Notes from building a Terraform security scanner
Security and engineering notes from the people building audytx.
CloudFormation support is live on the audytx MCP server
The engine now scans CloudFormation — JSON, YAML with short tags, SAM, CDK-synthesized output — through a new scan_cloudformation tool. Same AWS_* rule ids as Terraform, same context suppression, identical response shape. What shipped, what's not in yet, and how to try it in one tool call.
Read →Checkov vs Trivy in 2026: a field guide for Terraform teams
Checkov brings the widest policy catalog; Trivy folds everything into one binary. Measured false-positive and IAM-coverage numbers from a public corpus, a clear recommendation for each scope — and the layer neither of them has.
Read →The IAM privilege escalation hidden behind a stale date
BishopFox's iam-vulnerable ships a matched pair, fn3 and fp5, that differ by a single IAM condition operator. Trivy false-positives one; Checkov reads neither. Here's how audytx evaluates the condition semantically and gets both right.
Read →Why the TeamPCP supply-chain attack couldn't touch audytx
TeamPCP (CVE-2026-33634) turned trusted GitHub Actions, including Trivy and Checkmarx KICS, into credential stealers inside thousands of CI pipelines. audytx runs as a webhook, not a CI action — the whole attack class can't reach it. Here's why.
Read →Start free during the open beta
Install audytx on GitHub, or point your coding agent at the MCP server — your next pull request is the demo.