Infrastructure & deployment security audit — Docker, Nginx, databases, CI/CD, cloud, TLS, secrets management. Framework-agnostic, adapts to any stack. Use before production deployments.
ultrathink
Deep infrastructure and deployment configuration security audit. You have unrestricted tool access — use Read, Grep, Glob, Bash, and any available tool to thoroughly analyze all config files.
$ARGUMENTS — specific config files, directories, or full for complete project infra audit. Defaults to full project.
Before auditing, exhaustively discover every infrastructure config file to ensure nothing is missed.
Run ALL these searches in parallel using Grep and Glob:
Containers & Orchestration:
**/docker-compose*.yml, **/docker-compose*.yaml, **/Dockerfile*, **/podman-compose***/k8s/**, **/helm/**, **/kustomize/**, **/*.deployment.yaml, **/*.service.yaml(image:|ports:|volumes:|environment:|privileged|cap_add|security_context) in YAML files(FROM|EXPOSE|RUN|COPY|ADD|ENV|USER|ENTRYPOINT|CMD)\s in DockerfilesReverse Proxy & Web Server:
**/nginx*.conf, **/nginx/**, **/Caddyfile, **/traefik*.yml, **/haproxy.cfg, **/apache*.conf**/vercel.json, **/netlify.toml, **/fly.toml, **/render.yaml(server_tokens|add_header|proxy_pass|ssl_protocols|ssl_ciphers|limit_req) in config filesDatabases:
**/redis.conf, **/pg_hba.conf, **/postgresql.conf, **/mongod.conf, **/my.cnf, **/mysql.cnf(DATABASE_URL|REDIS_URL|MONGO_URI|connection_string|connectionString) — connection strings(requirepass|bind|maxmemory|ssl-cert|auth|trust) in database configsEnvironment & Secrets:
**/.env*, **/*.env, **/.env.example, **/.env.local, **/.env.production**/*.pem, **/*.key, **/*.crt, **/*.cert, **/*.p12, **/*.pfxgit ls-files '*.env' '.env*' — check if env files are trackedgit log --all --diff-filter=D -- '*.env' '*.pem' '*.key' — deleted secrets in history(api[_-]?key|secret|password|token|private[_-]?key|access[_-]?key)\s*[:=] in all source filesCI/CD Pipelines:
**/.github/workflows/*.yml, **/.gitlab-ci.yml, **/Jenkinsfile, **/bitbucket-pipelines.yml**/.circleci/config.yml, **/azure-pipelines.yml, **/.drone.yml(secrets\.|\$\{\{|env\.|permissions:|write-all|contents: write) in CI filesCloud / IaC:
**/terraform/*.tf, **/terraform.tfstate*, **/pulumi/**, **/cloudformation*.yml**/.aws/**, **/gcp-*.json, **/azure-*.json, **/service-account*.json(aws_|azurerm_|google_|resource |data |module ) in .tf files(public-read|public-read-write|AllUsers|\*:\*) — public access patternsBaaS & Third-party Platforms:
**/supabase/config.toml, **/supabase/migrations/**, **/supabase/functions/****/firestore.rules, **/storage.rules, **/database.rules.json, **/firebase.json(SUPABASE_SERVICE_ROLE|STRIPE_SECRET|CLERK_SECRET|FIREBASE_ADMIN)\s*[:=] — secret keys in config(NEXT_PUBLIC_|VITE_|REACT_APP_).*(SERVICE_ROLE|SECRET|PRIVATE) — secret keys accidentally exposed as public env vars(allow read, write: if true|".read":\s*true|".write":\s*true) — open Firebase rulesApp Security Config:
**/next.config.*, **/nuxt.config.*, **/vite.config.*(helmet|cors|csp|content-security-policy|x-frame-options|rate-limit) in source(productionSourceMap|devtool|source-map|sourcemap) — source maps configAfter discovery, organize all found configs into a prioritized checklist:
## INFRA AUDIT TODO — [Project Name]
### P1 — Critical (secrets, auth, exposed services)
- [ ] `.env.production` — committed to git with real credentials
- [ ] `docker-compose.yml` — redis exposed on 0.0.0.0:6379
- [ ] `terraform.tfstate` — state file in repo
### P2 — High (containers, proxy, database config)
- [ ] `Dockerfile` — running as root, unpinned base image
- [ ] `nginx.conf` — missing security headers
- [ ] `pg_hba.conf` — trust auth for remote connections
### P3 — Medium (CI/CD, TLS, cloud)
- [ ] `.github/workflows/deploy.yml` — write-all permissions
- [ ] `nginx.conf` — TLS 1.0/1.1 still enabled
### P4 — Low (hardening, defense-in-depth)
- [ ] `docker-compose.yml` — no resource limits
- [ ] `redis.conf` — dangerous commands not disabled
Rules for the TODO:
As you audit each config, update the checklist:
[x] — Audited, no issues found[!] — Audited, finding(s) reported[ ] — Not yet auditedPrint the checklist status at each major milestone so progress is visible.
