Cybersecurity · free, no signup
Terraform Exposure Analyzer
Paste a Terraform configuration and see what it opens. `0.0.0.0/0` is not a finding on its own — on 443 it is a web server doing its job, and grading that as a fault is why people stop reading these reports. On 22 it is an interactive shell exposed to every credential-stuffing bot on the internet; on 3306 it is the database, reachable from anywhere. The line that does it looks identical in all three cases, so the port decides the severity and the correct rules are listed rather than reported. Also covers `http_tokens = optional`, which reads like a compatibility flag and is the difference between an SSRF bug and stolen role credentials. Plus public buckets, databases marked publicly accessible, encryption explicitly disabled, and secrets written as literals — reported by location and length, with the value never reproduced. Nothing is planned or resolved, and a value arriving through a variable is reported as undetermined rather than assumed.
Authorized, defensive use only. Check assets you own or lawfully public data. This tool is educational and never provides another party's private data.
Paste a Terraform configuration and see what it opens. 0.0.0.0/0 is not a finding on its own — the port decides that. On 443 it is a web server doing its job, and calling that a fault is why people stop reading these reports. On 22 it is an interactive shell exposed to every bot on the internet; on 3306 it is your database, protected by nothing but its password. The line that does it looks identical in all three cases, so the correct rules are listed rather than flagged.
Nothing is planned, applied or resolved. Modules are not fetched, and a value arriving through var. is reported as undetermined rather than assumed safe or unsafe. If a secret is written as a literal it is reported by location and length only — the value is never shown, here or in the report.
What happens to what you enter
- The analysis runs on Solvex servers. What is recorded afterwards is a SHA-256 hash of your input and a coarse summary of the outcome — never the input itself, and never a result you could be identified from.
- Tools that read public sources (certificate logs, DNS, a public chain) contact those sources from our servers through a fetcher that refuses private and internal addresses.
- An email address is stored only where a tool offers to send you a report and you choose to give one.
Limits: ten runs of this tool per minute from one address, and three signed reports per minute. Past that the tool says so and tells you when to try again.
When a free check is not enough
This tool reads what is public and reports what it can see. The Infrastructure-as-Code Security Review engagement is the authorized, specialist-led version: signed scope, findings proven by hand, a signed report, and a retest.
Explore Infrastructure-as-Code Security Review