{"name":"Checkov: Scan Infrastructure as Code for Security Risks","description":"Checkov is a Python static-analysis and software-composition-analysis tool from Bridgecrew, maintained by Prisma Cloud. Its graph-based scans find security and compliance misconfigurations in infrastructure code, and vulnerabilities in container images and open-source packages.","github":"https://github.com/bridgecrewio/checkov","url":"https://osrepos.com/repo/bridgecrewio-checkov","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/bridgecrewio-checkov","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/bridgecrewio-checkov.md","json":"https://osrepos.com/repo/bridgecrewio-checkov.json","topics":["python","security","cli","infrastructure-as-code","cloud-security","sca"],"keywords":["python","security","cli","infrastructure-as-code","cloud-security","sca"],"stars":null,"summary":"Checkov is a Python static-analysis and software-composition-analysis tool from Bridgecrew, maintained by Prisma Cloud. Its graph-based scans find security and compliance misconfigurations in infrastructure code, and vulnerabilities in container images and open-source packages.","content":"## Overview\n\nCheckov is a Python static-analysis tool from Bridgecrew, maintained by Prisma Cloud. It uses graph-based scanning to find security and compliance misconfigurations in infrastructure as code (IaC), and also scans container images and open-source packages for vulnerabilities.\n\nIt covers cloud and deployment formats including Terraform, CloudFormation, Kubernetes, Helm, Bicep, OpenTofu, Dockerfiles, and CI workflow files. Teams can run it in local development or CI to catch policy violations before infrastructure is deployed.\n\n## Key Features\n\n- Provides more than 1,000 built-in security and compliance policies for AWS, Azure, and Google Cloud.\n- Scans IaC and deployment definitions, including Terraform, CloudFormation, Kubernetes, Helm, Dockerfiles, and OpenTofu.\n- Analyzes CI workflows for platforms such as GitHub Actions, GitLab CI, and Azure Pipelines.\n- Performs software composition analysis on open-source packages and container images to identify CVEs.\n- Detects secrets and supports policy checks that account for relationships between resources through graph-based scanning.\n- Allows teams to select or skip checks and suppress accepted risks inline with a reason.\n- Exports results in formats including CLI, JSON, SARIF, JUnit XML, CSV, and CycloneDX.\n\n## Use Cases\n\n- Platform and cloud security teams can check Terraform or CloudFormation changes against security policies before deployment.\n- DevOps teams can add IaC and CI workflow scans to build pipelines to identify misconfigurations during development.\n- Kubernetes teams can inspect manifests, Helm charts, and Kustomize files for policy violations before applying them.\n- Application security teams can scan container images and package dependencies for known vulnerabilities.\n\n## Our Take\nCheckov is an actively maintained, broad-coverage security scanner with a large policy set, though teams should validate its checks and findings against their own infrastructure and risk requirements.\n\n**Good fit if:**\n- You need one CLI tool to scan several IaC formats, CI workflows, and container or package dependencies.\n- You want built-in cloud security policies and results that can be integrated into CI through formats such as SARIF or JUnit XML.\n- Your team can run Python-based tooling and wants a project with regular commits and releases, a broad contributor base, and recent issue and pull request activity.\n\n**Look elsewhere if:**\n- You need a scanner limited to one platform or workflow and do not need Checkov's wider format and policy coverage.\n- Your environment cannot support the Python runtime required by Checkov or its Docker-based option.\n- Your required policy behavior cannot be met by its built-in or configurable checks, or you need findings to be handled without validation and tuning by your team.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Active**: regular commits and releases |\n| Last commit | 2026-10-20 (4 days ago) |\n| Commits, last 90 days | 64 |\n| Releases, last 12 months | 60 (latest 3.3.30, 2026-10-20) |\n| Contributors | 100+ (top contributor: 19% of commits) |\n| Issues closed, last 90 days | 22 (typically closed in 206 days) |\n| Pull requests merged, last 90 days | 25 (typically merged in 1 day) |\n| Project age | 6 years |\n\nChecked on 2026-10-25 with the GitHub API.\n\n## Project Facts\n\n- Language: Python\n- License: Apache-2.0\n- Stars: 9.1k\n- Forks: 1.4k\n- Topics: aws, aws-security, azure, cloudformation, compliance, devops, gcp, hacktoberfest\n- Website: https://www.checkov.io/\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Python (from pyproject.toml)\n- A Dockerfile, so it can run in a container\n- A test suite and automated checks on GitHub Actions\n\n## Getting Started\nInstall with pip and scan a directory:\n\n```sh\npip3 install checkov\ncheckov --directory /path/to/iac/code\n```\n\nSee the [README](https://github.com/bridgecrewio/checkov#readme) and project documentation for other install options, scan formats, and configuration details.\n\n## License in Plain Words\n\n**Apache-2.0** (permissive).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the license, the NOTICE file and a note of your changes\n- Share your changes: no\n- Includes an explicit patent grant from the contributors\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Alternatives\n\n- [ScoutSuite](https://osrepos.com/repo/nccgroup-scoutsuite): ScoutSuite audits live cloud accounts through provider APIs, while Checkov primarily scans infrastructure code and dependencies before deployment.\n\n| Project | Language | License | Stars | Status |\n|---|---|---|---|---|\n| **checkov** | Python | Apache-2.0 | 9.1k | Active |\n| [ScoutSuite](https://osrepos.com/repo/nccgroup-scoutsuite) | Python | GPL-2.0 | 7.9k | Inactive |\n\n## Considerations\n\n- Checkov reports policy findings, but teams still need to determine whether a finding applies to their deployment and whether a suppression is justified.\n- The README gives different Python support ranges: its requirements section lists Python 3.9 through 3.12, while its support section says Python 3.9 through 3.13. Confirm the supported version for your installation.\n- Some features, such as severity-based check selection, require an API key. The README also notes that Checkov uses Prisma Cloud's API to add links to remediation guides, and that this call can be skipped.\n- Checkov is licensed under Apache-2.0. Review the license terms when redistributing or incorporating it into a product.","metrics":{"detailViews":1,"githubClicks":0},"dates":{"published":null,"modified":"2026-10-25T08:05:23.000Z"}}