Notes from building a Terraform security scanner
Security and engineering notes from the people building audytx.
CloudFormation support is live on the audytx MCP server
The engine now scans CloudFormation — JSON, YAML with short tags, SAM, CDK-synthesized output — through a new scan_cloudformation tool. Same AWS_* rule ids as Terraform, same context suppression, identical response shape. What shipped, how it reads the template language, and how to try it in one tool call.
Read →Checkov vs Trivy in 2026: a field guide for Terraform teams
Checkov brings a wide policy catalog across clouds; Trivy puts images, dependencies and IaC into one scanner. A recommendation for each scope, and where audytx fits beside either.
Read →The IAM privilege escalation hidden behind a stale date
Bishop Fox's iam-vulnerable ships a matched pair, fn3 and fp5, that differ by a single IAM condition operator. A check that only asks whether a condition exists cannot tell them apart. audytx reads the operator and gets both right.
Read →Start free
Install audytx on GitHub, or point your coding agent at the MCP server — your next pull request is the demo.