# Infrastructure review checks

These checks describe what a review looks for. They do not run a review, connect to a cloud account, or prove that infrastructure is secure. Infrastructure text can be Terraform, CloudFormation, Kubernetes, Pulumi YAML, Pulumi programs, Docker Compose, a Dockerfile, or a GitHub Actions workflow. The list includes a public database, wildcard permissions, a Docker socket, a missing memory limit, a disabled timeout, a one-connection pool, a container that runs as root, a workflow that checks out pull request code from pull_request_target, and an action pinned to @main.

- [Public network access](https://skaleagents.com/checks/public-network-access.md): An unrestricted IPv4 range (0.0.0.0/0) or IPv6 range (::/0) used as a source outside an explicit egress rule.
- [Wildcard IAM permissions](https://skaleagents.com/checks/wildcard-iam-permissions.md): An unrestricted IAM action pattern in the supplied infrastructure text.
- [Elevated container privileges](https://skaleagents.com/checks/elevated-container-privileges.md): A Kubernetes manifest that enables a privileged execution setting.
- [Container image scan](https://skaleagents.com/checks/container-image-scan.md): This check does not scan a container registry. It is listed so a review can say the image was not scanned.
- [Error rate](https://skaleagents.com/checks/error-rate.md): A supplied errorRate of 0.05 or higher.
- [Failed scheduled jobs](https://skaleagents.com/checks/failed-scheduled-jobs.md): A supplied failedCrons count greater than zero.
- [Retry and timeout patterns](https://skaleagents.com/checks/retry-and-timeout-patterns.md): A retryCount of 3 or more, or at least two log lines that mention a timeout, connection reset, retry exhaustion, retrying, or HTTP 429 or 503.
- [Model token consumption](https://skaleagents.com/checks/model-token-consumption.md): A supplied tokenCount or tokens value of 100,000 or more.
- [AI API latency](https://skaleagents.com/checks/ai-api-latency.md): A supplied apiLatencyMs or routingLatencyMs of 500 or more.
- [AI compute utilization](https://skaleagents.com/checks/ai-compute-utilization.md): A supplied computeUtilization, gpuUtilization, or cpuUtilization of 85 percent or more.
- [Autoscaling capacity](https://skaleagents.com/checks/autoscaling-capacity.md): cpuUtilization of 80 percent or more while minReplicas is greater than or equal to maxReplicas.
- [Database bottlenecks](https://skaleagents.com/checks/database-bottlenecks.md): dbQueryLatencyMs or databaseQueryLatencyMs of 500 or more, or a slowQueryCount or dbSlowQueries greater than zero.
- [Public database](https://skaleagents.com/checks/public-database.md): A database that enables public network access in Terraform, CloudFormation, Kubernetes, Pulumi YAML, a Pulumi program, or Docker Compose.
- [Docker socket](https://skaleagents.com/checks/docker-socket.md): A workload that mounts the Docker socket or another host path, including a Compose volume for /var/run/docker.sock.
- [Missing memory limit](https://skaleagents.com/checks/missing-memory-limit.md): A container that does not set a memory limit, or a Compose memory limit of 0.
- [Disabled timeout](https://skaleagents.com/checks/disabled-timeout.md): An application snippet that sets a timeout to 0, false, or none.
- [One-connection pool](https://skaleagents.com/checks/one-connection-pool.md): An application snippet that caps a connection pool at one.
- [Container runs as root](https://skaleagents.com/checks/container-runs-as-root.md): A Dockerfile whose last USER is root or 0, or a Dockerfile with no USER instruction.
- [Remote script piped to a shell](https://skaleagents.com/checks/remote-script-piped-to-a-shell.md): A Dockerfile RUN instruction that downloads a script with curl or wget and pipes it to sh or bash.
- [Pull request target checkout of PR code](https://skaleagents.com/checks/pull-request-target-checkout.md): A GitHub Actions workflow that triggers on pull_request_target and checks out the pull request head ref or head sha.
- [Action pinned to @main](https://skaleagents.com/checks/action-pinned-to-main.md): A GitHub Actions uses value pinned to @main or @master.
- [Secret file copied into an image](https://skaleagents.com/checks/secret-file-copied-into-an-image.md): A Dockerfile COPY or ADD whose source is .env, id_rsa, id_ed25519, a .pem file, or a path ending in credentials.
- [Workflow prints a secret](https://skaleagents.com/checks/workflow-prints-a-secret.md): A GitHub Actions run script that echoes or prints a ${{ secrets. }} expression.
- [Workflow permissions are broad](https://skaleagents.com/checks/workflow-permissions-are-broad.md): A GitHub Actions workflow whose permissions value is write-all, or a pull_request_target workflow that sets contents: write.
