config-scan

Config Scan

Security review of configuration files and infrastructure as code.

Quick Start

/config-scan                      # Scan all config files
/config-scan --docker             # Docker files only
/config-scan --k8s                # Kubernetes manifests
/config-scan --terraform          # Terraform files
/config-scan --env                # Environment files

What This Skill Detects

Environment Files

• Secrets in .env files
• Insecure default values
• Missing required security variables

Docker Security

• Running as root
• Exposed sensitive ports
• Insecure base images
• Missing security options

Kubernetes Security

• Privileged containers
• Missing resource limits
• Insecure service accounts
• Network policy gaps

Infrastructure as Code

• Overly permissive IAM policies
• Public S3 buckets
• Unencrypted storage
• Missing security groups

Application Config

• Debug mode enabled
• Verbose error messages
• Insecure defaults

Scan Categories

Environment Files

Files scanned: .env, .env.*, *.env

Issue	Severity	Description
Secrets in .env	HIGH	Credentials should use secrets manager
.env committed	CRITICAL	Should be in .gitignore
DEBUG=true	HIGH	Debug mode in production config
Weak secrets	MEDIUM	Short or simple values

Detection patterns:

# Committed .env files
git ls-files | grep -E '\.env$|\.env\.'

# Secrets in env files
(PASSWORD|SECRET|KEY|TOKEN|CREDENTIAL)=.+

# Debug flags
DEBUG=(true|1|yes)
NODE_ENV=development

Docker Security

Files scanned: Dockerfile, docker-compose.yml

Issue	Severity	Description
USER root	HIGH	Container runs as root
COPY secrets	CRITICAL	Secrets copied into image
Latest tag	MEDIUM	Unpinned base image
Exposed ports	LOW	Wide port exposure
No healthcheck	LOW	Missing health monitoring

Detection patterns:

# Running as root (no USER directive)
FROM.*\n(?!.*USER)

# Copying secrets
COPY.*\.(pem|key|crt|env)
COPY.*secret
COPY.*password

# Unpinned images
FROM\s+\w+:latest
FROM\s+\w+\s*$

# Dangerous capabilities
--privileged
--cap-add

docker-compose.yml issues:

# Privileged mode
privileged: true

# All capabilities
cap_add:
  - ALL

# Host network
network_mode: host

# Sensitive mounts
volumes:
  - /:/host
  - /var/run/docker.sock

Kubernetes Security

Files scanned: *.yaml, *.yml (k8s manifests)

Issue	Severity	Description
privileged: true	CRITICAL	Full host access
runAsRoot	HIGH	Container runs as root
No resource limits	MEDIUM	DoS risk
hostNetwork	HIGH	Pod uses host network
No securityContext	MEDIUM	Missing security settings

Detection patterns:

# Privileged containers
securityContext:
  privileged: true

# Running as root
securityContext:
  runAsUser: 0
runAsNonRoot: false

# Host access
hostNetwork: true
hostPID: true
hostIPC: true

# Dangerous volume mounts
volumes:
  - hostPath:
      path: /

# Missing limits
# (absence of resources.limits)

# Wildcard RBAC
rules:
  - apiGroups: ["*"]
    resources: ["*"]
    verbs: ["*"]

Terraform/IaC

Files scanned: *.tf, *.tfvars

Issue	Severity	Description
Public S3 bucket	CRITICAL	Data exposure
* in IAM policy	HIGH	Overly permissive
No encryption	HIGH	Data at rest unencrypted
0.0.0.0/0 ingress	HIGH	Open to internet
Hardcoded secrets	CRITICAL	Credentials in TF

Detection patterns:

# Public S3
acl = "public-read"
acl = "public-read-write"

# Overly permissive IAM
"Action": "*"
"Resource": "*"
"Principal": "*"

# Open security groups
cidr_blocks = ["0.0.0.0/0"]
ingress {
  from_port = 0
  to_port   = 65535

# Missing encryption
encrypted = false
# (or absence of encryption settings)

# Hardcoded secrets
password = "..."
secret_key = "..."

Application Config

Files scanned: config/*.json, *.config.js, application.yml

Issue	Severity	Description
DEBUG=true	HIGH	Debug in production
Verbose errors	MEDIUM	Stack traces exposed
CORS *	HIGH	All origins allowed
No HTTPS	MEDIUM	Unencrypted transport

Detection patterns:

// Debug mode
debug: true,
DEBUG: true,
NODE_ENV: 'development'

// Verbose errors
showStackTrace: true
detailedErrors: true

// CORS
origin: '*'
origin: true
Access-Control-Allow-Origin: *

// Session security
secure: false  // cookies
httpOnly: false
sameSite: 'none'

Output Format

CONFIG SCAN RESULTS
===================

Files scanned: 23
Issues found: 15

CRITICAL (2)
------------
[!] Dockerfile:1 - Running as root
    No USER directive found
    Fix: Add "USER node" or similar non-root user

[!] terraform/s3.tf:12 - Public S3 bucket
    acl = "public-read"
    Fix: Remove public ACL, use bucket policies

HIGH (5)
--------
[H] docker-compose.yml:15 - Privileged container
    privileged: true
    Fix: Remove privileged flag, use specific capabilities

[H] k8s/deployment.yaml:34 - Missing resource limits
    No CPU/memory limits defined
    Fix: Add resources.limits section

...

MEDIUM (8)
----------
...

Configuration

Ignore Rules

Create .config-scan-ignore:

# Ignore specific files
files:
  - "docker-compose.dev.yml"
  - "terraform/modules/test/**"

# Ignore specific rules
rules:
  - id: "docker-root-user"
    files: ["Dockerfile.dev"]
    reason: "Development only"

  - id: "k8s-no-limits"
    reason: "Handled by LimitRange"

Scan Profiles

# .config-scan.yaml
profile: production  # or: development, strict

# Custom thresholds
thresholds:
  fail_on: high
  warn_on: medium

# Specific scanners
scanners:
  docker: true
  kubernetes: true
  terraform: true
  env_files: true
  app_config: true

Best Practices Checked

Docker

• Non-root user specified
• Base image pinned to digest
• No secrets in build
• Multi-stage build used
• Health check defined
• Read-only root filesystem

Kubernetes

• Non-root security context
• Resource limits defined
• Network policies in place
• No privileged containers
• Service accounts scoped
• Secrets encrypted at rest

Terraform

• State file encrypted
• No hardcoded secrets
• Least privilege IAM
• Encryption enabled
• Logging enabled
• No public access by default

Remediation Examples

Docker: Run as Non-Root

# Before
FROM node:18

# After
FROM node:18
RUN groupadd -r app && useradd -r -g app app
USER app

Kubernetes: Security Context

# Before
containers:
  - name: app
    image: myapp

# After
containers:
  - name: app
    image: myapp
    securityContext:
      runAsNonRoot: true
      runAsUser: 1000
      readOnlyRootFilesystem: true
      allowPrivilegeEscalation: false

Terraform: Private S3

# Before
resource "aws_s3_bucket" "data" {
  acl = "public-read"
}

# After
resource "aws_s3_bucket" "data" {
  # No ACL (private by default)
}

resource "aws_s3_bucket_public_access_block" "data" {
  bucket = aws_s3_bucket.data.id
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

CI/CD Integration

# GitHub Actions
- name: Config Security Scan
  run: |
    /config-scan --fail-on high

- name: Docker Scan
  run: |
    /config-scan --docker --fail-on critical

Related Skills

• /security-scan - Full security analysis
• /secrets-scan - Credential detection
• /dependency-scan - Package vulnerabilities