Terraform
500+ Trivy checks across AWS, GCP, Azure, and Kubernetes resources defined in HCL.
Terraform & Kubernetes scanner
before they reach production.
Upload Terraform, Kubernetes manifests, Istio CRDs, Docker Compose, CloudFormation, or Helm charts and receive an instant security assessment. misconfigs runs targeted static analysis across your infrastructure-as-code, flags intent vs. reality gaps where names or tags claim a secure posture but settings allow risky behavior, and delivers a PDF report with severity scoring and remediation guidance.
6
IaC formats
AWS · K8s · Compose
Coverage
PDF
Instant report
What we scan
Kubernetes Manifests
Privileged containers, HostPath mounts, missing resource limits, root containers, and cluster-admin bindings.
Docker Compose
Host filesystem mounts, privileged mode, exposed admin ports, and hardcoded secrets.
CloudFormation
AWS-specific misconfigurations — open security groups, public RDS, IAM/trust policy risks, and over-privileged roles.
Helm Charts
Insecure defaults in values, privileged pods in templates, and secret exposure.
Istio CRDs
Disabled or permissive mTLS, allow-all AuthorizationPolicies, wildcard hosts, and insecure gateways.
Intent vs. reality
Flags resources named internal-only or tagged production that still allow 0.0.0.0/0, privileged pods, or wildcard IAM.
Security report
Download a detailed PDF with findings grouped by scanner, severity ratings, and remediation steps.
API quickstart
Scan via REST with your API key — same engines as the upload form.
Example request
curl -X POST "http://api.misconfigs.com/api/v1/iac?format=sarif&fail_on=critical,high" \ -H "X-API-Key: mc_your_key" \ -F "file=@sample/iac/k8s-bad.yaml"
Run a security scan
Upload IaC files or a zip archive to generate your assessment report
Try demo
See it in action
Download a demo archive, upload it below, and review intent gaps plus suggested fixes instantly.
Click a demo — we download the zip for you, then run the scan automatically. Keep this tab open; results appear below (usually 1–2 minutes).
One free demo per day — no account. Sign in free for more demos and your own uploads.
Drag & drop your infrastructure files here
Terraform · Kubernetes · Istio · Compose · CloudFormation · Helm · .zip · max 10 MB
Automated scans only — not a penetration test, compliance audit, or professional security advice. Results may contain false positives or miss issues. You are responsible for validating findings before acting. Terms · Privacy
The optional scan assistant and Explain actions use Google Gemini (a third-party AI). Responses are generated automatically and may be inaccurate or incomplete — not security, legal, or professional advice. Chat sends finding details, scan summaries, and your messages to Google for processing. Do not include secrets you cannot afford to disclose. Official Terms (AI section) and Privacy Policy (AI section) are the source of truth, not assistant replies.