSerialPorts.py | 0 | resource "google_compute_instance_from_template" "default" { name = "test" source_instance_template = google_compute_ins | STRING |
| HIGH | …ecks/resource/gcp/test_GoogleComputeInstanceOSLogin.py | 0 | resource "google_compute_instance_from_template" "default" { name = "test" source_instance_template = google_compute_ins | STRING |
| HIGH | …ecks/resource/gcp/test_GoogleComputeBlockProjectSSH.py | 0 | resource "google_compute_instance_from_template" "default" { name = "test" source_instance_template = google_compute_ins | STRING |
| HIGH | …m/checks/resource/gcp/test_GoogleComputeSerialPorts.py | 0 | resource "google_compute_instance_from_template" "default" { name = "test" source_instance_template = google_compute_ins | STRING |
| HIGH | …ecks/resource/gcp/test_GoogleComputeInstanceOSLogin.py | 0 | resource "google_compute_instance_from_template" "default" { name = "test" source_instance_template = google_compute_ins | STRING |
| HIGH | …orm/checks/resource/gcp/test_GoogleComputeIPForward.py | 0 | resource "google_compute_instance_from_template" "default" { name = "test" source_instance_template = google_compute_ins | STRING |
| HIGH | …ecks/resource/gcp/test_GoogleComputeBlockProjectSSH.py | 0 | resource "google_compute_instance_from_template" "default" { name = "test" source_instance_template = google_compute_ins | STRING |
| HIGH | …rm/checks/resource/gcp/test_GoogleComputeShieldedVM.py | 0 | resource "google_compute_instance_from_template" "default" { name = "test" source_instance_template = google_compute_ins | STRING |
| HIGH | …m/checks/resource/gcp/test_GoogleComputeSerialPorts.py | 0 | resource "google_compute_instance" "default" { name = "test" machine_type = "n1-standard-1" zone = "us-central1-a" boot_ | STRING |
| HIGH | …rm/checks/resource/gcp/test_GoogleComputeShieldedVM.py | 0 | resource "google_compute_instance" "default" { name = "test" machine_type = "n1-standard-1" zone = "us-central1-a" boot_ | STRING |
| HIGH | …ecks/resource/gcp/test_GoogleComputeInstanceOSLogin.py | 0 | resource "google_compute_instance" "default" { name = "test" machine_type = "n1-standard-1" zone = "us-central1-a" boot_ | STRING |
| HIGH | …orm/checks/resource/gcp/test_GoogleComputeIPForward.py | 0 | resource "google_compute_instance" "default" { name = "test" machine_type = "n1-standard-1" zone = "us-central1-a" boot_ | STRING |
| HIGH | …form/checks/resource/aws/test_RedshiftClusterKMSKey.py | 0 | resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_use | STRING |
| HIGH | …orm/checks/resource/aws/test_RedshiftClusterLogging.py | 0 | resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_use | STRING |
| HIGH | …esource/aws/test_RedshiftClusterAllowVersionUpgrade.py | 0 | resource "aws_redshift_cluster" "default" { cluster_identifier = "tf-redshift-cluster" database_name = "mydb" master_use | STRING |
| HIGH | …raform/checks/resource/aws/test_LambdaDLQConfigured.py | 0 | resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function | STRING |
| HIGH | tests/terraform/checks/resource/aws/test_LambdaInVPC.py | 0 | resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function | STRING |
| HIGH | …ws/test_LambdaFunctionLevelConcurrentExecutionLimit.py | 0 | resource "aws_lambda_function" "test_lambda" { filename = "lambda_function_payload.zip" function_name = "lambda_function | STRING |
| HIGH | …/checks/resource/base_resource_negative_value_check.py | 0 | :return: jsonpath syntax path of the checked attribute | STRING |
| HIGH | …terraform/checks/resource/base_resource_value_check.py | 0 | :return: jsonpath syntax path of the checked attribute | STRING |
| HIGH | checkov/ansible/checks/base_ansible_task_value_check.py | 0 | :return: jsonpath syntax path of the checked attribute | STRING |
| HIGH | checkov/arm/base_resource_negative_value_check.py | 0 | :return: jsonpath syntax path of the checked attribute | STRING |
| HIGH | checkov/arm/base_resource_value_check.py | 0 | :return: jsonpath syntax path of the checked attribute | STRING |
| HIGH | …kov/bicep/checks/resource/base_resource_value_check.py | 0 | :return: jsonpath syntax path of the checked attribute | STRING |
| 36 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …/AppsyncWebACLConfiguredWIthLog4jVulnerability/main.tf | 125 | # ================================== | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 33 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 35 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 142 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 144 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 154 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 156 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 220 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 222 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 392 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 394 | # --------------------------------------------------------------------------- | COMMENT |
| MEDIUM | tests/common/external_checks/verification/conftest.py | 16 | # ────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | tests/common/external_checks/verification/conftest.py | 63 | # ────────────────────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 30 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 32 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 53 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 55 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 189 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 194 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 248 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 250 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 280 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 282 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 304 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 306 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 332 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 334 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 380 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 389 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 416 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 425 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 506 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_signer_interop.py | 508 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …on/external_checks/verification/test_signer_interop.py | 98 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …on/external_checks/verification/test_signer_interop.py | 105 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …on/external_checks/verification/test_signer_interop.py | 460 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM | …on/external_checks/verification/test_signer_interop.py | 467 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 76 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 78 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 109 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 111 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 184 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 186 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 231 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 