Tools
Things that answer, not argue
Small tools for people who build and run platforms. Every one of them runs entirely in your browser: there is no upload, no account and no server that could keep what you paste, which is the only version worth using on infrastructure source.
Dockerfile security checker
Paste a Dockerfile and see what it exposes: unpinned base images, secrets baked into layers, containers running as root, remote scripts piped into a shell.
Every finding names the CIS or NIST control it fails and what an attacker gains from it.
Open the toolJWT decoder and security checker
Decode a token and see what it gives away: unsigned algorithms, missing expiry, absent audience, personal data and secrets sitting in a payload that is encoded rather than encrypted.
Checked against RFC 8725, the JWT best current practices. The token is never sent anywhere, which for a live credential is the only acceptable design.
Open the toolGitHub Actions security checker
Paste a workflow and read what it hands out: pwn requests, values an outsider can write into your shell, actions pinned to tags their owner can move, tokens granted more than the job needs.
Written for a file you did not write, which is the case a scanner in your own pipeline never covers.
Open the tool
The reasoning behind them is in the writing, and the systems are where the same controls were applied to something already in production.