Know your IaC security score
in 30 seconds.

Paste any public GitHub repo — we'll scan it for Terraform, Kubernetes, and CloudFormation misconfigurations and return a score instantly.

🔒 We store only scores and rule IDs — no source code is ever saved. Privacy policy →

pip install misconfig-index ·
🗑️ No source code stored — Quick Scan runs in memory and discards your code immediately after scoring.
📊 We store only scores & rule IDs — no file contents, no snippets, no secrets.
🔓 Open source — inspect exactly what we collect in the public repo. Privacy policy →
— / 100

Community Score

Aggregate misconfig score across all repos tracked in the last 90 days. Connect your repo →

Score Trend

Loading history…
A B C D F

Industry Benchmark

How the community compares — last 90 days

— repos · — scans · avg —

Benchmark grows as more repos are connected.

Grade distribution

Category averages

Loading…

Most common misconfigs

  1. Loading…

Latest Scan

Total Findings

—

Files Scanned

—

Top Rules

    Get Started

    Integrate Misconfig Index into your CI pipeline, add a live score badge to your README, or query the API directly.

    Add a live score badge to your README that updates every time you push.

    Misconfig score badge preview Live badge once you're connected

    Markdown

    ![Misconfig Score](https://api.misconfig.dev/badge/YOUR_ORG/YOUR_REPO)

    Badge URL

    https://api.misconfig.dev/badge/YOUR_ORG/YOUR_REPO

    Drop this workflow into .github/workflows/ to gate every pull request on your misconfig score.

    .github/workflows/misconfig-index.yml

    name: Misconfig Index on: push: paths: ['**.tf', '**.yaml', '**.yml', '**/Dockerfile'] pull_request: paths: ['**.tf', '**.yaml', '**.yml', '**/Dockerfile'] env: MIN_SCORE: 60 jobs: scan: runs-on: ubuntu-latest steps: - uses: actions/checkout@v4 - uses: actions/setup-python@v5 with: python-version: '3.11' - run: pip install misconfig-index - name: Scan IaC env: MISCONFIG_API_KEY: ${{ secrets.MISCONFIG_API_KEY }} run: | misconfig ingest \ --path . \ --repo "${{ github.repository }}" \ --branch "${{ github.ref_name }}" \ --commit "${{ github.sha }}" \ --min-score $MIN_SCORE
    1. Get an API key and add it as MISCONFIG_API_KEY in your repository secrets.
    2. Commit the workflow file — the scanner runs on every IaC change.
    3. Adjust MIN_SCORE to set your quality gate threshold.

    Use the REST API to ingest scans programmatically or build your own integrations.

    Create an organisation

    curl -X POST https://api.misconfig.dev/v1/orgs \ -H "Content-Type: application/json" \ -d '{"name":"Acme","slug":"acme"}'

    Ingest a scan result

    curl -X POST https://api.misconfig.dev/v1/ingest \ -H "X-API-Key: mi_YOUR_KEY" \ -H "Content-Type: application/json" \ -d '{ "repo": "github.com/acme/infra", "branch": "main", "commit_sha": "abc123", "total_files_scanned": 42, "findings": [...] }'

    Get repo score history

    curl https://api.misconfig.dev/v1/repos/1/history \ -H "X-API-Key: mi_YOUR_KEY"

    Full interactive API reference at api.misconfig.dev/docs