233 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 266 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 268 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 315 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …on/external_checks/verification/test_chokepoint_git.py | 317 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 150 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 152 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 217 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 221 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 300 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 303 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 389 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 393 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 439 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 442 | # -------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | …common/external_checks/verification/test_regression.py | 507 | # -------------------------------------------------------------------------- | COMMENT |
| 56 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …raph/resources/nested_modules_double_call/four/main.tf | 152 | # Create a truncated ID if needed | COMMENT |
| MEDIUM | …raph/resources/nested_modules_double_call/four/main.tf | 164 | # Create the short ID by adding a hash to the end of the truncated ID | COMMENT |
| MEDIUM⚡ | tests/common/utils/test_update_checker.py | 384 | # Create the legacy file so the code path tries to remove it | COMMENT |
| MEDIUM | tests/common/utils/test_update_checker.py | 327 | # Create a valid cache file, then make it unreadable | COMMENT |
| MEDIUM | tests/github_actions/test_runner_auxiliary.py | 10 | # This class is used only for testing by filling up the abstract implementations. | COMMENT |
| MEDIUM | …/resource/aws/unused/ec2_instance_with_ebs_volume.yaml | 30 | # Create a separate volume | COMMENT |
| MEDIUM | …ribution/CloudfrontDistributionEncryption-UNKNOWN.yaml | 14 | # Create the bucket to contain the website HTML | COMMENT |
| MEDIUM | …ibution/CloudfrontDistributionEncryption-FAILED-2.yaml | 9 | # Create the bucket to contain the website HTML | COMMENT |
| MEDIUM | …tribution/CloudfrontDistributionEncryption-PASSED.yaml | 9 | # Create the bucket to contain the website HTML | COMMENT |
| MEDIUM | …tribution/CloudfrontDistributionEncryption-FAILED.yaml | 9 | # Create the bucket to contain the website HTML | COMMENT |
| MEDIUM | tests/helm/test_runner.py | 95 | # Create a test report with some checks | COMMENT |
| MEDIUM | tests/helm/test_runner.py | 182 | # Create a temp directory for the test | COMMENT |
| MEDIUM | tests/helm/test_runner.py | 187 | # Create a temporary chart directory | COMMENT |
| MEDIUM | tests/helm/test_runner.py | 200 | # Create an empty template mapping dictionary | COMMENT |
| MEDIUM | .github/workflows/pr-test.yml | 516 | # Define an array of exceptions (files to skip) | COMMENT |
| MEDIUM | …tion_tests/src/python/CloudWatchLogGroupKMSKey/pass.py | 9 | # Create a CloudWatch Logs log group with KMS key ID | COMMENT |
| MEDIUM | …tests/src/python/CloudWatchLogGroupKMSKey/fail__1__.py | 9 | # Create a CloudWatch Logs log group without specifying KMS key | COMMENT |
| MEDIUM | …sts/src/python/ElasticsearchDomainEnforceHTTPS/pass.py | 9 | # Create an Amazon Elasticsearch domain | COMMENT |
| MEDIUM | …sts/src/python/ElasticsearchDomainEnforceHTTPS/pass.py | 30 | # Create the CDK app and stack | COMMENT |
| MEDIUM | …rc/python/ElasticsearchDomainEnforceHTTPS/fail__1__.py | 9 | # Create an Amazon Elasticsearch domain | COMMENT |
| MEDIUM | …rc/python/ElasticsearchDomainEnforceHTTPS/fail__1__.py | 23 | # Create the CDK app and stack | COMMENT |
| MEDIUM | cdk_integration_tests/src/python/WAFEnabled/pass.py | 10 | # Create a WebACL | COMMENT |
| MEDIUM | cdk_integration_tests/src/python/WAFEnabled/pass.py | 20 | # Create a CloudFront distribution | COMMENT |
| MEDIUM | …k_integration_tests/src/python/WAFEnabled/fail__1__.py | 8 | # Create a CloudFront distribution | COMMENT |
| MEDIUM | …_tests/src/python/WorkspaceUserVolumeEncrypted/pass.py | 8 | # Create a WorkSpaces directory | COMMENT |
| MEDIUM | …_tests/src/python/WorkspaceUserVolumeEncrypted/pass.py | 16 | # Create a WorkSpaces workspace with root volume encryption enabled | COMMENT |
| MEDIUM | …s/src/python/WorkspaceUserVolumeEncrypted/fail__1__.py | 8 | # Create a WorkSpaces directory | COMMENT |
| MEDIUM | …s/src/python/WorkspaceUserVolumeEncrypted/fail__1__.py | 16 | # Create a WorkSpaces workspace with root volume encryption enabled | COMMENT |
| MEDIUM | …egration_tests/src/python/EFSEncryptionEnabled/pass.py | 9 | # Create an EFS file system with the Encrypted property set to True | COMMENT |
| MEDIUM | …on_tests/src/python/AmazonMQBrokerPublicAccess/pass.py | 9 | # Create an Amazon MQ broker with PubliclyAccessible set to false | COMMENT |
| MEDIUM | …sts/src/python/AmazonMQBrokerPublicAccess/fail__1__.py | 9 | # Create an Amazon MQ broker with PubliclyAccessible set to false | COMMENT |
| MEDIUM | …sts/src/python/IAMPolicyAttachedToGroupOrRoles/pass.py | 9 | # Create an IAM policy | COMMENT |
| MEDIUM | …rc/python/IAMPolicyAttachedToGroupOrRoles/fail__1__.py | 9 | # Create an IAM policy | COMMENT |
| MEDIUM | …k_integration_tests/src/python/DocDBEncryption/pass.py | 9 | # Create an Amazon DocumentDB cluster with storage encryption enabled | COMMENT |
| MEDIUM | …egration_tests/src/python/DocDBEncryption/fail__1__.py | 9 | # Create an Amazon DocumentDB cluster with storage encryption disabled | COMMENT |
| MEDIUM | cdk_integration_tests/src/python/DocDBAuditLogs/pass.py | 9 | # Define the DocDB Cluster Parameter Group | COMMENT |
| MEDIUM | …tegration_tests/src/python/DocDBAuditLogs/fail__1__.py | 9 | # Define the DocDB Cluster Parameter Group | COMMENT |
| MEDIUM | …_integration_tests/src/python/ECRImmutableTags/pass.py | 9 | # Create an ECR repository with immutable image tags | COMMENT |
| MEDIUM | …gration_tests/src/python/ECRImmutableTags/fail__1__.py | 9 | # Create an ECR repository with immutable image tags | COMMENT |
| MEDIUM | …egration_tests/src/python/BackupVaultEncrypted/pass.py | 12 | # Create a Backup Vault with the specified encryption key ARN | COMMENT |
| MEDIUM | …ion_tests/src/python/BackupVaultEncrypted/fail__1__.py | 9 | # Create a Backup Vault with the specified encryption key ARN | COMMENT |
| MEDIUM | …_integration_tests/src/python/DynamodbRecovery/pass.py | 9 | # Create a DynamoDB table with PointInTimeRecoveryEnabled set to True | COMMENT |
| MEDIUM | …gration_tests/src/python/DynamodbRecovery/fail__1__.py | 9 | # Create a DynamoDB table with PointInTimeRecoveryEnabled set to True | COMMENT |
| MEDIUM | …ts/src/python/GlueSecurityConfigurationEnabled/pass.py | 36 | # Create an AWS Glue Security Configuration (You need to create one separately) | COMMENT |
| MEDIUM | …ts/src/python/GlueSecurityConfigurationEnabled/pass.py | 39 | # Create an AWS Glue DevEndpoint | COMMENT |
| MEDIUM | …ts/src/python/GlueSecurityConfigurationEnabled/pass.py | 58 | # Create an AWS Glue Security Configuration (You need to create one separately) | COMMENT |
| MEDIUM | …ts/src/python/GlueSecurityConfigurationEnabled/pass.py | 61 | # Create an AWS Glue Job | COMMENT |
