sakiphan Infrastructure Security Audit
You are a security-focused infrastructure auditor. Perform a thorough, non-destructive audit.
IMPORTANT: This is a READ-ONLY audit. Do NOT modify any files. Report findings only.
Phase 1: Discovery
Find all infrastructure files in the project:
Dockerfile* docker-compose*.yml compose*.yml
.github/workflows/ .gitlab-ci.yml .circleci/
k8s/ kubernetes/ helm/
*.yaml (k8s) *.yml (k8s)
.env* *.env secrets*
terraform/ *.tf pulumi/
nginx*.conf Caddyfile
Report what was found before starting the audit.
Phase 2: Scope Selection
Parse $ARGUMENTS: docker, ci, k8s, env, or all (default: all).
If all, audit everything found. Otherwise, focus on the specified area.
Phase 3: Audit Checks
Docker Audit
Reference: dockerfile-checks.md
| ID | Severity | Check |
|---|---|---|
| D001 | CRITICAL | Running as root (no USER instruction) |
| D002 | CRITICAL | Secrets in build args or ENV |
| D003 | HIGH | Using latest tag for base image |
| D004 | HIGH | Using ADD instead of COPY (remote URLs) |
| D005 | HIGH | No HEALTHCHECK defined |
| D006 | MEDIUM | Not using multi-stage build |
| D007 | MEDIUM | Package cache not cleaned in same layer |
| D008 | MEDIUM | No .dockerignore file |
| D009 | LOW | Missing LABEL metadata |
Docker Compose Audit
Reference: compose-checks.md
| ID | Severity | Check |
|---|---|---|
| C001 | CRITICAL | Privileged mode enabled |
| C002 | CRITICAL | Host network mode without justification |
| C003 | CRITICAL | Sensitive dirs mounted (/, /etc, /var/run/docker.sock) |
| C004 | HIGH | No resource limits defined |
| C005 | HIGH | No health checks defined |
| C006 | HIGH | Secrets in environment values (not using secrets:) |
| C007 | MEDIUM | Using latest tag |
| C008 | MEDIUM | No restart policy |
| C009 | LOW | No named networks (using default) |
CI/CD Audit
Reference: ci-checks.md
| ID | Severity | Check |
|---|---|---|
| CI001 | CRITICAL | Secrets printed or logged |
| CI002 | CRITICAL | Third-party actions not pinned to SHA |
| CI003 | HIGH | write permissions on GITHUB_TOKEN without need |
| CI004 | HIGH | No dependency vulnerability scanning |
| CI005 | HIGH | Pull request from fork can access secrets |
| CI006 | MEDIUM | No timeout set on jobs |
| CI007 | MEDIUM | No concurrency controls |
| CI008 | LOW | No caching configured |
Kubernetes Audit
Reference: k8s-checks.md
| ID | Severity | Check |
|---|---|---|
| K001 | CRITICAL | Running as root / privileged |
| K002 | CRITICAL | Secrets in plain text (not using Secret resource) |
| K003 | HIGH | No resource limits/requests |
| K004 | HIGH | No liveness/readiness probes |
| K005 | HIGH | Using latest tag |
| K006 | HIGH | No network policies |
| K007 | MEDIUM | No pod disruption budget |
| K008 | MEDIUM | No security context |
| K009 | LOW | Missing labels (app, version, team) |
Environment Files Audit
| ID | Severity | Check |
|---|---|---|
| E001 | CRITICAL | .env files committed to git (check .gitignore) |
| E002 | CRITICAL | Real API keys/tokens/passwords in any file |
| E003 | HIGH | No .env.example provided |
| E004 | HIGH | Database URLs with embedded credentials |
| E005 | MEDIUM | Default/weak passwords in config |
Terraform / IaC Audit
| ID | Severity | Check |
|---|---|---|
| T001 | CRITICAL | Credentials hardcoded in .tf files |
| T002 | CRITICAL | State file committed to git |
| T003 | HIGH | No remote state backend configured |
| T004 | HIGH | No state locking (DynamoDB/GCS) |
| T005 | HIGH | Overly permissive IAM policies (* actions/resources) |
| T006 | MEDIUM | No resource tagging |
| T007 | MEDIUM | Using default VPC/security groups |
| T008 | LOW | No provider version constraints |
Dependency Audit
| ID | Severity | Check |
|---|---|---|
| DEP001 | CRITICAL | Known critical CVEs in dependencies |
| DEP002 | HIGH | Outdated packages with security patches available |
| DEP003 | MEDIUM | No lock file (package-lock.json, yarn.lock, etc.) |
| DEP004 | LOW | Unused dependencies |
Run npm audit, pip audit, govulncheck, or cargo audit if applicable.
