Our take
Activeregular commits and releases- Activity
- 76
- Community
- 92
- Issues
- 48
- Pull requests
- 51
- Releases more often than 89% of the projects we track
- More contributors than 77% of the projects we track
- Slower to close issues than 90% of the projects we track
Checkov is an actively maintained, broad-coverage security scanner with a large policy set, though teams should validate its checks and findings against their own infrastructure and risk requirements.
Good fit if
- You need one CLI tool to scan several IaC formats, CI workflows, and container or package dependencies.
- You want built-in cloud security policies and results that can be integrated into CI through formats such as SARIF or JUnit XML.
- Your team can run Python-based tooling and wants a project with regular commits and releases, a broad contributor base, and recent issue and pull request activity.
Look elsewhere if
- You need a scanner limited to one platform or workflow and do not need Checkov's wider format and policy coverage.
- Your environment cannot support the Python runtime required by Checkov or its Docker-based option.
- Your required policy behavior cannot be met by its built-in or configurable checks, or you need findings to be handled without validation and tuning by your team.
All health signals
| Last commit | 2026-10-20 (4 days ago) |
|---|---|
| Commits, last 90 days | 64 |
| Releases, last 12 months | 60 (latest 3.3.30, 2026-10-20) |
| Contributors | 100+ (top contributor: 19% of commits) |
| Issues closed, last 90 days | 22 (typically closed in 206 days) |
| Pull requests merged, last 90 days | 25 (typically merged in 1 day) |
| Project age | 6 years |
Checked on 2026-10-25 with the GitHub API.
Overview
Checkov is a Python static-analysis tool from Bridgecrew, maintained by Prisma Cloud. It uses graph-based scanning to find security and compliance misconfigurations in infrastructure as code (IaC), and also scans container images and open-source packages for vulnerabilities.
It covers cloud and deployment formats including Terraform, CloudFormation, Kubernetes, Helm, Bicep, OpenTofu, Dockerfiles, and CI workflow files. Teams can run it in local development or CI to catch policy violations before infrastructure is deployed.
Key Features
- Provides more than 1,000 built-in security and compliance policies for AWS, Azure, and Google Cloud.
- Scans IaC and deployment definitions, including Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles, and OpenTofu.
- Analyzes CI workflows for platforms such as GitHub Actions, GitLab CI, and Azure Pipelines.
- Performs software composition analysis on open-source packages and container images to identify CVEs.
- Detects secrets and supports policy checks that account for relationships between resources through graph-based scanning.
- Allows teams to select or skip checks and suppress accepted risks inline with a reason.
- Exports results in formats including CLI, JSON, SARIF, JUnit XML, CSV, and CycloneDX.
Use Cases
- Platform and cloud security teams can check Terraform or CloudFormation changes against security policies before deployment.
- DevOps teams can add IaC and CI workflow scans to build pipelines to identify misconfigurations during development.
- Kubernetes teams can inspect manifests, Helm charts, and Kustomize files for policy violations before applying them.
- Application security teams can scan container images and package dependencies for known vulnerabilities.
What you need
Detected in the repository
- Python (from pyproject.toml)
- A Dockerfile, so it can run in a container
- A test suite and automated checks on GitHub Actions
License in plain words
Apache-2.0permissive
- Commercial use: yes
- Modify and redistribute: yes
- You must keep: the license, the NOTICE file and a note of your changes
- Share your changes: no
- Includes an explicit patent grant from the contributors:
A summary, not legal advice: the LICENSE file is what applies.
Getting Started
Install with pip and scan a directory:
pip3 install checkov
checkov --directory /path/to/iac/code
See the README and project documentation for other install options, scan formats, and configuration details.
Alternatives
- ScoutSuite: ScoutSuite audits live cloud accounts through provider APIs, while Checkov primarily scans infrastructure code and dependencies before deployment.
| Project | Language | License | Stars | Status |
|---|---|---|---|---|
| Checkov | Python | Apache-2.0 | 9.1k | Active |
| ScoutSuite | Python | GPL-2.0 | 7.9k | Inactive |
Considerations
- Checkov reports policy findings, but teams still need to determine whether a finding applies to their deployment and whether a suppression is justified.
- The README gives different Python support ranges: its requirements section lists Python 3.9 through 3.12, while its support section says Python 3.9 through 3.13. Confirm the supported version for your installation.
- Some features, such as severity-based check selection, require an API key. The README also notes that Checkov uses Prisma Cloud's API to add links to remediation guides, and that this call can be skipped.
- Checkov is licensed under Apache-2.0. Review the license terms when redistributing or incorporating it into a product.
Found this useful?
Share it with someone who would like Checkov.