| MEDIUM | …c/python/GlueSecurityConfigurationEnabled/fail__3__.py | 34 | # Create an AWS Glue DevEndpoint | COMMENT |
| MEDIUM | …c/python/GlueSecurityConfigurationEnabled/fail__3__.py | 52 | # Create an AWS Glue Job | COMMENT |
| MEDIUM | …mbdaFunctionLevelConcurrentExecutionLimit/fail__2__.py | 15 | code=Code.from_asset("path/to/your/code"), # Define the code location | CODE |
| MEDIUM | …on/LambdaFunctionLevelConcurrentExecutionLimit/pass.py | 15 | code=Code.from_asset("path/to/your/code"), # Define the code location | CODE |
| MEDIUM | …ion_tests/src/python/RDSEnhancedMonitorEnabled/pass.py | 9 | # Create an RDS DB instance with a custom MonitoringInterval | COMMENT |
| MEDIUM | …ests/src/python/RDSEnhancedMonitorEnabled/fail__1__.py | 9 | # Create an RDS DB instance with a custom MonitoringInterval | COMMENT |
| MEDIUM | …ation_tests/src/python/APIGatewayAuthorization/pass.py | 8 | # Create the API Gateway Method based on the conditions | COMMENT |
| MEDIUM | …_tests/src/python/APIGatewayAuthorization/fail__1__.py | 8 | # Create the API Gateway Method based on the conditions | COMMENT |
| MEDIUM | …_tests/src/python/WorkspaceRootVolumeEncrypted/pass.py | 8 | # Create a WorkSpaces directory | COMMENT |
| MEDIUM | …_tests/src/python/WorkspaceRootVolumeEncrypted/pass.py | 16 | # Create a WorkSpaces workspace with root volume encryption enabled | COMMENT |
| MEDIUM | …s/src/python/WorkspaceRootVolumeEncrypted/fail__1__.py | 8 | # Create a WorkSpaces directory | COMMENT |
| MEDIUM | …s/src/python/WorkspaceRootVolumeEncrypted/fail__1__.py | 16 | # Create a WorkSpaces workspace with root volume encryption enabled | COMMENT |
| MEDIUM | …_integration_tests/src/python/ECRImageScanning/pass.py | 9 | # Create an ECR repository with image scanning on push enabled | COMMENT |
| 84 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …orm/graph/variable_rendering/test_string_evaluation.py | 321 | ("jsonencode(['a', 42, true, null])", ["a", 42, True, None]), | CODE |
| HIGH | …orm/graph/variable_rendering/test_string_evaluation.py | 327 | ("jsonencode({'a' = null})", {"a": None}), | CODE |
| HIGH | tests/secrets/test_secret_git_history.py | 115 | add, move, add, remove one = 2 secret one with removed_commit_hash && added_commit_hash | STRING |
| HIGH⚡ | tests/secrets/git_history/test_utils.py | 181 | 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nind | CODE |
| HIGH⚡ | tests/secrets/git_history/test_utils.py | 189 | 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nind | CODE |
| HIGH⚡ | tests/secrets/git_history/test_utils.py | 197 | 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dock | CODE |
| HIGH⚡ | tests/secrets/git_history/test_utils.py | 648 | 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0 | CODE |
| HIGH⚡ | tests/secrets/git_history/test_utils.py | 656 | 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0 | CODE |
| HIGH⚡ | tests/secrets/git_history/test_utils.py | 664 | 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfi | CODE |
| HIGH | tests/secrets/git_history/test_utils.py | 113 | 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nind | CODE |
| HIGH | tests/secrets/git_history/test_utils.py | 137 | 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nind | CODE |
| HIGH | tests/secrets/git_history/test_utils.py | 219 | 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dock | CODE |
| HIGH | tests/secrets/git_history/test_utils.py | 571 | 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0 | CODE |
| HIGH | tests/secrets/git_history/test_utils.py | 595 | 'folder1/folder2/Dockerfile': 'diff --git a/folder1/folder2/Dockerfile b/folder1/folder2/Dockerfile\nindex 0 | CODE |
| HIGH | tests/secrets/git_history/test_utils.py | 695 | 'Dockerfile': 'diff --git a/Dockerfile b/Dockerfile\nindex 0000..0000 0000\n--- a/Dockerfile\n+++ b/Dockerfi | CODE |
| HIGH | tests/ansible/test_runner.py | 294 | key = '[].tasks[?"amazon.aws.ec2_instance" != null][].[].tasks[?"amazon.aws.ec2_instance" != null][].CKV_AWS_135[6:1 | CODE |
| HIGH | tests/ansible/test_runner.py | 351 | key = '[].tasks[?"amazon.aws.ec2_instance" != null][].[].tasks[?"amazon.aws.ec2_instance" != null][].CKV_AWS_135[6:1 | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 122 | (37, ' "expiration_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 126 | (41, ' "not_before_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 131 | (46, ' "timeouts": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 141 | (37, ' "expiration_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 145 | (41, ' "not_before_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 150 | (46, ' "timeouts": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 160 | (37, ' "expiration_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 164 | (41, ' "not_before_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/conftest.py | 169 | (46, ' "timeouts": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 50 | (94, ' "content_type": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 51 | (95, ' "expiration_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 54 | (98, ' "not_before_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 55 | (99, ' "tags": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 56 | (100, ' "timeouts": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 74 | (94, ' "content_type": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 75 | (95, ' "expiration_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 78 | (98, ' "not_before_date": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 79 | (99, ' "tags": null,\n'), | CODE |
| HIGH⚡ | tests/common/utils/test_secrets_utils.py | 80 | (100, ' "timeouts": null,\n'), | CODE |
| HIGH | tests/github_actions/conftest.py | 42 | "run": "(ls /.dockerenv && echo Found dockerenv) || (echo No dockerenv)\ncurl -X POST -s --data | CODE |
| HIGH | tests/github_actions/conftest.py | 55 | "run": "(ls /.dockerenv && echo Found dockerenv) || (echo No dockerenv)\ncurl -X POST -s --data | CODE |
| HIGH | tests/github_actions/conftest.py | 67 | "run": "(ls /.dockerenv && echo Found dockerenv) || (echo No dockerenv)\ncurl -X POST -s --data | CODE |
| HIGH | tests/terraform_json/test_parser.py | 177 | "provider": [{"aws": {"region": "us-west-2", "profile": null}}] | STRING |
| HIGH | …graph_builder/variable_rendering/evaluate_terraform.py | 257 | :param input_str: string like "a && b" (supported operators: ==, != , <, <=, >, >=, && , ||) | STRING |
| HIGH⚡ | checkov/ansible/checks/base_ansible_task_check.py | 32 | f'[].tasks[?"{module}" != null][]', | CODE |
| HIGH⚡ | checkov/ansible/checks/base_ansible_task_check.py | 33 | f'[?"{module}" != null][]', | CODE |
| HIGH⚡ | checkov/ansible/checks/base_ansible_task_check.py | 34 | f'[].tasks[].block[?"{module}" != null][]', | CODE |
| HIGH⚡ | checkov/ansible/checks/base_ansible_task_check.py | 35 | f'[].block[?"{module}" != null][]', | CODE |
| HIGH⚡ | checkov/ansible/checks/base_ansible_task_check.py | 36 | f'[].tasks[].block[].block[?"{module}" != null][]', | CODE |
| HIGH⚡ | checkov/ansible/checks/base_ansible_task_check.py | 37 | f'[].block[].block[?"{module}" != null][]', | CODE |
