# IaC security pre-scan report

Scanned 2 file(s).

Findings: 7 HIGH, 7 MEDIUM, 3 LOW, 3 INFO

- **HIGH** `K8S-SECRET-ENV` deploy.yaml:14 — env SESSION_SECRET carries a literal value — use a Secret/valueFrom
- **HIGH** `K8S-PRIV` deploy.yaml:20 — privileged: true — container = host root
- **HIGH** `SG-WORLD-ADMIN` main.tf:12 — world-open ingress (0.0.0.0/0) to sensitive port(s) 22 — restrict source CIDRs
- **HIGH** `DB-PUBLIC` main.tf:27 — datastore publicly_accessible = true
- **HIGH** `TF-SECRET` main.tf:29 — literal credential assigned to 'password' — move to tfvars outside VCS or a secret manager
- **HIGH** `S3-PUBLIC-ACL` main.tf:35 — bucket acl 'public-read' grants public access
- **HIGH** `TF-SECRET` main.tf:41 — literal credential assigned to 'DEPLOY_TOKEN' — move to a secret manager
- **MEDIUM** `K8S-HOST-NS` deploy.yaml:8 — shares host Network namespace
- **MEDIUM** `K8S-PRIV-ESC` deploy.yaml:21 — allowPrivilegeEscalation: true
- **MEDIUM** `K8S-HOSTPATH` deploy.yaml:24 — hostPath volume mounts host filesystem
- **MEDIUM** `K8S-RBAC-WILDCARD` deploy.yaml:32 — wildcard * in ClusterRole rule
- **MEDIUM** `K8S-RBAC-WILDCARD` deploy.yaml:33 — wildcard * in ClusterRole rule
- **MEDIUM** `K8S-RBAC-WILDCARD` deploy.yaml:34 — wildcard * in ClusterRole rule
- **MEDIUM** `ENC-OFF` main.tf:28 — encryption explicitly disabled
- **LOW** `K8S-LATEST` deploy.yaml:11 — mutable image ref 'registry.example.com/web:latest'
- **LOW** `SKIP-SNAPSHOT` main.tf:30 — DB deletion skips final snapshot
- **LOW** `PUB-IP` main.tf:39 — instance gets a public IP — confirm intended exposure
- **INFO** `K8S-NO-LIMITS` deploy.yaml:1 — workload Deployment has no resources.limits — unbounded CPU/memory
- **INFO** `BACKEND-ENC` main.tf:2 — tfstate backend 's3' without encrypt = true
- **INFO** `NO-DEL-PROT` main.tf:31 — deletion protection off

_Pre-scan, not an audit: variable resolution, module composition, and cloud state are out of scope; a clean report is not proof the infrastructure is safe._