Checkov Brings Free SAST Scanning to Terraform and Other IaC Formats

·1 views

Static Application Security Testing (SAST) can be applied to Infrastructure as Code (IaC) files like Terraform, Pulumi, and CloudFormation, which are just as prone to misconfiguration as application code. Checkov, a free open-source scanner developed by Bridgecrew and now maintained under Palo Alto Networks, can detect issues such as public S3 buckets, open SSH ports, hardcoded credentials, and overly permissive IAM policies before deployment. The tool supports a wide range of IaC formats including Kubernetes, Helm, Dockerfile, and ARM templates, and requires no account or API key to run locally or in CI pipelines. Checkov can be integrated into GitHub Actions workflows to automatically block pull request merges when critical misconfigurations are detected. It also supports custom policies written in Python or YAML, making it adaptable to organisation-specific security requirements.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Regex Outperforms LLM Routers for AI Agent Context Gating, Study Finds

A July 2026 paper titled 'ContextSniper' introduced a token-efficient context management system for AI coding agents that filters irrelevant code before it reaches the model, cutting token usage by up to 51.5% on some agents. The system uses an intention-aware gate to decide the cheapest retrieval strategy for any given request, such as symbol lookup, semantic search, or graph traversal. Researchers testing how complex this gate needs to be compared three lightweight routing methods across 140 hand-labeled requests spanning seven intent categories. A simple 40-line regex heuristic achieved 94.3% accuracy and a macro-F1 of 0.945, outperforming TF-IDF centroid classification by roughly 45 points. The findings suggest that for agent context routing, a dedicated LLM call is unnecessary and a well-crafted regex can match or exceed heavier classifiers at a fraction of the cost.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

A Practical Folder Structure Guide for Large Next.js App Router Projects

A developer has shared a folder architecture guide for large Next.js projects using the App Router, based on lessons learned from reorganising a client dashboard. The structure separates routes into the app/ directory, domain-specific business logic into a features/ folder, and reusable UI primitives into components/ui. A key principle called the '10-second findability rule' requires that any piece of code — such as a password reset email handler — can be located within ten seconds, or the structure is considered flawed. Common early mistakes highlighted include dumping 80-plus components into a single folder, growing utility files to over a thousand lines, and scattering Server Actions across random page files instead of colocating them in a dedicated actions.ts. The guide also recommends route groups for separating marketing and dashboard shells, TypeScript strict mode, and an ESLint-enforced import direction policy for teams larger than three developers.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Why Running Code Matters More Than Reviewing It: A Testing Lesson

A developer discovered a critical gap between code review verdicts and actual test evidence while working on a notification queue ordering change. Although a review had returned a 'pass-with-risk' result with a named reason, the requirement had never actually been executed, leaving the risk labelled but unverified. When the code was finally run, a real timing failure emerged that review alone could not have detected — the scheduler incorrectly prioritised one notification over another under a specific condition. The experience highlighted that a skipped test row looks identical to a passing one in a results matrix, making unverified requirements invisible unless checks are explicitly enforced. The developer concluded that test matrices should preserve records of both failures and fixes, since deleting resolved failures erases the only proof that a check was ever run.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

The 'Placebo Bug': How Developers Intentionally Plant Flaws to Survive Toxic Reviews

Some experienced developers deliberately introduce minor, harmless errors into their code — such as a typo or misaligned button — so that overly critical seniors have an obvious flaw to flag, leaving the core architecture untouched. The practice, informally called the 'Placebo Bug,' mirrors a decades-old game design trick known as the 'Corporate Duck,' where a designer planted a ridiculous visual element to absorb a manager's compulsive need to request changes. While the hack can protect sound engineering work from unnecessary refactoring, it signals a deeper problem: a workplace culture driven by hierarchy and fault-finding rather than genuine mentorship. Under such pressure, junior developers increasingly turn to AI tools for quick fixes without fully understanding the generated code, which can introduce security vulnerabilities that surface only in production. The article argues that when senior developers prioritise asserting authority over nurturing talent, the long-term cost is fragile, insecure systems and stunted engineering growth.

0 comments Read more at DEV Community