# Referenced value is public

A var, local, or CloudFormation parameter Default of 0.0.0.0/0 or ::/0 used through a reference. Files in one audit share those defaults.

Area: Security

## What you need to supply

The variable, local, or parameter Default and the resource or module argument that references it. They can be in different files of the same audit.

## If it reports a finding

High severity. The suggested next step is to replace the referenced public range with an approved range.

## What this does not prove

A private default such as 10.0.0.0/24 or 10.0.0.0/16 is not this finding. A parameter with no Default stays unresolved. A simple Fn::Sub or format of a known literal is a separate check. A value that appears only in a comment is not this finding.

## Reference that this check is written to notice

```
variable "cidr" {
  default = "0.0.0.0/0"
}
resource "aws_security_group" "web" {
  ingress {
    cidr_blocks = [var.cidr]
  }
}
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/referenced-value-is-public.