Yourclusterishidingmisconfigs.Weexposeeveryone.
Six categories. Fifty-plus checks. One score. Audited live, every fifteen minutes.
- Read-only · No agent privileges
- Continuous audit
- Severity-ranked
payment-svc/deployment.yaml
Single replica
Running as root
Privileged container
0
issues found
0
categories audited
0s
full scan
What we audit
Sixaxes.Fifty-pluschecks.
Every category. Every severity. Every resource. Nothing missed.
Security
11 checks
- SEC-001Running as root
- SEC-002Privileged container
- SEC-007Read-only root FS missing
Reliability
11 checks
- REL-001Single replica
- REL-005No liveness probe
- REL-006No readiness probe
Workload Config
9 checks
- WRK-002Missing PDB
- WRK-003No graceful shutdown
- WRK-004No revision history
Scheduling & Placement
6 checks
- SCH-001No anti-affinity
- SCH-002No topology spread
- SCH-003Missing tolerations
Namespace Org
5 checks
- NS-001Missing resource quota
- NS-002No limit range
- NS-003Missing labels
Resource Config
8 checks
- RES-001No CPU limits
- RES-002No memory limits
- RES-003No requests set
Every check audited every 15 minutesCISNSA/CISAPod Security Standards
Signal → fix
Fromvaguewarningtocopy-pastefix.
Every finding is shipped with the exact resource, the why, the how, and the YAML.
payment-service
Why it matters
Container runs as UID 0. A pod escape grants root on the node.
How to fix
- 1
Add securityContext.runAsNonRoot: true
- 2
Set securityContext.runAsUser: 10001
- 3
Rebuild image with non-root USER directive
spec: template: spec:+ securityContext:+ runAsNonRoot: true+ runAsUser: 10001 containers: - name: api image: payment:1.4.2Exact resource
Cluster · namespace · kind · name. Plus the manifest path.
Step-by-step
Each finding has numbered remediation. Never just a warning.
Real YAML
Copy-paste-ready snippets. Audited against the source manifest.
Score over time
TriageMonday.ScoreclimbsbyFriday.
Compliance score is a daily number. Watch it move.
Compliance score · 8 weeks
prod-east cluster
Now
0
from 38
0
points climbed
6 weeks
triage to compliance
38 → 92
headline score
Stop paying for unused capacity.
Connect your first cluster in 5 minutes. The first 100 vCPU is on us, forever. Above it, the rate tiers from $1.99 down to $0.60 — same features, every plan.