Misconfigs caught before they ship.

Our rule packs run on every push. AI triage drops the noise, the autofix lands in your PR.

high · blocked before applyPublic ACL on aws_s3_bucket.dataiac/aws/s3-public-acl · CKV_AWS_20

main.tfplan3 findings0 findings

resource "aws_s3_bucket" "data" {  bucket = "customer-pii"  acl = "public-read"  acl = "private"  versioning {    enabled = false    enabled = true  }}resource "aws_s3_bucket_public_access_block" "data" {  bucket                  = aws_s3_bucket.data.id  block_public_acls       = true  restrict_public_buckets = true}

Traffic flows through the ALB to the API and the database. The plan is being read.aws_s3_bucket.data is public: anyone on the internet can read customer-pii, around the VPC.Verdict: high. The apply is blocked, the finding carries the rule and the three lines.The fix lands in main.tf: private ACL, versioning on, a public access block on the bucket.Plan clean, 0 findings. The bucket is private before anything is applied.

Your files, read on every push.

Terraform, CloudFormation, Kubernetes, Pulumi, Ansible, CDKTF. With AI triage on top.

Terraformmain.tf

aws_s3_bucket.dataacl+ "private"

CloudFormationtemplate.yaml

AWS::RDS::DBInstancePubliclyAccessible+ false

Kubernetesdeployment.yaml

kind: DeploymentrunAsNonRoot+ true

Helmvalues.yaml

service.type: LoadBalancerservice.type+ ClusterIP

Ansiblesite.yml

ufw: port 22ssh_allowed_cidr+ 10.0.0.0/8

CIS Benchmarks (AWS, Azure, GCP, Kubernetes), NIST 800-53 and 800-171, AWS Well-Architected.

Cloud security without the alert pile.

Our AI reads every alert before your team does.

What a scanner hands you

acme/platform-infra

highIAM policy allows Action "*"prod/iam.tf:12
lowS3 bucket has no tags~~S3 bucket has no tags~~template.yaml:9
mediumPort 5432 open to 0.0.0.0/0rds.tf:21
highIAM policy allows Action "*"staging/iam.tf:12
mediumDeployment has no securityContextdeployment.yaml:18
lowIngress has no TLS~~Ingress has no TLS~~values-test.yaml:7
highIAM policy allows Action "*"dev/iam.tf:12

What your team gets

highThe orders database is open to the internetrds.tf:21 · aws_db_instance.ordersraised from medium
highThe deploy role can do anything in AWSprod, staging, dev · iam.tf:123 alerts, grouped into one
mediumThe API container may run as rootdeployment.yaml:18 · Deployment/api

Dropped as noise: a bucket without tags, an ingress used only for tests.

Sent to

Jira

GitHub Issues

GitLab Issues

Slack

Drops the noise
Groups the duplicates
Raises what is really exposed

Connect the repo, the rest is automatic.

Browse all integrations

Every push, or on demand

acme/platform-infra

$ git push origin feat/orders-db

rds: open orders db to the peering vpc

Scanned in our pods

terraformread
kubernetesread
helmread

1 high · aws_db_instance.orders

The verdict flows back

dashboardhigh
MCPMCP serververdict served
CIGitHub Actions · GitLab CIgate · blocked

Findings appear in the unified dashboard, alongside SAST, SCA, Secrets, CI/CD and Container.

How it works,
in detail.

The documentation walks you through setup, configuration and every option.

Read the docs

Code Scanning / Scanning Options

Code Repository Scanning

Checkov, KICS and Trivy under the CybeDefend Engine, from Terraform and CloudFormation to Helm and Kubernetes.

2. Infrastructure as Code (IAC) Security

Frequently asked about CybeDefend IaC.

Which IaC frameworks and clouds do you cover?

Terraform (HCL and JSON), CloudFormation, AWS CDK, Pulumi (TypeScript, Python, Go, .NET), CDKTF, Kubernetes manifests, Helm charts, Kustomize, Ansible playbooks. Cloud-aware rule packs for AWS, GCP, Azure, DigitalOcean, Hetzner, Scaleway and OVH.

How is the scan triggered?

Connect GitHub or GitLab once. From there, every push triggers a scan in our pods, and you can also run on-demand scans from the dashboard or the CLI. Findings flow into the unified dashboard alongside SAST, SCA, Secrets, CI/CD and Container findings.

What does the autofix look like?

Cybe AutoFix proposes a patch tailored to the framework: a Terraform diff for an S3 misconfig, a Kubernetes manifest patch for a missing securityContext, an Ansible variable change for an open port. Each patch lands as a Cybe AutoFix PR ready to review and merge.

Install VibeDefend in 5 seconds.

One command wires every coding agent on your machine to CybeDefend: your business rules, your compliance frameworks, and guards that block destructive calls before they fire.

Install in 5 secondsNode 18.17+

npx -y @cybedefend/vibedefend@latest install

Auto-detects

Claude Code
Cursor
OpenAI Codex
Windsurf
VS Code Copilot