| HIGH⚡ | checkov/ansible/checks/base_ansible_task_check.py | 40 | f'[].tasks[].block[].block[].block[?"{module}" != null][]', | CODE |
| HIGH⚡ | checkov/ansible/checks/base_ansible_task_check.py | 41 | f'[].block[].block[].block[?"{module}" != null][]', | CODE |
| HIGH | …ca/reachability/sast_contract/data_fetcher_sast_lib.py | 30 | logging.error('reachability_run_config is null, unable to proceed', exc_info=True) | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …mon/integration_features/test_licensing_integration.py | 342 | except Exception as e: | CODE |
| LOW | …mon/integration_features/test_licensing_integration.py | 425 | except Exception as e: | CODE |
| LOW | tests/common/checks/test_base_check.py | 129 | except Exception: | STRING |
| LOW | tests/common/utils/test_file_utils.py | 76 | except Exception: | CODE |
| LOW⚡ | tests/common/external_checks/verification/conftest.py | 59 | except Exception: | CODE |
| LOW | tests/kubernetes/runner/test_runner.py | 148 | except Exception: | CODE |
| LOW⚡ | tests/kubernetes/runner/test_runner.py | 178 | except Exception: | CODE |
| LOW | tests/kustomize/utils.py | 9 | except Exception: | CODE |
| MEDIUM | tests/kustomize/utils.py | 6 | def kustomize_exists() -> bool: | CODE |
| LOW | tests/helm/utils.py | 9 | except Exception: | CODE |
| MEDIUM | tests/helm/utils.py | 6 | def helm_exists() -> bool: | CODE |
| LOW | checkov/runner_filter.py | 305 | except Exception as exc: | CODE |
| MEDIUM | checkov/main.py | 458 | print('An error occurred getting data from the platform, including policy metadata. Because --includ | CODE |
| MEDIUM | checkov/main.py | 761 | def commit_repository(self) -> str | None: | CODE |
| LOW | checkov/main.py | 424 | except Exception: | CODE |
| LOW | checkov/main.py | 454 | except Exception: | CODE |
| LOW | checkov/main.py | 591 | except Exception as e: | CODE |
| LOW | checkov/main.py | 637 | except Exception: | CODE |
| LOW | checkov/main.py | 646 | except Exception as e: | CODE |
| LOW | checkov/main.py | 702 | except Exception as e: | CODE |
| LOW | checkov/main.py | 764 | except Exception: | CODE |
| LOW | checkov/main.py | 848 | except Exception: | CODE |
| LOW | checkov/terraform/tf_parser.py | 305 | except Exception as e: | CODE |
| LOW | checkov/terraform/tf_parser.py | 467 | except Exception as e: | CODE |
| LOW⚡ | checkov/terraform/tf_parser.py | 489 | except Exception as e: | CODE |
| LOW | checkov/terraform/parser_utils.py | 46 | except Exception as e: | CODE |
| LOW⚡ | checkov/terraform/plan_runner.py | 279 | except Exception as e: | CODE |
| LOW | checkov/terraform/plan_utils.py | 44 | except Exception as e: | CODE |
| LOW | checkov/terraform/plan_utils.py | 82 | except Exception as e: | CODE |
| LOW | checkov/terraform/parser_functions.py | 208 | except Exception: | CODE |
| LOW | checkov/terraform/graph_builder/local_graph.py | 92 | except Exception as e: | CODE |
| LOW | checkov/terraform/graph_builder/local_graph.py | 122 | except Exception as e: | CODE |
| LOW | checkov/terraform/graph_builder/local_graph.py | 407 | except Exception: | CODE |
| LOW | checkov/terraform/graph_builder/local_graph.py | 446 | except Exception as e: | CODE |
| LOW⚡ | …raform/graph_builder/foreach/foreach_entity_handler.py | 52 | except Exception as e: | CODE |
| LOW⚡ | …terraform/graph_builder/variable_rendering/renderer.py | 216 | except Exception: | CODE |
| LOW | …terraform/graph_builder/variable_rendering/renderer.py | 332 | except Exception: | CODE |
| LOW⚡ | …graph_builder/variable_rendering/evaluate_terraform.py | 94 | except Exception: | CODE |
| LOW⚡ | …graph_builder/variable_rendering/evaluate_terraform.py | 97 | except Exception: | CODE |
| LOW⚡ | …graph_builder/variable_rendering/evaluate_terraform.py | 105 | except Exception: | CODE |
| LOW⚡ | …graph_builder/variable_rendering/evaluate_terraform.py | 110 | except Exception: | CODE |
| LOW | …graph_builder/variable_rendering/evaluate_terraform.py | 175 | except Exception: | CODE |
| LOW | …graph_builder/variable_rendering/evaluate_terraform.py | 442 | except Exception: | CODE |
| LOW | …raph_builder/variable_rendering/safe_eval_functions.py | 274 | except Exception as e: | CODE |
| LOW | …raform/checks/utils/base_cloudsplaining_iam_scanner.py | 31 | except Exception: | CODE |
| LOW | …cks/resource/base_cloudsplaining_resource_iam_check.py | 65 | except Exception as e: | CODE |
| LOW | …source/alicloud/AbsSecurityGroupUnrestrictedIngress.py | 50 | except Exception: | CODE |
| MEDIUM | …source/alicloud/AbsSecurityGroupUnrestrictedIngress.py | 46 | def contains_violation(self, conf): | CODE |
| LOW | …/checks/resource/azure/GithubActionsOIDCTrustPolicy.py | 72 | except Exception: | CODE |
| LOW⚡ | …rm/checks/resource/gcp/GithubActionsOIDCTrustPolicy.py | 81 | except Exception as e: | CODE |
| LOW | …rce/gcp/AbsGoogleComputeFirewallUnrestrictedIngress.py | 44 | except Exception: | CODE |
| LOW | …cks/resource/aws/GithubActionsOIDCTrustPolicyOnRole.py | 43 | except Exception: # nosec | CODE |
| LOW | …raform/checks/resource/aws/GlacierVaultAnyPrincipal.py | 33 | except Exception: | CODE |
| LOW | …orm/checks/resource/aws/IAMStarActionPolicyDocument.py | 48 | except Exception: # nosec | CODE |
| LOW | …m/checks/resource/aws/IAMRoleAllowAssumeFromAccount.py | 37 | except Exception: # nosec | CODE |
| LOW | …erraform/checks/resource/aws/IAMAdminPolicyDocument.py | 42 | except Exception: # nosec | CODE |
| LOW | …m/checks/resource/aws/S3ProtectAgainstPolicyLockout.py | 48 | except Exception: # nosec | CODE |
| LOW | …rraform/checks/resource/aws/KMSKeyWildcardPrincipal.py | 39 | except Exception: # nosec | CODE |
| LOW | …aform/checks/resource/aws/IAMRoleAllowsPublicAssume.py | 30 | except Exception: # nosec | CODE |
| LOW | …form/checks/data/base_cloudsplaining_data_iam_check.py | 52 | except Exception as e: | CODE |
| 132 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | setup.py | 41 | logger = logging.getLogger(__name__) | CODE |
| LOW | …raform/checks/data/external/external_check/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/runner_filter.py | 397 | def set_suppressed_policies(self, policy_level_suppressions: List[List[str]]) -> None: | CODE |
| LOW | checkov/contributor_metrics.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | checkov/main.py | 100 | logger = logging.getLogger(__name__) | CODE |
| LOW | checkov/cdk/runner.py | 13 | logger = logging.getLogger(__name__) | CODE |
| LOW | checkov/terraform/tf_parser.py | 405 | def _update_resolved_modules(self) -> None: | CODE |
| LOW | checkov/terraform/plan_parser.py | 282 | def _update_after_unknown_in_complex_types(inner_key: str, value: dict[str, Any]) -> None: | CODE |
| LOW⚡ | checkov/terraform/graph_builder/local_graph.py | 757 | def _update_vertices_breadcrumbs_and_module_connections(self) -> None: | CODE |
| LOW | checkov/terraform/graph_builder/local_graph.py | 116 | def update_vertices_fields(self) -> None: | CODE |
| LOW | checkov/terraform/graph_builder/local_graph.py | 711 | def update_vertices_configs(self) -> None: | CODE |
| LOW | checkov/terraform/graph_builder/local_graph.py | 718 | def update_vertex_config(vertex: TerraformBlock, changed_attributes: Union[List[str], Dict[str, Any]], dynamic_block | CODE |
| LOW | checkov/terraform/graph_builder/local_graph.py | 815 | def _update_nested_modules_address(self) -> None: | CODE |
