Infrastructure as Code

Your Terraform, Kubernetes, and CloudFormation — checked before they ship.

A misconfiguration written once in code provisions everywhere it runs. BreachLens catches it — and any hardcoded secret — in the pull request, before it reaches a cloud account, then drafts the fix as a PR you review.

Book a technical demo Read the docs

Terraform · K8s · CloudFormationCaught in the pull requestRuns on your infrastructure

Fix the source, not every copy

A misconfig in code becomes a misconfig everywhere.

One open security group or public bucket in a module ships to every environment that uses it. BreachLens scans the code that provisions your cloud — naming the exact resource and the rule it breaks — so you fix it once, at the source, before it's ever deployed.

Scan

Every IaC format, one pass

Terraform, Kubernetes, CloudFormation, Helm, ARM, and Dockerfiles are auto-detected — misconfigurations and hardcoded secrets flagged together, no per-format setup.

Catch

In the pull request

Scans run in your pipeline on the changed files, so findings land inline on the PR before merge — not in an incident review three weeks later.

Fix

Drafted as a pull request

For the findings that matter, AI drafts the patch and opens a PR or MR against the repo. A human reviews and merges — nothing changes without approval.

What you get

IaC findings a team can fix — at the source, before deploy.

Every IaC format

One scanner, auto-detected.

· Terraform, Kubernetes, CloudFormation, Helm, ARM, and Dockerfiles.
· Hundreds of built-in checks, no configuration to write.
· New formats in a repo are picked up without wiring anything.

The exact resource, and the rule

Not a vague category.

· The specific resource that fails and the rule it breaks.
· The offending block of code, with file and line.
· Enough to fix it in place, without a scavenger hunt.

Secrets, before they're committed

Same pass, no extra tool.

· A hardcoded key or token in a variables file or manifest, caught.
· Scanned alongside the misconfigurations, in one run.
· Surfaced on the PR before it lands in history.

Caught before deploy

In the pipeline, on the PR.

· Runs in GitHub Actions, GitLab CI, Jenkins — any runner.
· Incremental on changed files, so PR scans stay fast.
· Fail the build on what matters; warn on the long tail.

From misconfig to attack path

The code, meet the cloud it builds.

· An IaC finding correlates with the cloud resource or container it provisions.
· A public bucket in Terraform shows up next to the app that reads it.
· Posture you can prioritise, not just a linter's opinion.

Fixed in a pull request

AI drafts, a human merges.

· AI drafts the patch and opens a PR/MR against the right repo.
· Bring your own model — Anthropic, OpenAI, Gemini, or fully local.
· Nothing auto-merges; a human is always in the approval seat.

breachlens · fix

A BreachLens finding with an AI-drafted fix — the misconfiguration on the left, the proposed patch on the right, ready to open as a pull request for review.

A misconfiguration and its AI-drafted patch — opened as a pull request you review, never auto-merged.

Straight answers

What a platform team asks about IaC scanning.

Which IaC formats do you scan?

Terraform, Kubernetes manifests, CloudFormation, Helm charts, ARM templates, and Dockerfiles — auto-detected, with no per-format configuration to maintain.

Does it catch hardcoded secrets too?

Yes. Secret scanning runs in the same code-tier pass, so a key or token committed into a variables file or manifest is flagged right next to the misconfigurations — before it lands in your git history.

When does the scan run — before or after deploy?

Before. The scan runs in your pipeline on the changed files, so findings land on the pull request ahead of merge. You catch the misconfiguration in code, not after it has provisioned a live resource.

How is this more than a linter?

An IaC finding doesn't sit alone — it correlates with the cloud resource or container it provisions, so a risky module surfaces as part of an attack path. And for the findings that matter, AI drafts the fix and opens a PR you review, with your own model.

Where does it run?

On your infrastructure. Your IaC, the findings, and the fixes stay inside your deployment — it can run fully air-gapped.