How CloudGuard works
CloudGuard checks Terraform, CloudFormation, Kubernetes, Helm charts, Compose and Dockerfiles for security mistakes before they're deployed. A proven static analyzer finds the problems; a language model explains them in terms of your code and writes the fix.
What happens when you scan
-
Checkov runs the policies
Paste one file, upload a zip, or link a public GitHub repository or folder. Configuration files are picked out and everything else is ignored. Checkov, an open-source analyzer with over a thousand policies, reports each resource that fails a policy, with the file and lines involved. The same files always give the same findings.
-
The findings get explained
The files and Checkov's findings go to a language model: gpt-oss-120b on Groq for free explained scans, or the model you pick with your own API key. For each finding it says what's actually at risk in your code and which setting to change. It also points out problems no policy covers, such as passwords in a Compose file. Those are listed separately and don't affect the score.
-
Earlier fixes are checked
Findings become embeddings through a small open model (bge-small) running on this server and are compared with your own earlier scans in PostgreSQL with pgvector. The closest matches, and the patches written for them, are given to the model as examples so fixes stay consistent. Only your scans are searched.
-
A patch is written
The model rewrites each file with its findings addressed and marks changed lines with a
# FIXED:comment. The report shows the patch as a diff next to the annotated original. For projects, the files with the most serious findings are patched first. -
The scan is saved
It goes into your history, and a copy of the original and patched files goes to a private S3 bucket.
Free explained scans and your own key
Checkov scans are always free and unlimited. Explanations, extra review findings and patches use a language model, so each visitor gets a few explained scans a day on this site's Groq account. The free model also has a small per-minute allowance shared by everyone; when it's busy, or used up for the day, scans still show every Checkov finding and the report says when to try again.
You can also bring your own API key from OpenAI, Anthropic, Google, xAI, Groq or Mistral in . CloudGuard lists the models your key can use and suggests one. Scans with your key have no daily limit, cover larger projects, and are billed to your account by the provider.
How the score works
Only Checkov findings count, so the score is the same every time you scan the same files. CloudGuard rates each policy itself, because the open-source release doesn't include severities: public access and secrets are critical, missing encryption is high, logging and backups are medium, tags and monitoring are low. Each finding adds points:
| Severity | Points |
|---|---|
| Critical | 30 |
| High | 12 |
| Medium | 4 |
| Low | 1 |
The score is 100 × e−points / 80. The first serious problems cost the most, and a long list of minor warnings can't drag an otherwise sound file to zero: one critical finding gives 69, one high gives 86, ten low ones give 88. File types Checkov doesn't support, such as Compose, aren't scored.
Diagram check
The model you chose in Model settings reads the image and the Terraform together, so it needs to accept images. It reports resources that appear in one but not the other, subnets placed differently, and connections the security groups or route tables don't allow. It doesn't try to read IAM permissions or port numbers from a picture. The Terraform also goes through a normal scan. Diagram checks always use your own key.
Your data
- There are no accounts. Your browser gets a random ID in a cookie the first time you visit, and every scan you run is filed under it. Nobody else can list, open or search your scans, and they're never used as examples for anyone else.
- History belongs to that cookie, so it won't follow you to another device, and clearing cookies loses it.
- Clear history deletes your scans and findings from the database. The file copies in S3 aren't linked to your browser and aren't shown to anyone.
- Checkov and the embedding model run on this server. For explained scans the files also go to the model provider: Groq on the free tier, or whichever provider your key belongs to. Swap real passwords and keys for placeholders before scanning.
- Your own API key stays in this browser (or only for the session if you untick "Remember on this device") and is sent with each scan over HTTPS. The server passes it to the provider for that request and never stores or logs it.
- Repositories are downloaded from GitHub for the scan and not kept, apart from the files saved with your scan. The free-scan counter stores a keyed hash of your IP address, not the address.
Limits
- Checkov only knows the policies it ships with. Passing all of them doesn't make a file secure.
- Explanations and review findings come from a language model. They can be wrong or incomplete, which is why they never change the score.
- Read a patch before applying it and run
terraform plan. A rewrite can change more than the lines it marks. - Helm charts need to be uploaded as a zip or linked from GitHub, since a single template can't be rendered on its own. Chart dependencies aren't downloaded, so only subcharts included in the upload are checked.
- Pasted files can be up to 120,000 characters, zips up to 10 MB, repositories up to 25 MB compressed with at most 400 configuration files, and diagrams up to 8 MB. Scans are rate limited per IP address.
In your pull requests
The same scan runs as a GitHub Action and a command-line tool. The action runs in your own CI with your own secrets, comments on each pull request with findings in the files it changes, and can fail the check at a severity you choose. Setup is in the repository README. Everything on this site also goes through a JSON API, documented at /docs.