- [Secret assigned in an image variable](https://skaleagents.com/checks/secret-assigned-in-an-image-variable.md): A Dockerfile ENV or ARG whose name is password, passwd, secret, api_key, apikey, auth_token, access_key, private_key, or token, with a non-empty literal value.
- [Secret assigned in workflow env](https://skaleagents.com/checks/secret-assigned-in-workflow-env.md): A GitHub Actions env mapping whose key matches those secret-like names and whose value is a non-empty literal.
- [Helm privileged container](https://skaleagents.com/checks/helm-privileged-container.md): A Helm template that sets privileged: true outside a comment.
- [Ansible task runs as root](https://skaleagents.com/checks/ansible-task-runs-as-root.md): An Ansible play or task that sets become: true or become: yes outside a comment.
- [Storage encryption disabled](https://skaleagents.com/checks/storage-encryption-disabled.md): A database or volume that sets encryption to false, such as storage_encrypted = false or encrypted = false.
- [Database backups disabled](https://skaleagents.com/checks/database-backups-disabled.md): A database whose backup retention period is set to zero.
- [Possible AWS access key](https://skaleagents.com/checks/possible-aws-access-key.md): A value matching an AWS access key id: AKIA or ASIA, then 16 letters or digits.
- [Private key material in source](https://skaleagents.com/checks/private-key-material-in-source.md): A private key block in the submitted text. The scanner matches an RSA, EC, OpenSSH, DSA, or generic private key header.
- [Pipeline prints a secret](https://skaleagents.com/checks/pipeline-prints-a-secret.md): A GitLab CI, Azure Pipelines, or Cloud Build script line that echoes or prints a secret-like variable.
- [Unpinned pipeline image](https://skaleagents.com/checks/unpinned-pipeline-image.md): A GitLab CI, Azure Pipelines, or Cloud Build image or step name that uses latest, or that has no tag and no digest.
- [Secret assigned in a Terraform variable](https://skaleagents.com/checks/secret-assigned-in-a-terraform-variable.md): A tfvars assignment or Terraform variable default that gives a non-empty literal to a secret-like name.
- [Public input on a Terraform module](https://skaleagents.com/checks/public-input-on-a-terraform-module.md): A Terraform module argument set to 0.0.0.0/0 or ::/0, unless the argument is egress, destination, or ipv6 egress, or a module argument publicly_accessible = true.
- [Secret assigned in a Terraform local](https://skaleagents.com/checks/secret-assigned-in-a-terraform-local.md): A Terraform local whose name looks like a password, secret, or token, and whose value is a non-empty literal.
- [Secret assigned in serverless environment](https://skaleagents.com/checks/secret-assigned-in-serverless-environment.md): A Serverless Framework provider or function environment entry whose name looks like a password, secret, or token, and whose value is a non-empty literal.
- [IAM policy allows every action](https://skaleagents.com/checks/iam-policy-allows-every-action.md): A standalone IAM policy statement whose Effect is Allow, or omitted, and whose Action is * or a list containing only *.
- [Referenced value is public](https://skaleagents.com/checks/referenced-value-is-public.md): A var, local, or CloudFormation parameter Default of 0.0.0.0/0 or ::/0 used through a reference. Files in one audit share those defaults.
- [Referenced secret](https://skaleagents.com/checks/referenced-secret.md): A same-file secret-like variable or parameter default used through a reference.
- [IAM condition allows every address](https://skaleagents.com/checks/iam-condition-allows-every-address.md): An IpAddress or aws:SourceIp value of 0.0.0.0/0, ::/0, or * on a standalone IAM policy or a Serverless iamRoleStatements entry.
- [Substituted value is public](https://skaleagents.com/checks/substituted-value-is-public.md): A same-file Fn::Sub or format result of 0.0.0.0/0 or ::/0.
- [Policy allows any principal](https://skaleagents.com/checks/policy-allows-any-principal.md): Principal * on an Allow statement inside a resource policy.
- [Joined value is public](https://skaleagents.com/checks/joined-value-is-public.md): A join or Fn::Join of known literals that results in 0.0.0.0/0 or ::/0.
- [Mapped value is public](https://skaleagents.com/checks/mapped-value-is-public.md): An Fn::FindInMap result of 0.0.0.0/0 or ::/0 used as an ingress CIDR.
- [Package script pipes a download to a shell](https://skaleagents.com/checks/package-script-pipes-a-download-to-a-shell.md): A scripts.preinstall, scripts.install, or scripts.postinstall value that downloads with curl or wget and pipes to sh or bash.
- [Dependency range is floating](https://skaleagents.com/checks/dependency-range-is-floating.md): A dependencies, devDependencies, or optionalDependencies value that is exactly * or latest.