// tool reference · Vulnerability & Assessment

Config and IaC Review Assistant Free

Dockerfile、nginx、.env、compose / K8s、Actions、Terraform を貼り付けると、設定不備を重要度順に示し、修正方法を提示します。

What it does

Audits infrastructure-as-code and server configuration — Terraform, Docker, Kubernetes, nginx, Apache — for the misconfigurations that become incidents.

When to use it

Reviewing IaC before merge; auditing an inherited Dockerfile or nginx config.

Inputs

Field names are the actual form parameters, verified against source.

Field	種類	Required	Notes
cfg	textarea	required	The configuration.
type	select	任意	Config type. Auto-detected when omitted.

What you get back

Findings with severity and the corrected directive.

活用例

Input

FROM ubuntu:latest
USER root
COPY . /app
EXPOSE 22
CMD ["./start.sh"]

Output (abridged)

HIGH    'ubuntu:latest' is unpinned — builds are not reproducible and
        you cannot know what shipped. → pin a digest: ubuntu@sha256:…

HIGH    Container runs as root. A container escape starts as root.
        → RUN useradd -r -u 10001 app && USER 10001

MEDIUM  'COPY . /app' copies the build context — .git, .env and CI
        secrets included. → add a .dockerignore; copy explicit paths.

MEDIUM  EXPOSE 22 — SSH in a container is an anti-pattern.
        → use `docker exec`; drop sshd.

How it works

Deterministic rule pass, then AI interpretation.

Limits

Read live from the platform configuration.

Rate limit

30 requests / 60s (platform default)

Limitations — what it does なし do

It audits the text you paste. It cannot see values injected at deploy, a base image's own contents, or an admission controller that would reject the manifest anyway. Clean output means the file is clean, not the cluster.

プライバシー

Config is sent to the AI provider. Redact secrets first.

Standards

CIS Docker BenchmarkCIS Kubernetes BenchmarkNIST CSF