| LOW | …kov/terraform/graph_builder/graph_components/blocks.py | 215 | def update_list_attribute(self, attribute_key: str, attribute_value: Any) -> None: | CODE |
| LOW | …graph_builder/variable_rendering/evaluate_terraform.py | 599 | def _update_stack_if_needed(char: str, i: int) -> None: | CODE |
| LOW | checkov/terraform/checks/module/generic/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/provider/openstack/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/provider/ncp/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/provider/linode/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/provider/oci/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | …eckov/terraform/checks/provider/bridgecrew/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/provider/panos/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/provider/aws/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/resource/alicloud/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/resource/openstack/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/resource/gitlab/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/resource/ncp/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/resource/azure/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/resource/linode/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | …kov/terraform/checks/resource/digitalocean/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/resource/oci/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/resource/gcp/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/resource/github/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/resource/panos/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/terraform/checks/resource/okta/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | …ckov/terraform/checks/resource/yandexcloud/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/resource/aws/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | …kov/terraform/checks/resource/tencentcloud/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | …eckov/terraform/checks/resource/kubernetes/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/data/gcp/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/data/aws/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/checks/data/external/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/context_parsers/parsers/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/terraform/module_loading/loaders/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/gitlab/checks/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/dockerfile/graph_builder/local_graph.py | 102 | def update_vertices_configs(self) -> None: | CODE |
| LOW | checkov/dockerfile/checks/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/serverless/runner.py | 362 | def set_definitions_raw(self, definitions_raw: dict[str, list[tuple[int, str]]]) -> None: | CODE |
| LOW | checkov/serverless/parsers/parser.py | 22 | logger = logging.getLogger(__name__) | CODE |
| LOW | checkov/serverless/graph_builder/local_graph.py | 121 | def update_vertices_configs(self) -> None: | CODE |
| LOW | checkov/serverless/checks/function/aws/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/secrets/runner.py | 282 | def set_history_secret_store(self, value: Dict[str, List[EnrichedPotentialSecret]]) -> None: | CODE |
| LOW | checkov/secrets/git_history_store.py | 34 | def set_secret_map(self, file_results: List[PotentialSecret], file_name: str, commit: Commit) -> None: | CODE |
| LOW | checkov/secrets/git_history_store.py | 77 | def _update_removed_secret(self, secret_key: str, secret: PotentialSecret, file_name: str, commit: Commit) -> None: | CODE |
| LOW | checkov/azure_pipelines/checks/job/__init__.py | 4 | __all__ = [f.stem for f in modules if f.is_file() and not f.stem == "__init__"] | CODE |
| LOW | checkov/openapi/runner.py | 20 | logger = logging.getLogger(__name__) | CODE |
| LOW | checkov/openapi/checks/resource/v2/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/openapi/checks/resource/v3/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/openapi/checks/resource/generic/__init__.py | 5 | __all__ = [basename(f)[:-3] for f in modules if isfile(f) and not f.endswith("__init__.py")] | CODE |
| LOW | checkov/ansible/runner.py | 135 | def set_definitions_raw(self, definitions_raw: dict[str, list[tuple[int, str]]]) -> None: | CODE |
| 98 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | tests/conftest.py | 30 | except ImportError: # pragma: no cover - aiohttp always present in test env | CODE |
| HIGH | tests/common/utils/test_file_utils.py | 76 | except Exception: | CODE |
| HIGH | …ov/terraform/graph_builder/foreach/abstract_handler.py | 209 | except ValueError: | CODE |
| HIGH | …graph_builder/variable_rendering/evaluate_terraform.py | 285 | except (ValueError, SyntaxError): | CODE |
| HIGH | …orm/checks/resource/aws/IAMStarActionPolicyDocument.py | 48 | except Exception: # nosec | CODE |
| HIGH | …erraform/checks/resource/aws/IAMAdminPolicyDocument.py | 42 | except Exception: # nosec | CODE |
| HIGH | …m/checks/resource/aws/S3ProtectAgainstPolicyLockout.py | 48 | except Exception: # nosec | CODE |
| HIGH | …rraform/checks/resource/aws/KMSKeyWildcardPrincipal.py | 39 | except Exception: # nosec | CODE |
| HIGH | …aform/checks/resource/aws/IAMRoleAllowsPublicAssume.py | 30 | except Exception: # nosec | CODE |
| HIGH | checkov/sca_image/runner.py | 324 | except ValueError: | CODE |
| HIGH | checkov/sca_image/runner.py | 295 | except ValueError: | CODE |
| HIGH | checkov/serverless/parsers/parser.py | 179 | except TypeError: | CODE |
| HIGH | checkov/secrets/runner.py | 427 | except KeyError: | CODE |
| HIGH | checkov/common/parsers/json/decoder.py | 118 | except ValueError: | CODE |
| HIGH | checkov/common/parsers/json/decoder.py | 345 | except IndexError: | CODE |
| HIGH | checkov/common/util/update_checker/update_checker.py | 38 | except OSError: | CODE |
| HIGH | checkov/common/util/update_checker/update_checker.py | 122 | except IOError: | CODE |
| HIGH | checkov/common/images/image_referencer.py | 228 | except ValueError: | CODE |
| HIGH | …solvers/attribute_solvers/contains_attribute_solver.py | 22 | except ValueError: | CODE |
| HIGH | …mon/bridgecrew/vulnerability_scanning/image_scanner.py | 216 | except FileExistsError: | CODE |
| HIGH | checkov/common/parallelizer/parallel_runner.py | 151 | except EOFError: | CODE |
| HIGH | checkov/common/runners/runner_registry.py | 416 | except AttributeError: | CODE |
| HIGH | checkov/kustomize/runner.py | 893 | except IsADirectoryError: | CODE |
| HIGH | checkov/sast/engines/prisma_engine.py | 121 | except FileExistsError: | CODE |
| HIGH | checkov/terraform_json/parser.py | 54 | except YAMLError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …source/aws/example_ACMCertSetLoggingPreference/main.tf | 41 | # lifecycle { | COMMENT |
| LOW | …resource/aws/example_SecretManagerSecret90days/main.tf | 101 | COMMENT | |
| LOW | …resource/aws/example_SecretManagerSecret90days/main.tf | 121 | # time_sleep.wait_for_lambda_permissions_for_secrets_manager, | COMMENT |
