# controlplaneio/kubesec

Security risk analysis for Kubernetes resources

Repository: https://github.com/controlplaneio/kubesec
Canonical: https://ross.abutalabs.com/products/kubesec
Homepage: https://kubesec.io
Language: Go
License: Apache-2.0
License Family: permissive
Topics: hacktoberfest, kubernetes, security, static-analysis, sast
Last push: 2026-07-10T17:08:21+00:00

## Health v2 (maintenance only)
Score: 64/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 91, release rhythm 8, longevity 100
- inputs: {"age_days": 3249, "days_push": 54, "days_rel": 649, "gap_med": null, "n_releases_24m": 1}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1477, forks 108 (observed 2026-08-28T04:04:50.467805+00:00)

## What it is
Kubesec is a static analysis tool that performs security risk analysis on Kubernetes resource manifests, assigning a security score and detailed findings. It is available as a CLI, Docker image, HTTP server, kubectl plugin, and admission controller.

## Use cases
- scan kubernetes yaml manifests for security misconfigurations
- score pod security context before deploying to cluster
- enforce security policies with a kubernetes admission webhook
- integrate kubernetes security scanning into CI pipeline
- check if containers run with read-only root filesystem

## When to choose
- you want fast static analysis of Kubernetes YAML without a running cluster
- you need a simple security score for manifests in CI/CD
- you want to block insecure resources via an admission controller

## When to avoid
- you need runtime security monitoring of live clusters
- you need full policy-as-code frameworks like OPA/Gatekeeper with custom policies
- you scan container images rather than Kubernetes manifests

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, vulnerability-scanning, static-site-generator
- domain: security
- platform: windows, cli, go
- tags: kubernetes, sast, static-analysis, kubernetes-manifests, admission-controller, security-scoring, devops, containers, linux, macos, docker

## Member repositories
- controlplaneio/kubesec (main) score 64

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:50.467805+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:34:23.588627+00:00, confidence not recorded.
  - readme: https://github.com/controlplaneio/kubesec (fetched 2026-08-28T04:04:50.467805+00:00, sha a0844b7211ee)
  - homepage: https://kubesec.io (fetched 2026-08-29T11:41:25.801312+00:00, sha 7d414bdbf141)
- Data as of 2026-08-30T08:39:29.467469+00:00.