Ansible Security Scanner

Static SAST for Ansible content: playbooks, roles, collections, task files, vars, and inventories.

Detects malicious code, remote code execution, command and template injection, hardcoded credentials, supply-chain risk, unauthorized cloud access, lateral movement, and reverse shells. Every finding ships with remediation guidance and maps to CWE, OWASP Top 10, OWASP ASVS, MITRE ATT&CK, NIST, and CIS.

Over 1,000 rules across 30+ detection categories, auto-discovered from YAML pattern plugins. Outputs SARIF, CycloneDX SBOM, GitLab SAST, JUnit, JSON, HTML, and Markdown.

CI-native and autofix-capable. Releases are Sigstore-signed with SLSA Build Level 3 provenance.