{"name":"kics: Scan Infrastructure as Code for Security Issues","description":"KICS by Checkmarx scans infrastructure as code for security vulnerabilities, compliance issues, and misconfigurations, using Open Policy Agent queries. It supports a broad range of formats, including Terraform, Kubernetes, Docker, and CloudFormation, for teams looking to catch configuration risks early.","github":"https://github.com/Checkmarx/kics","url":"https://osrepos.com/repo/checkmarx-kics","source":"osrepos.com","sourceDescription":"This repository profile is provided by osrepos.com, an open source repository discovery platform.","repositoryProfile":"https://osrepos.com/repo/checkmarx-kics","generatedFor":"open source discovery and AI-assisted research","markdown":"https://osrepos.com/repo/checkmarx-kics.md","json":"https://osrepos.com/repo/checkmarx-kics.json","topics":["go","security","cli","cloud-native","infrastructure-as-code","iac-scanning","configuration-analysis"],"keywords":["go","security","cli","cloud-native","infrastructure-as-code","iac-scanning","configuration-analysis"],"stars":null,"summary":"KICS by Checkmarx scans infrastructure as code for security vulnerabilities, compliance issues, and misconfigurations, using Open Policy Agent queries. It supports a broad range of formats, including Terraform, Kubernetes, Docker, and CloudFormation, for teams looking to catch configuration risks early.","content":"## Overview\n\nKICS (Keeping Infrastructure as Code Secure) is Checkmarx's open-source scanner for finding security vulnerabilities, compliance issues, and misconfigurations in infrastructure as code. It uses Open Policy Agent queries as its rule foundation, which teams can customize or extend to suit their checks.\n\nIt is aimed at cloud-native and DevSecOps teams that want to find configuration problems during development or in CI/CD, rather than after deployment. Supported formats include Terraform, Kubernetes, Docker, CloudFormation, Ansible, Helm, OpenAPI, and others listed in the project documentation.\n\n## Key Features\n\n- Scans infrastructure definitions for security vulnerabilities, compliance issues, and misconfigurations.\n- Provides customizable queries that teams can edit, extend, or add.\n- Supports a broad set of infrastructure formats, including Terraform, OpenTofu, Kubernetes, Docker, CloudFormation, and Pulumi.\n- Produces results intended to help developers identify and fix detected issues.\n- Offers integrations for CI/CD workflows.\n- Provides Docker and Docker Compose support.\n\n## Use Cases\n\n- A platform team can scan Terraform or OpenTofu changes before cloud resources are provisioned.\n- A DevSecOps team can add IaC checks to CI/CD and surface findings during code review.\n- A Kubernetes team can check manifests and Helm-related infrastructure for risky configurations.\n- A security team can adapt queries to enforce internal compliance expectations across supported formats.\n\n## Our Take\n\nKICS is an actively maintained, broadly compatible IaC scanner with an extensible Open Policy Agent query model, though teams should account for its Go and container requirements and evaluate how its findings fit their existing workflow.\n\n**Good fit if:**\n- You need to scan several IaC formats, not just Terraform.\n- Your team wants to customize or add security and compliance queries.\n- You can run Go-based tooling or use Docker in development and CI.\n\n**Look elsewhere if:**\n- Your required IaC format is not among the project's supported platforms.\n- You need an alternative that does not use Open Policy Agent queries.\n- You cannot accommodate the Go runtime or Docker-based setup.\n\n## Project Health\n\n| Signal | Value |\n|---|---|\n| Status | **Active**: regular commits and releases |\n| Last commit | 2026-11-09 (today) |\n| Commits, last 90 days | 50 |\n| Releases, last 12 months | 8 (latest v2.2.1, 2026-11-09) |\n| Contributors | 100+ (top contributor: 10% of commits) |\n| Issues closed, last 90 days | 4 (typically closed in 13 days) |\n| Pull requests merged, last 90 days | 50 (typically merged in 1 day) |\n| Project age | 6 years |\n\nChecked on 2026-11-10 with the GitHub API.\n\n## Project Facts\n\n- Language: Open Policy Agent\n- License: Apache-2.0\n- Stars: 2.7k\n- Forks: 385\n- Topics: appsec, cloudnative, devsecops, golang, hacktoberfest, iac, infrastructure-as-code, open-policy-agent\n- Website: https://kics.io\n- Archived: no\n\n## What You Need\n\nDetected in the repository:\n\n- Go 1.26.8 or newer (from go.mod)\n- A Dockerfile, so it can run in a container; a Compose file sets up the related services\n- A test suite and automated checks on GitHub Actions\n\n## Getting Started\n\nSee the [getting-started guide](https://github.com/Checkmarx/kics/blob/master/docs/getting-started.md) for installation and the first scan. The [KICS documentation](https://docs.kics.io/) covers configuration, results, queries, and integrations.\n\n## License in Plain Words\n\n**Apache-2.0** (permissive).\n\n- Commercial use: yes\n- Modify and redistribute: yes\n- You must keep: the license, the NOTICE file and a note of your changes\n- Share your changes: no\n- Includes an explicit patent grant from the contributors\n\nA summary, not legal advice: the LICENSE file is what applies.\n\n## Alternatives\n\n- [Checkov](https://osrepos.com/repo/bridgecrewio-checkov): Checkov also scans IaC for security and compliance issues, using Python and graph-based analysis, and additionally covers container images and open-source package vulnerabilities.\n\n| Project | Language | License | Stars | Status |\n|---|---|---|---|---|\n| **kics** | Open Policy Agent | Apache-2.0 | 2.7k | Active |\n| [Checkov](https://osrepos.com/repo/bridgecrewio-checkov) | Python | Apache-2.0 | 9.1k | Active |\n\n## Considerations\n\nThe project is active, with regular commits and releases, and contributions are not concentrated in one person. Recent issue closure activity is relatively light compared with its ongoing pull request and release activity, so teams should check the issue tracker for the status of concerns relevant to their use. KICS requires Go, and Docker and Docker Compose are supported options; confirm that your build or CI environment can accommodate the runtime and execution method. The repository uses the Apache-2.0 license, so review its terms as part of adoption.","metrics":{"detailViews":0,"githubClicks":0},"dates":{"published":null,"modified":"2026-11-10T14:46:26.000Z"}}