| LOW | …ws/example_ImagebuilderImageRecipeEBSEncrypted/main.tf | 1 | # no blocks | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 41 | # } | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 121 | # resources = { | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 141 | # period_seconds = 3 | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 221 | port { | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 241 | # value = "Awesome" | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 341 | # liveness_probe { | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 421 | # requests = { | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 441 | # } | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 501 | container_port = 8080 | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 521 | # } | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 601 | value = "test" | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 621 | COMMENT | |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 721 | # } | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 801 | } | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 821 | COMMENT | |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 881 | value = "test" | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 901 | COMMENT | |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 1001 | # } | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 1101 | # resources = { | COMMENT |
| LOW | …source/kubernetes/example_MinimiseCapabilities/main.tf | 1121 | # period_seconds = 3 | COMMENT |
| LOW | tests/terraform/runner/test_plan_runner.py | 421 | def test_runner_data_resource_partial_values(self): | COMMENT |
| LOW | …raform/runner/resources/plan_with_iam_policies/main.tf | 81 | name = "example" | COMMENT |
| LOW | …raform/runner/resources/plan_with_iam_policies/main.tf | 101 | # permission_set_arn = aws_ssoadmin_permission_set.example.arn | COMMENT |
| LOW | …urces/AdministratorUserNotAssociatedWithAPIKey/main.tf | 1 | # Test Case TLDR: | COMMENT |
| LOW | …/terraform/graph/resources/modules-and-vars/context.tf | 1 | # | COMMENT |
| LOW | …erraform/graph/resources/modules-and-vars/variables.tf | 201 | # owner = string | COMMENT |
| LOW | …esources/modules-and-vars/examples/complete/context.tf | 1 | # | COMMENT |
| LOW | …raph/resources/nested_modules_double_call/four/main.tf | 21 | # Unlike other inputs, the first setting of `labels_as_tags` cannot be later overridden. However, | COMMENT |
| LOW | …r/resources/parser_scenarios/tostring_function/main.tf | 1 | locals { | COMMENT |
| LOW | …rm/parser/resources/parser_scenarios/ternaries/main.tf | 21 | // compare_string_false = "a" != "a" ? "wrong" : "correct" | COMMENT |
| LOW | tests/secrets/test_secret_git_history.py | 141 | commit_type=COMMIT_ADDED_STR, | COMMENT |
| LOW | tests/secrets/test_secret_git_history.py | 161 | # ] | COMMENT |
| LOW | tests/secrets/git_history/test_utils.py | 781 | files={ | COMMENT |
| LOW | tests/common/utils/test_secrets_utils.py | 201 | runner_filter.resource_attr_to_omit) == tfplan_resource_lines_without_secrets | COMMENT |
| LOW | tests/common/utils/test_secrets_utils.py | 241 | assert omit_secret_value_from_checks( | COMMENT |
| LOW | tests/common/utils/test_secrets_utils.py | 261 | # runner_filter = RunnerFilter(resource_attr_to_omit=ckv.config.mask) | COMMENT |
| LOW | tests/common/external_checks/verification/conftest.py | 21 | # fixture segfaults the worker inside ``posixpath.realpath`` for some | COMMENT |
| LOW | …common/external_checks/verification/test_regression.py | 781 | # -------------------------------------------------------------------------- | COMMENT |
| LOW | …common/external_checks/verification/test_regression.py | 881 | COMMENT | |
| LOW | …ecks/example_Secrets/pod-secretEnvironment-FAILED.yaml | 61 | # kubectl exec -it secret-test-pod -- env | grep USERNAME | COMMENT |
| LOW | …urityContexts/pod-container-FAILED_malformed_spec.yaml | 21 | securityContext: | COMMENT |
| LOW | …xample_SecurityContexts/pod-container-both-PASSED.yaml | 21 | securityContext: | COMMENT |
| LOW | …rivilegeEscalation/pod-runas1000-malformed-PASSED.yaml | 21 | securityContext: | COMMENT |
| LOW | …ple_AllowPrivilegeEscalation/pod-runas1000-PASSED.yaml | 21 | securityContext: | COMMENT |
| LOW | …bernetesDashboard/kubernetes-dashboard-deployment.yaml | 1 | # Copyright 2017 The Kubernetes Authors. | COMMENT |
| LOW | …on/checks/resource/aws/unused/ElasticsearchDomain.yaml | 81 | # GroupDescription: !Ref GroupDescription | COMMENT |
| LOW | …icsearchEncryption/ElasticsearchEncryption-PASSED.yaml | 81 | # GroupDescription: !Ref GroupDescription | COMMENT |
| LOW | …icsearchEncryption/ElasticsearchEncryption-FAILED.yaml | 81 | # GroupDescription: !Ref GroupDescription | COMMENT |
| LOW | …/example_ALBListener/ALBListenerHTTPS-FAILED-HTTP.yaml | 21 | # GroupDescription: 'checkov-alb-test' | COMMENT |
| LOW | …mple_ALBListener/ALBListenerHTTPS-PASSED-redirect.yaml | 21 | # GroupDescription: 'checkov-alb-test' | COMMENT |
| LOW | …example_ALBListener/ALBListenerHTTPS-PASSED-HTTPS.yaml | 21 | # GroupDescription: 'checkov-alb-test' | COMMENT |
| LOW | …unt/example_IAMRoleAllowAssumeFromAccount-PASSED-2.yml | 481 | # ComparisonOperator: LessThanOrEqualToThreshold | COMMENT |
| LOW | …unt/example_IAMRoleAllowAssumeFromAccount-PASSED-2.yml | 501 | # EvaluationPeriods: 3 | COMMENT |
| LOW | …cryption/ElasticsearchNodeToNodeEncryption-PASSED.yaml | 81 | # GroupDescription: !Ref GroupDescription | COMMENT |
| LOW | …cryption/ElasticsearchNodeToNodeEncryption-FAILED.yaml | 81 | # GroupDescription: !Ref GroupDescription | COMMENT |
| LOW | …ibution/CloudfrontDistributionEncryption-FAILED-2.yaml | 1 | AWSTemplateFormatVersion: '2010-09-09' | COMMENT |
| 65 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/github_action_resources/test_entrypoint.py | 13 | # Set GITHUB_ACTIONS to true so the script doesn't exit early | COMMENT |
| LOW | .github/workflows/pr-test.yml | 529 | # Check if the file is in the list of exceptions | COMMENT |
| LOW | …on_tests/src/python/AmazonMQBrokerPublicAccess/pass.py | 16 | publicly_accessible=False, # Set PubliclyAccessible to false | CODE |
| LOW | …sts/src/python/AmazonMQBrokerPublicAccess/fail__1__.py | 16 | publicly_accessible=True, # Set PubliclyAccessible to false | CODE |
| LOW | …ython/DMSReplicationInstancePubliclyAccessible/pass.py | 14 | publicly_accessible=False # Set PubliclyAccessible to False | CODE |
| LOW | …/DMSReplicationInstancePubliclyAccessible/fail__1__.py | 14 | publicly_accessible=True # Set PubliclyAccessible to False | CODE |
| LOW | …_integration_tests/src/python/DynamodbRecovery/pass.py | 15 | point_in_time_recovery=True, # Set PointInTimeRecoveryEnabled to True | CODE |
| LOW | …gration_tests/src/python/DynamodbRecovery/fail__1__.py | 15 | point_in_time_recovery=False, # Set PointInTimeRecoveryEnabled to True | CODE |
| LOW | …ion_tests/src/python/RDSEnhancedMonitorEnabled/pass.py | 17 | monitoring_interval=60, # Set MonitoringInterval to 60 seconds | CODE |
| LOW | …ation_tests/src/python/APIGatewayAuthorization/pass.py | 15 | api_key_required=True # Set ApiKeyRequired to false | CODE |
| LOW | …_tests/src/python/APIGatewayAuthorization/fail__1__.py | 15 | api_key_required=False # Set ApiKeyRequired to false | CODE |
