otty / apps
All apps/tfsec

tfsec

tfsec

Static analysis security scanner for Terraform code.

Runs as tfsec|macOS, Linux, Windows
Open form in Otty otty.toml

Command form

ai-draft · 2 tasks · 13 fields

Scan a directory of Terraform for security issues. Rego, custom checks and updates are left out.

Opens the form; the finished command lands at your prompt, unrun
Run in Otty
otty gui tfsec
Scan TerraformExample values, fixed in this page — nothing here reaches a terminal
Basic
Directory*
directory
Minimum severity
string
Soft fail
--soft-fail
TasksEach one presets the form for one job
Scan a directory
directoryminimum_severitysoft_fail
JSON report
directoryformatoutminimum_severity
ParametersOnly these flags are editable in the form
Directory
path · positional 0
Output format
string
--format-fdefaultjsoncsvcheckstylejunitsarif
Output file
path
--out-O
Minimum severity
string
--minimum-severity-mCRITICALHIGHMEDIUMLOW
Exclude rule IDs
Comma-separated rule IDs.
string
--exclude-e
Exclude paths
path · repeatable
--exclude-path
tfvars files
path · repeatable
--tfvars-file
Config file
path
--config-file
Soft fail
Run checks but suppress the error exit code.
boolean
--soft-fail-s
Concise output
boolean
--concise-output
No color
boolean
--no-color
Include passed checks
boolean
--include-passed
No module downloads
boolean
--no-module-downloads
SourcesEvery flag above is checked against these
fig
completion

github.com

Before it fills your prompt, Otty checks the installed tfsec against its version. A form that does not match your version is not offered.