Finding things
Infrastructure as code
The servers, buckets and clusters described in files, and the pipeline that builds everything else.
Configuration as code
trivy over Terraform, CloudFormation, Kubernetes manifests, Helm charts and Dockerfiles. A storage bucket left open in a file is open in production, and it is cheaper to find in the file.
The pipeline itself
GitHub Actions workflows are read for the things that make a pipeline a target: an action pinned to a mutable tag, a workflow that checks out and runs code from a pull request, a step with more permission than it needs. The pipeline holds the credentials for everything downstream and is the least examined thing in most estates.
What it does not do
Snyk IaC has more rules and better remediation text, and has cloud context this does not have at all.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.