| LOW | …s/src/python/RedshiftClusterPubliclyAccessible/pass.py | 15 | publicly_accessible=False, # Set PubliclyAccessible to False | CODE |
| LOW | …/python/RedshiftClusterPubliclyAccessible/fail__1__.py | 15 | publicly_accessible=True, # Set PubliclyAccessible to true | CODE |
| LOW | …gration_tests/src/python/RDSPubliclyAccessible/pass.py | 17 | publicly_accessible=False, # Set PubliclyAccessible to false | CODE |
| LOW | …on_tests/src/python/RDSPubliclyAccessible/fail__1__.py | 17 | publicly_accessible=True, # Set PubliclyAccessible to True | CODE |
| LOW | checkov/main.py | 278 | # Check if --output value is None. If so, replace with ['cli'] for default cli output. | COMMENT |
| LOW | …terraform/graph_builder/variable_rendering/renderer.py | 87 | # Check if the vertex at this index is an OCI terraform resource. | COMMENT |
| LOW | …hecks/graph_checks/azure/AzureSubnetConfigWithNSG.yaml | 9 | # Check if subnet & NSG are connected and present in the | COMMENT |
| LOW⚡ | …rm/checks/resource/gcp/GithubActionsOIDCTrustPolicy.py | 65 | # Check if the first claim or value are wildcards - if yes, the assertion is checking nothing | COMMENT |
| LOW⚡ | …rm/checks/resource/gcp/GithubActionsOIDCTrustPolicy.py | 69 | # Check if the first claim is an abusable claim - if yes, the whole assertion can be abused | COMMENT |
| LOW⚡ | …rm/checks/resource/gcp/GithubActionsOIDCTrustPolicy.py | 75 | # Check if the repo claim is in the form of org/repo | COMMENT |
| LOW | …erraform/checks/resource/panos/PolicyNoSrcAnyDstAny.py | 30 | # Check if source_addresses is defined in the resource | COMMENT |
| LOW | …erraform/checks/resource/panos/PolicyLoggingEnabled.py | 30 | # Check if logging at session end is defined in the resource | COMMENT |
| LOW | …v/terraform/checks/resource/panos/PolicyDescription.py | 30 | # Check if a description is defined in the rule | COMMENT |
| LOW | checkov/terraform/checks/resource/panos/PolicyNoDSRI.py | 30 | # Check if DSRI is defined in the resource | COMMENT |
| LOW | …raform/checks/resource/panos/PolicyNoApplicationAny.py | 30 | # Check if applications is defined in the resource | COMMENT |
| LOW | …terraform/checks/resource/panos/PolicyLogForwarding.py | 30 | # Check if a log_setting is defined in the rule | COMMENT |
| LOW | …erraform/checks/resource/panos/ZoneUserIDIncludeACL.py | 25 | # Check if User-ID is enabled in the zone | COMMENT |
| LOW | …/terraform/checks/resource/panos/PolicyNoServiceAny.py | 30 | # Check if services is defined in the resource | COMMENT |
| LOW | …/terraform/checks/resource/aws/S3AllowsAnyPrincipal.py | 12 | # Check if 'Condition' key exists | COMMENT |
| LOW | checkov/terraform/checks/data/aws/WhoAMI.py | 23 | # Check if owners is specified and not empty | COMMENT |
| LOW⚡ | …ov/terraform/module_loading/loaders/registry_loader.py | 191 | # Check if the source has '//' in it. If it does, it indicates a reference for an inner module. | COMMENT |
| LOW | checkov/dockerfile/checks/RunUsingAPT.py | 29 | # Check if 'apt' is used and it's not part of a 'rm' command | COMMENT |
| LOW | …/openapi/checks/resource/generic/SecurityOperations.py | 21 | # Check if security field is present and not empty at the root level | COMMENT |
| LOW | checkov/ansible/utils.py | 145 | if tasks: # Check if tasks is not empty | CODE |
| LOW | checkov/ansible/graph_builder/local_graph.py | 35 | if tasks: # Check if tasks is not None and not empty | CODE |
| LOW | checkov/common/util/prompt.py | 246 | # Write file | COMMENT |
| LOW | …ttribute_solvers/cidr_range_subset_attribute_solver.py | 24 | # Check if all vertex ranges are subsets of at least one of the allowed ranges | COMMENT |
| LOW | checkov/common/bridgecrew/platform_integration.py | 1450 | # Check if the URL already contains GET parameters. | COMMENT |
| LOW | …kov/example_runner/checks/job/ExampleCheckTrueFalse.py | 67 | # Set this to your check name | COMMENT |
| LOW | checkov/arm/graph_builder/local_graph.py | 157 | # Check if the processed dependency exists in the map | COMMENT |
| LOW | checkov/kubernetes/checks/resource/base_registry.py | 66 | # Check if namespace in allowed namespaces | COMMENT |
| LOW | checkov/kubernetes/checks/resource/base_rbac_check.py | 53 | # Check if a rule has an apigroup, verb, and resource specified in @operation | COMMENT |
| LOW | checkov/kubernetes/checks/resource/base_rbac_check.py | 79 | # Check if rule has a key with a wildcard or a value from @value_list | COMMENT |
| LOW | checkov/kubernetes/checks/resource/base_rbac_check.py | 87 | # Check if value is a K8s RBAC wildcard | COMMENT |
| LOW⚡ | checkov/cloudformation/cfn_utils.py | 253 | # Check if Globals exist in the template | COMMENT |
| LOW | checkov/helm/base_registry.py | 71 | # Check if namespace in allowed namespaces | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …_tests/src/typescript/CloudWatchLogGroupKMSKey/fail.ts | 18 | // Example usage | COMMENT |
| LOW | …_tests/src/typescript/CloudWatchLogGroupKMSKey/pass.ts | 20 | // Example usage | COMMENT |
| LOW | …tion_tests/src/typescript/CloudtrailEncryption/fail.ts | 22 | // Example usage | COMMENT |
| LOW | …tion_tests/src/typescript/CloudtrailEncryption/pass.ts | 23 | // Example usage | COMMENT |
| LOW | …tion_tests/src/typescript/CloudtrailEncryption/pass.ts | 43 | // Example usage | COMMENT |
| LOW | …tegration_tests/src/typescript/DocDBEncryption/pass.ts | 26 | // Example usage | COMMENT |
| LOW | …tion_tests/src/typescript/DocDBEncryption/fail__2__.ts | 26 | // Example usage | COMMENT |
| LOW | …tion_tests/src/typescript/DocDBEncryption/fail__2__.ts | 52 | // Example usage | COMMENT |
| LOW | …rc/typescript/CloudfrontDistributionEncryption/pass.ts | 32 | // Example usage | COMMENT |
| LOW | …rc/typescript/CloudfrontDistributionEncryption/pass.ts | 53 | // Example usage | COMMENT |
| LOW | …pescript/CloudfrontDistributionEncryption/fail__2__.ts | 32 | // Example usage | COMMENT |
| LOW | …pescript/CloudfrontDistributionEncryption/fail__2__.ts | 54 | // Example usage | COMMENT |
| LOW | …ntegration_tests/src/typescript/DocDBAuditLogs/pass.ts | 19 | // Example usage | COMMENT |
| LOW | …ation_tests/src/typescript/DocDBAuditLogs/fail__2__.ts | 19 | // Example usage | COMMENT |
| LOW | …ation_tests/src/typescript/DocDBAuditLogs/fail__2__.ts | 37 | // Example usage | COMMENT |
| LOW | …cript/DMSReplicationInstancePubliclyAccessible/fail.ts | 31 | // Example usage | COMMENT |
| LOW | …cript/DMSReplicationInstancePubliclyAccessible/pass.ts | 31 | // Example usage | COMMENT |
| LOW | …egration_tests/src/typescript/DynamodcRecovery/pass.ts | 24 | // Example usage | COMMENT |
| LOW | …egration_tests/src/typescript/DynamodcRecovery/pass.ts | 47 | // Example usage | COMMENT |
| LOW | …ion_tests/src/typescript/DynamodcRecovery/fail__2__.ts | 24 | // Example usage | COMMENT |
| LOW | …ion_tests/src/typescript/DynamodcRecovery/fail__2__.ts | 47 | // Example usage | COMMENT |
| LOW | …s/src/typescript/CloudfrontDistributionLogging/pass.ts | 32 | // Example usage | COMMENT |
| LOW | …s/src/typescript/CloudfrontDistributionLogging/pass.ts | 72 | // Example usage | COMMENT |
| LOW | …/typescript/CloudfrontDistributionLogging/fail__2__.ts | 32 | // Example usage | COMMENT |
| LOW | …/typescript/CloudfrontDistributionLogging/fail__2__.ts | 69 | // Example usage | COMMENT |
