DryRun Security IaC Security vs kube-score

DryRun Security IaC Security scans infrastructure-as-code changes for security risks by analyzing infrastructure and application code together. It covers Terraform, Kubernetes, and other IaC, with checks for overly permissive IAM policies, publicly exposed resources, insecure defaults, and subdomain takeover risks. Scans run in pull requests and provide guidance during infrastructure design. Teams can write natural-language guardrails for public access, permitted cloud regions, approved resource types, and organization-specific requirements; the Custom Policy Agent enforces them on changes. Terraform findings can appear as pull-request comments and Risk Register entries containing the affected resource, risk description, and remediation guidance. Listed integrations include Claude Code, Claude Desktop, Codex, Cursor, GitHub, GitLab, and Slack. The SaaS service supports GitHub.com personal, organization, and Enterprise Cloud repositories, plus GitLab SaaS; custom instances and other source-control systems require contacting DryRun. DryRun says it uses private models, sends no data to public AI systems, stores minimal metadata and findings, and allows code-access revocation through repository permissions. Pricing is on request, aligned with team size, and a free trial is available.

kube-score statically analyzes Kubernetes object definitions and recommends changes intended to improve application security and resilience. Its checks cover container limits, NetworkPolicy targeting, PodDisruptionBudget, Pod anti-affinity, container probes, security context, and stable APIs. Optional checks include matching resource requests and limits, container ports, and seccomp profile configuration. You can configure tests to be ignored or enabled globally or for individual objects. kube-score works with Helm, Kustomize, static YAML files, Docker, and resources retrieved from a Kubernetes cluster. Its browser demo accepts Kubernetes YAML or JSON and, according to the maker, processes it in the browser without sending data to a server. Local options include prebuilt binaries for Linux, macOS, and Windows, along with Docker, Homebrew, and Kubernetes Krew. Output formats include human-readable, JSON, CI, and SARIF. In CI/CD, critical errors return exit code 1; warnings can also be set as the exit threshold. The free, MIT-licensed project recommends analyzing all applications deployed to the same namespace together. Building from source requires Go 1.21 or later.