# aquasecurity/tfsec

Tfsec is now part of Trivy

Repository: https://github.com/aquasecurity/tfsec
Canonical: https://ross.abutalabs.com/products/tfsec
Homepage: https://aquasecurity.github.io/trivy/
Language: Go
License: MIT
License Family: permissive
Topics: terraform, security, scanner, static-analysis, ci, aws, azure, google-cloud-platform, compliance, infrastructure-as-code, devsecops, vulnerability-scanners, misconfiguration, digitalocean, devops, linter, go, terraform-security, hacktoberfest
Last push: 2026-03-25T08:06:52+00:00

## Health v2 (maintenance only)
Score: 59/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 74, release rhythm 16, longevity 100
- inputs: {"age_days": 2739, "days_push": 161, "days_rel": 488, "gap_med": 91, "n_releases_24m": 4}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 7035, forks 559 (observed 2026-08-28T04:09:55.149546+00:00)

## What it is
tfsec is a static analysis security scanner for Terraform code that detects misconfigurations across major cloud providers using hundreds of built-in rules. It has been merged into Trivy, which now provides the same Terraform scanning engine alongside broader vulnerability and secret scanning.

## Use cases
- scan terraform code for security misconfigurations
- check aws security groups in terraform before deploy
- run terraform security checks in ci pipeline
- find unencrypted s3 buckets in infrastructure code
- audit terraform modules for compliance issues
- enforce rego policies on terraform configs

## When to choose
- you need a dedicated terraform-only static analysis tool
- you want lightweight terraform misconfiguration checks without broader scanning features
- you maintain an existing tfsec-based pipeline

## When to avoid
- you are starting a new project - use Trivy instead, which natively supports Terraform scanning
- you need vulnerability, secret, or container scanning alongside IaC checks
- you expect active new feature development, since engineering effort has moved to Trivy

## Facets
- artifact type: cli-tool
- maturity: maintenance
- function: vulnerability-scanning, static-site-generator, linter, ci-cd, security
- domain: security, infrastructure-as-code, cloud-computing
- platform: windows, cli, editor-plugin
- tags: terraform, iac-scanning, misconfiguration-detection, devsecops, trivy-migration, static-analysis, devops, linux, macos, docker

## Member repositories
- aquasecurity/tfsec (main) score 59

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:09:55.149546+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:40:33.666685+00:00, confidence not recorded.
  - readme: https://github.com/aquasecurity/tfsec (fetched 2026-08-28T04:09:55.149546+00:00, sha 4e4b84fb133b)
  - homepage: https://aquasecurity.github.io/trivy/ (fetched 2026-08-29T08:36:20.565540+00:00, sha 151f61ef246b)
  - site_page: http://trivy.dev/docs/latest/getting-started (fetched 2026-08-29T08:36:20.568801+00:00, sha 95b2d593af86)
  - site_page: http://trivy.dev/docs (fetched 2026-08-29T08:36:20.570742+00:00, sha dc61c6342432)
- Data as of 2026-08-30T08:39:29.467469+00:00.