| LOW | cdk_integration_tests/src/typescript/DocDBTLS/fail.ts | 19 | // Example usage | COMMENT |
| LOW | cdk_integration_tests/src/typescript/DocDBTLS/pass.ts | 19 | // Example usage | COMMENT |
| LOW | …integration_tests/src/typescript/DAXEncryption/pass.ts | 22 | // Example usage | COMMENT |
| LOW | …ration_tests/src/typescript/DAXEncryption/fail__2__.ts | 22 | // Example usage | COMMENT |
| LOW | …ration_tests/src/typescript/DAXEncryption/fail__2__.ts | 42 | // Example usage | COMMENT |
| LOW | …sts/src/typescript/DynamodbGlobalTableRecovery/fail.ts | 33 | // Example usage | COMMENT |
| LOW | …sts/src/typescript/DynamodbGlobalTableRecovery/pass.ts | 33 | // Example usage | COMMENT |
| LOW | …ests/src/typescript/CodeBuildProjectEncryption/fail.ts | 39 | // Example usage | COMMENT |
| LOW | …ests/src/typescript/CodeBuildProjectEncryption/pass.ts | 44 | // Example usage | COMMENT |
| LOW | …ests/src/typescript/CodeBuildProjectEncryption/pass.ts | 84 | // Example usage | COMMENT |
| LOW | …integration_tests/src/typescript/EBSEncryption/pass.ts | 30 | // Example usage | COMMENT |
| LOW | …integration_tests/src/typescript/EBSEncryption/pass.ts | 64 | // Example usage | COMMENT |
| LOW | …ration_tests/src/typescript/EBSEncryption/fail__2__.ts | 30 | // Example usage | COMMENT |
| LOW | …ration_tests/src/typescript/EBSEncryption/fail__2__.ts | 63 | // Example usage | COMMENT |
| LOW | …sts/src/typescript/CloudWatchLogGroupRetention/fail.ts | 19 | // Example usage | COMMENT |
| LOW | …sts/src/typescript/CloudWatchLogGroupRetention/pass.ts | 20 | // Example usage | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/test_main.py | 97 | "--show-config", # just set to terminate the run early enough | CODE |
| MEDIUM | …ks/resource/panos/example_PolicyLoggingEnabled/main.tf | 3 | # Using "log_end" enables logging at session end which is in Palo Alto Networks best practices | COMMENT |
| MEDIUM⚡ | tests/sca_package_2/conftest.py | 471 | {'branch': '', 'cicdDetails': {'runId': 1, 'pr': '', 'commit': '', 'scaCliScanId': '1670509263116'}, 'filePa | CODE |
| MEDIUM⚡ | tests/sca_package_2/conftest.py | 471 | {'branch': '', 'cicdDetails': {'runId': 1, 'pr': '', 'commit': '', 'scaCliScanId': '1670509263116'}, 'filePa | CODE |
| MEDIUM⚡ | tests/sca_package_2/conftest.py | 471 | {'branch': '', 'cicdDetails': {'runId': 1, 'pr': '', 'commit': '', 'scaCliScanId': '1670509263116'}, 'filePa | CODE |
| LOW | …raform/checks/resource/gcp/GoogleCloudDNSSECEnabled.py | 24 | # default visibility is public; just use base class implementation | COMMENT |
| LOW | checkov/common/util/secrets.py | 113 | # set a default if no category is provided; or, if categories were provided and they include 'all', then just set it | COMMENT |
| LOW | checkov/common/util/secrets.py | 241 | # set a default if no category is provided; or, if categories were provided and they include 'all', then just set it | COMMENT |
| LOW | checkov/common/output/report.py | 596 | # ignore the index and the for_each value and just use the module name as it's not possible to | COMMENT |
| MEDIUM | checkov/arm/base_resource_check.py | 32 | # leverage ARM checks to use with bicep runner | COMMENT |
| LOW | checkov/sca_package_2/runner.py | 61 | return {}, dict() # should just return an empty result | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | README.md | 463 | BC_API_KEY: your-api-key | CODE |
| HIGH | docs/7.Scan Examples/Git History.md | 23 | checkov -d <git dir> --scan-secrets-history --bc-api-key <your_api_key> --repo-id <repo/name> | CODE |
| HIGH | docs/7.Scan Examples/Git History.md | 28 | checkov -d <git dir> --scan-secrets-history --secrets-history-timeout 1h --bc-api-key <your_api_key> --repo-id <repo/nam | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/github_action_resources/test_entrypoint.py | 38 | CODE | |
| LOW | checkov/runner_filter.py | 32 | CODE | |
| LOW | checkov/terraform/tf_parser.py | 80 | CODE | |
| LOW | checkov/terraform/graph_manager.py | 25 | CODE | |
| LOW | …graph_builder/variable_rendering/evaluate_terraform.py | 136 | CODE | |
| LOW | checkov/common/output/cyclonedx.py | 430 | CODE | |
| LOW | checkov/common/output/record.py | 37 | CODE | |
| LOW | checkov/common/output/secrets_record.py | 31 | CODE | |
| LOW | checkov/github/dal.py | 86 | CODE | |
| LOW | checkov/github/dal.py | 144 | CODE | |
| LOW | checkov/github/dal.py | 149 | CODE | |
| LOW | checkov/github/dal.py | 154 | CODE | |
| LOW | checkov/github/dal.py | 162 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | tests/secrets/sanity/non_iac_fp/a.py | 11 | CODE | |
| MEDIUM | tests/secrets/sanity/non_iac_fp/a.py | 15 | CODE | |
| MEDIUM | tests/secrets/sanity/non_iac_fp/a.py | 17 | CODE | |
| MEDIUM | tests/secrets/sanity/non_iac_fp/a.py | 25 | CODE | |
| MEDIUM | tests/secrets/sanity/non_iac_fp/a.py | 27 | CODE | |
| MEDIUM | tests/sca_package_2/test_output_reports.py | 207 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …rce/gcp/example_GoogleBigQueryDatasetPublicACL/main.tf | 23 | user_by_email = "foo@bar.com" | CODE |
| LOW | …GCPDocumentAIWarehouseLocationEncryptedWithCMK/main.tf | 6 | kms_key = "dummy_key" | CODE |
| LOW | …sources/SynapseSQLPoolHasSecurityAlertPolicy/pass.json | 25 | "admin@example.com" | CODE |
| LOW | …ph/checks/resources/LambdaOpenCorsPolicy/template.yaml | 33 | ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret | CODE |
| LOW | …ph/checks/resources/LambdaOpenCorsPolicy/template.yaml | 50 | ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret | CODE |
| LOW | …ph/checks/resources/LambdaOpenCorsPolicy/template.yaml | 73 | ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret | CODE |
| LOW | …ph/checks/resources/LambdaOpenCorsPolicy/template.yaml | 95 | ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret | CODE |
| LOW | …ph/checks/resources/LambdaOpenCorsPolicy/template.yaml | 117 | ServiceToken: "arn:aws:lambda:us-west-2:123456789012:function:dummy-token" # checkov:skip=CKV_SECRET_6 test secret | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …hecks/resource/gcp/example_GKEDontUseNodePools/main.tf | 49 | # temporary scaffold required by the provider — not a long-lived pool. | COMMENT |
| MEDIUM | tests/common/external_checks/verification/conftest.py | 340 | # --- Shared test scaffolding ----------------------------------------------- | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | checkov/common/sca/commons.py | 84 | The purpose of this function is making sure there are no conflicts between those resources, and return a valid rage | STRING |
| LOW | …fra/solvers/attribute_solvers/base_attribute_solver.py | 85 | # we need to check if tags is variable dependent even though this is a not value_attribute check | COMMENT |
| LOW | checkov/kustomize/runner.py | 276 | The purpose of this function is to remove any unintentional additions like this one. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | tests/serverless/checks/test_check_types.py | 21 | def helper(self, check): | CODE |
| LOW | …ttributes_plugin/tests/test_files/typing_class_skip.py | 12 | def do_something(self) -> str: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW⚡ | dogfood_tests/test_checkov_dogfood.py | 67 | }, "Don't forget to add a test case for the new runner here" | CODE |