0.0.0.0 instead of 127.0.0.1 — network exposure (CWE-668)USER/user: directive (CWE-250)mem_limit, cpus, pids_limit) (CWE-770):latest — supply chain risk (CWE-1395)privileged: true or dangerous cap_add (NET_ADMIN, SYS_ADMIN) (CWE-250)docker.sock mounted into container (CWE-250)server_tokens on / ServerSignature On — version leak (CWE-200)X-Forwarded-Host, X-Forwarded-Server (CWE-644)max-age < 31536000 or missing includeSubDomains (CWE-319)Redis:
requirepass — unauthenticated access (CWE-306)0.0.0.0 (CWE-668)CONFIG, DEBUG, FLUSHALL, KEYS (CWE-250)maxmemory + eviction policy (CWE-770)PostgreSQL / MySQL:
trust or password-less auth for non-local connections (CWE-306)log_statement = 'all' logging sensitive queries (CWE-532)MongoDB:
--noauth) (CWE-306)0.0.0.0 without bindIp restriction (CWE-668).env files committed to git: git ls-files '*.env' '.env*' (CWE-798).env.example containing real values instead of placeholders (CWE-798).gitignore entries for *.env, *.pem, *.key (CWE-538)npm audit, pip audit, cargo audit) (CWE-1395)Supabase:
SUPABASE_SERVICE_ROLE_KEY exposed in client-side env vars (e.g. NEXT_PUBLIC_, VITE_, REACT_APP_) — bypasses all RLS (CWE-798)supabase/migrations/ that ALTER TABLE ... ENABLE ROW LEVEL SECURITY is present for every user-data table (CWE-284)public in supabase/config.toml or dashboard config (CWE-668)Authorization header not checked) (CWE-306)Firebase:
firestore.rules / storage.rules containing allow read, write: if true; (CWE-284)firebaseConfig object with unrestricted API key (no HTTP referrer or IP restriction) in client bundle (CWE-284)functions.https.onCall auth check or admin SDK without service account restrictions (CWE-306)database.rules.json with ".read": true or ".write": true at root (CWE-284)Clerk / Auth.js / BetterAuth:
CLERK_SECRET_KEY, AUTH_SECRET) in client-side env var (CWE-798)publicRoutes pattern too broad (e.g. /(.*) instead of specific paths) — accidentally exposes protected routes (CWE-284)Stripe / Payment Providers:
STRIPE_SECRET_KEY or STRIPE_WEBHOOK_SECRET exposed via NEXT_PUBLIC_ / VITE_ prefix (CWE-798)* or overly broad permissions (CWE-250)0.0.0.0/0 inbound on non-HTTP ports (CWE-668)sensitive = true (CWE-798)terraform.tfstate committed to git (CWE-798)Per finding:
### [SEVERITY] Title — CWE-XXX
**File**: `path/to/config:line`
**Confidence**: confirmed | probable
**Issue**: What is wrong (specific).
**Risk**: What an attacker gains and how.
**Fix**:
Before:
[exact current config line]
After:
[exact fixed config line]
**Effort**: ~Xmin
End with executive summary: total findings by severity, top priority fixes, production readiness assessment, and Files Discovered: X total (Y audited, Z skipped).