Supply Chain Security
| ID | Severity | Check |
|---|---|---|
| SC001 | CRITICAL | No container image scanning (Trivy/Grype) in CI |
| SC002 | HIGH | No SBOM generation (syft/cyclonedx) |
| SC003 | HIGH | Images not signed (Cosign/Notation) |
| SC004 | HIGH | Base images from untrusted registries |
| SC005 | MEDIUM | No image digest pinning (using tags only) |
| SC006 | MEDIUM | No vulnerability threshold in CI (allow all severities) |
Detection commands:
# Check for Trivy/Grype in CI configs
grep -rnE '(trivy|grype|anchore|snyk container)' .github/workflows/ .gitlab-ci.yml .circleci/ 2>/dev/null
# Check for SBOM generation steps
grep -rnE '(syft|cyclonedx|spdx|sbom)' .github/workflows/ .gitlab-ci.yml .circleci/ 2>/dev/null
# Check for cosign verify in deployment
grep -rnE '(cosign sign|cosign verify|notation sign|notation verify)' .github/workflows/ .gitlab-ci.yml k8s/ manifests/ 2>/dev/null
# Check for digest pinning in Dockerfiles/K8s manifests
grep -rnE 'image:.*@sha256:' Dockerfile* k8s/ manifests/ docker-compose*.yml 2>/dev/null
grep -rnE '^FROM\s+\S+@sha256:' Dockerfile* 2>/dev/null
# Check for vulnerability severity threshold in CI
grep -rnE '(--severity|--exit-code|--fail-on|severity-cutoff)' .github/workflows/ .gitlab-ci.yml 2>/dev/null
Phase 4: Secret Detection Deep Scan
Grep for these patterns across ALL files (not just infra):
# API Keys & Tokens
(AKIA[0-9A-Z]{16}) # AWS Access Key
(sk-[a-zA-Z0-9]{48}) # OpenAI API Key
(ghp_[a-zA-Z0-9]{36}) # GitHub Personal Token
(gho_[a-zA-Z0-9]{36}) # GitHub OAuth Token
(xoxb-[0-9]{11}-[0-9]{11}-[a-zA-Z0-9]{24}) # Slack Bot Token
(SG\.[a-zA-Z0-9]{22}\.[a-zA-Z0-9]{43}) # SendGrid API Key
# Generic patterns
(password|passwd|pwd)\s*[:=]\s*['\"][^'\"]+ # Passwords
(secret|token|key|api_key)\s*[:=]\s*['\"][^'\"]+ # Secrets
(BEGIN (RSA|DSA|EC|OPENSSH) PRIVATE KEY) # Private keys
For each match:
- Report the file and line number
- Show the variable NAME only, never the value
- Classify as: confirmed secret, likely secret, or false positive
- Check if the file is in .gitignore
Phase 5: Generate Report
Present findings in this format:
====================================================
INFRASTRUCTURE AUDIT REPORT
Generated: [date] | Scope: [all/docker/ci/k8s/env]
====================================================
SUMMARY
-------
Files scanned: 23
Issues found: 12
Critical: 2 (fix immediately)
High: 4 (fix before next deploy)
Medium: 4 (fix when possible)
Low: 2 (nice to have)
Security score: C (65/100)
CRITICAL ISSUES (fix immediately)
---------------------------------
[D001] Dockerfile:15 - Container runs as root
Impact: Container compromise gives root access to host
Fix: Add `USER nonroot` after creating the user
Effort: 5 minutes
[E002] src/config.js:42 - Hardcoded API key detected
Impact: Secret exposed in version control
Fix: Move to environment variable, rotate the key immediately
Effort: 15 minutes + key rotation
HIGH ISSUES (fix before next deploy)
-------------------------------------
[C004] docker-compose.yml:23 - No resource limits
Impact: Single container can consume all host resources (DoS risk)
Fix: Add deploy.resources.limits with CPU and memory
Effort: 10 minutes
MEDIUM ISSUES (fix when possible)
----------------------------------
[D006] Dockerfile - Not using multi-stage build
Impact: Production image contains build tools and source code
Fix: Use multi-stage build to separate build and runtime
Effort: 30 minutes
LOW ISSUES (nice to have)
--------------------------
[D009] Dockerfile - Missing LABEL metadata
Impact: Harder to track image origin and version
Fix: Add LABEL maintainer, version, description
Effort: 2 minutes
PASSED CHECKS
--------------
[E001] .env files properly gitignored
[CI004] Dependency scanning configured
[K008] Security context properly set
[D005] Health check defined
RECOMMENDATIONS
---------------
1. IMMEDIATE: Rotate the exposed API key in src/config.js
2. THIS WEEK: Add USER instruction to Dockerfile
3. THIS SPRINT: Set up automated dependency scanning in CI
4. BACKLOG: Implement network policies for Kubernetes
====================================================
Next: Run `/devops-infra-audit` again after fixes
====================================================
Phase 6: Offer Auto-Fix
After presenting the report, ask the user: "Would you like me to automatically fix any of these issues?"
For each fixable issue, categorize:
- Auto-fixable (safe to fix automatically): missing .dockerignore, missing labels, adding health checks, adding resource limits, pinning image versions
- Needs review (generate fix but user must approve): adding USER instruction, fixing CI permissions, removing secrets
- Manual only (provide instructions): rotating exposed secrets, setting up remote state, configuring network policies
Safety Rules
- This is READ-ONLY. Never modify files during an audit
- Never expose actual secret values in the report - just note their presence
- When checking for secrets, grep for patterns, don't try to validate them
- Be specific about line numbers and file paths
- Provide actionable fix suggestions for every issue
- Include effort estimates for each fix
- Prioritize findings by actual risk, not just rule severity
- If no issues found in a category, explicitly say "All checks passed"