35 findings
| CRITICAL | OPEN | Bucket publicly accessible | Storage | Cloud only | ovh://bucket/backups-gra |
| CRITICAL | OPEN | Object storage bucket is public | Storage | Cloud only | scw://bucket/prod-data-eu |
| CRITICAL | OPEN | Bucket with a public ACL | Storage | Cloud only | osc://bucket/prod-archives |
| CRITICAL | OPEN | RDS instance is publicly accessible | Database | DRIFT | arn:aws:rds:eu-west-1:123456789012:db:prod-orders |
| CRITICAL | OPEN | Image shared publicly | Storage | Cloud only | osc://image/ami-prod-base |
| CRITICAL | OPEN | Kubernetes API server is exposed to 0.0.0.0/0 | Kubernetes | Cloud only | k8s-prod-eu |
| CRITICAL | OPEN | NSG allows RDP from internet | Network | Cloud only | azure://Microsoft.Network/networkSecurityGroups/prod-nsg |
| HIGH | OPEN | Instance has public IP with permissive security group | Compute | Cloud only | scw://instance/i-7f3b9a |
| HIGH | OPEN | Database reachable from the public network | Database | Cloud only | ovh://database/prod-pg |
| HIGH | OPEN | OKS API server reachable from the Internet | Kubernetes | Cloud only | oks-prod |
| HIGH | OPEN | Storage account allows HTTP traffic | Storage | Cloud only | azure://Microsoft.Storage/storageAccounts/prodeustorage |
| HIGH | OPEN | Managed Kubernetes API server without an ACL | Kubernetes | Cloud only | mks-prod |
| HIGH | OPEN | Default security group with an unrestricted rule | Network | Cloud only | osc://sg/sg-default-osc |
| HIGH | OPEN | VM with a public IP behind a security group open to the Internet | Network | DRIFT | osc://vm/i-a1b2c3d4 |
| HIGH | OPEN | Kapsule API server reachable from the Internet | Kubernetes | Cloud only | k8s-prod-eu |
| HIGH | OPEN | IAM role uses wildcard Action permissions | IAM | Cloud only | arn:aws:iam::123456789012:role/prod-deploy |
| HIGH | OPEN | Instance with a public IP behind a security group open to the Internet | Network | DRIFT | ovh://instance/prod-web-ovh |
| HIGH | OPEN | SSH (port 22) open to the world | Network | DRIFT | arn:aws:ec2:eu-west-1:123456789012:security-group/sg-default-22 |
| HIGH | OPEN | Administrator policy linked to a user | IAM | Cloud only | osc://user/admin |
| HIGH | OPEN | RDS automated backups disabled | Database | Cloud only | arn:aws:rds:eu-west-1:123456789012:db:staging-db |
| MEDIUM | OPEN | OKS cluster without the PodSecurity admission plugin | Kubernetes | Cloud only | oks-prod |
| MEDIUM | OPEN | Managed Kubernetes without a private network | Kubernetes | Cloud only | mks-prod |
| MEDIUM | RESOLVED | OS Login disabled on Compute Engine instance | Compute | Cloud only | gcp://compute/instance/api-staging-1 |
| MEDIUM | OPEN | Kapsule cluster without automatic upgrades | Kubernetes | Cloud only | k8s-prod-eu |
| MEDIUM | OPEN | Kapsule cluster not attached to a Private Network | Kubernetes | Cloud only | k8s-prod-eu |
| MEDIUM | OPEN | S3 bucket versioning is disabled | Storage | Code & Cloud | arn:aws:s3:::staging-logs |
| MEDIUM | IGNORED | Function uses deprecated Node 14 runtime | Serverless | Cloud only | scw://function/eu-cleanup-cron |
| MEDIUM | OPEN | Bucket without versioning | Storage | Cloud only | osc://bucket/prod-archives |
| MEDIUM | IGNORED | CloudTrail log file validation is disabled | Logging | Cloud only | arn:aws:cloudtrail:eu-west-1:123456789012:trail/prod-trail |
| MEDIUM | RESOLVED | KMS key rotation is not enabled | Cryptography | Cloud only | gcp://kms/key/prod-master-key |
| MEDIUM | RESOLVED | S3 bucket versioning is disabled | Storage | Cloud only | arn:aws:s3:::staging-uploads |
| LOW | OPEN | Kapsule cluster with an upgrade available | Kubernetes | Cloud only | k8s-prod-eu |
| LOW | OPEN | User with both console login and an access key | IAM | Cloud only | osc://user/admin |
| LOW | RESOLVED | Object storage bucket logging is disabled | Storage | Cloud only | arn:aws:s3:::staging-logs |
| LOW | OPEN | Object storage bucket logging is disabled | Storage | Cloud only | scw://bucket/dev-uploads |
