Conftest vs Winfunc Infrastructure Scanner
Conftest
conftest.devWinfunc Infrastructure Scanner
winfunc.comSide by side
| Figure | Conftest | Winfunc Infrastructure Scanner |
|---|---|---|
| Price from | Free | — |
| Free plan | Yes | — |
| Free trial | — | — |
| Open source | — | — |
| Web | — | Yes |
| Windows | Yes | — |
| macOS | Yes | — |
| Linux | Yes | — |
| API | — | Yes |
| Self-hosted | — | Yes |
| Plans published | 1 | 4 |
| Spec score · Infrastructure as Code Security Software | 8.4 (#7) | 7.8 (#16) |
| Purpose | Conftest is a utility for writing tests against structured configuration data. | Scans infrastructure-as-code, cloud configurations, and container definitions for misconfigurations, exposed secrets, and compliance violations before production. |
| Support | Questions and discussions are directed to the Open Policy Agent Slack channel `#opa-conftest`. | The Trust Center says Enterprise includes a dedicated security engineer, priority Slack channel, response times under one hour for critical issues, and quarterly security reviews. |
| Supported formats | Supported formats include YAML, JSON, HCL/HCL2, Dockerfile, TOML, CUE, XML, INI, SPDX and CycloneDX. | Supports Terraform, CloudFormation, Pulumi, Kubernetes manifests, and Dockerfiles. |
Plans
Winfunc Infrastructure Scanner
- One-time$500, paid once
- EnterprisePriced on request
- Pay as you goPriced on request
- RecurringPrice not published
In their own words
Conftest
Conftest is a free utility for testing structured configuration data, designed for use in CI environments. It uses the Open Policy Agent Rego language to express policies, then evaluates deny, violation, and warning rules within namespaces. Configuration can be read from individual files, directories, multiple files, or standard input. Supported inputs include Kubernetes-style YAML, JSON, HCL and HCL2, Dockerfiles, Terraform-related data, JSONnet, TOML, and XML. Results can be output as plaintext, JSON, TAP, table, JUnit, GitHub, Azure DevOps, or SARIF; the GitHub outputter can annotate test results in workflows. The `conftest verify` command runs policy unit tests. Policies can be pulled from HTTPS URLs, Git repositories, and OCI registries, or pushed to compatible OCI registries. Plugins extend the CLI, with downloads available from sources including OCI, Git, HTTP/HTTPS, Mercurial, and cloud storage. Pre-commit hooks support policy workflows, and integrations are documented for CircleCI, GitHub Actions, and Tekton. Conftest is available for Linux, macOS, and Windows.
Winfunc Infrastructure Scanner
Winfunc Infrastructure Scanner has no write-up on Specifiction yet; its figures are above.