# bridgecrewio/checkov

Prevent cloud misconfigurations and find vulnerabilities during build-time in infrastructure as code, container images and open source packages with Checkov by Bridgecrew.

Repository: https://github.com/bridgecrewio/checkov
Canonical: https://ross.abutalabs.com/products/checkov
Homepage: https://www.checkov.io/
Language: Python
License: Apache-2.0
License Family: permissive
Topics: terraform, static-analysis, aws, gcp, azure, aws-security, cloudformation, scans, compliance, kubernetes, infrastructure-as-code, devops, hacktoberfest
Last push: 2026-08-26T10:49:46+00:00

## Health v2 (maintenance only)
Score: 95/100 (v2, computed 2026-09-03T02:39:23.370411+00:00)
- activity 99, release rhythm 87, longevity 100
- inputs: {"age_days": 2471, "days_push": 7, "days_rel": 7, "gap_med": 2, "n_releases_24m": 190}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 8973, forks 1399 (observed 2026-08-28T04:10:26.561923+00:00)

## What it is
Checkov is a static code analysis tool for infrastructure as code (Terraform, CloudFormation, Kubernetes, Helm, Dockerfile, and more) that detects misconfigurations before deployment. It also performs software composition analysis (SCA) on container images and open source packages, with a Python/YAML policy-as-code framework for custom checks.

## Use cases
- scan terraform files for security misconfigurations
- find vulnerabilities in docker images and open source packages
- enforce compliance policies on kubernetes manifests
- run iac security checks in ci/cd pipeline
- write custom policy-as-code checks for cloud resources
- scan cloudformation and helm charts before deployment
- prevent cloud misconfigurations at build time

## When to choose
- you need build-time scanning of IaC across many frameworks (Terraform, CloudFormation, Kubernetes, Helm, Bicep, ARM)
- you want hundreds of built-in compliance and security checks plus custom Python/YAML policies
- you need CI/CD integrations with GitHub Actions, GitLab, Jenkins, or Bitbucket
- you want a single CLI covering both IaC misconfiguration and SCA scanning

## When to avoid
- you need runtime cloud posture management or live infrastructure scanning rather than static analysis
- you only use a niche IaC tool not among the supported frameworks
- you need dynamic application security testing or source code vulnerability analysis beyond IaC and dependencies

## Facets
- artifact type: cli-tool
- maturity: stable
- function: security, vulnerability-scanning, static-site-generator, cli, infrastructure-as-code, developer-tools
- domain: security, infrastructure-as-code, cloud-computing, developer-tools
- platform: python, cli, windows, cloud
- tags: iac-scanning, policy-as-code, sca, terraform, kubernetes, cloudformation, compliance, misconfiguration-detection, container-images, cicd-integration, devops, containers, docker, linux, macos

## Member repositories
- bridgecrewio/checkov (main) score 95

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:10:26.561923+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:24:25.858178+00:00, confidence not recorded.
  - readme: https://github.com/bridgecrewio/checkov (fetched 2026-08-28T04:10:26.561923+00:00, sha 6cd0bac9be13)
  - homepage: https://www.checkov.io/ (fetched 2026-08-29T08:24:34.186615+00:00, sha ebbba9d0b04d)
  - site_page: https://www.checkov.io/1.Welcome/Quick%20Start.html (fetched 2026-08-29T08:24:34.195498+00:00, sha f54b407aede0)
  - site_page: https://www.checkov.io/1.Welcome/Feature%20Descriptions.html (fetched 2026-08-29T08:24:34.197496+00:00, sha 9452e6d79a65)
- Data as of 2026-08-30T08:39:29.467469+00:00.