DevOps and security checks

What each of the 50 checks looks for, why it matters, and how to fix it. Scan a public repository for free →

Security

• How to find and remove secrets committed to a Git repository
• Why .env must be in .gitignore (and how to check it is not already committed)
• A .env file is committed to the repository: what to do
• Automated dependency updates with Dependabot or Renovate
• How to pin GitHub Actions to a commit SHA
• Least-privilege GITHUB_TOKEN permissions in workflows
• The pull_request_target trap in GitHub Actions
• Script injection in GitHub Actions and how to prevent it
• Self-hosted runners in public repositories
• Deploying from GitHub Actions with OIDC instead of stored cloud keys
• Pinning images in GitLab CI
• Pinning GitLab CI includes from other projects
• GitLab CI deploys with OIDC (id_tokens) instead of stored keys

Hygiene

• How to add a SECURITY.md security policy to a repository
• How to set up CODEOWNERS for required reviews
• What a good README contains
• Writing a README that explains how to run the project
• Keeping a CHANGELOG: formats and tools
• How to write a CONTRIBUTING guide
• Pull request and issue templates
• Why every repository needs a .gitignore
• Documenting environment variables with .env.example
• Choosing and adding a LICENSE
• Is this repository still maintained?

CI/CD

• Setting up a CI/CD pipeline for every push
• How to run tests in CI on every pull request
• How to protect the main branch on GitHub and GitLab
• Adding a linter or formatter to your project
• Adding security scanning (Trivy, gitleaks, CodeQL) to CI

Docker

• Writing a production Dockerfile
• What to put in .dockerignore
• How to add a Docker healthcheck
• How to run a Docker container as a non-root user
• Why pin Docker base images (and not use :latest or python:slim)
• Docker multi-stage builds: smaller and safer images
• Setting memory and CPU limits in docker-compose

Dependencies

• Why every project needs a dependency manifest
• Should you commit a lock file?
• Pinning Python dependencies to exact versions
• Finding known vulnerabilities (CVE) in your dependencies

Operations

• Adding logging, metrics and error tracking to a service

Infrastructure as Code

• Terraform remote state and state locking
• Security groups open to 0.0.0.0/0 in Terraform
• Removing hardcoded credentials from Terraform
• Constraining Terraform provider versions
• Scanning Terraform in CI with Checkov, tfsec or Trivy

AI agent safety

• Keeping secrets out of CLAUDE.md, AGENTS.md and other agent instructions
• Pinning MCP server versions
• Keeping credentials out of MCP configs
• AI agents in CI that outsiders can steer