Browse, install and publish security Checks, Providers and Compliance Frameworks for Prowler.
Add Prowler Registry as an extra index URL for pip.
Install any artifact with pip using the registry URL.
Installed artifacts are automatically discovered by Prowler.
A daily highlighted security check from Prowler Registry.
A daily highlighted compliance framework from Prowler Registry.
apikeys_api_restricted_with_gemini_api
The Gemini API (a.k.a. Generative Language API, generativelanguage.googleapis.com) uses API keys to authenticate requests for uploaded files and cached content. For projects with the Gemini API enabled, each API key should have API restrictions configured to limit access to specific services.
aws_audit_manager_control_tower_guardrails_aws
AWS Control Tower is a management and governance service that you can use to navigate through the setup process and governance requirements that are involved in creating a multi-account AWS environment.
Prowler is an Open Source Project
Red-team plugins promptfoo runs against a model, built into Prowler
ProwlerOfficialBuilt-inVerified2Dockerfile misconfiguration rules Trivy runs for container images, built into Prowler
ProwlerOfficialBuilt-inVerified2Infrastructure-as-code misconfiguration rules Trivy runs, built into Prowler
ProwlerOfficialBuilt-inVerified2FedRAMP 20x Key Security Indicators (KSI) 2026, a compliance framework built into Prowler
ProwlerOfficialBuilt-inVerified2FedRAMP 20x Class C Rules (FRR) 2026, a compliance framework built into Prowler
ProwlerOfficialBuilt-inVerified2Digital Operational Resilience Act (Regulation (EU) 2022/2554), a compliance framework built into Prowler
ProwlerOfficialBuilt-inVerified2System and Organization Controls (SOC), defined by the American Institute of Certified Public Accountants (AICPA), is the name of a set of reports that's produced during an audit. It's intended for use by service organizations (organizations that provide information systems as a service to other organizations) to issue validated reports of internal controls over those information systems to the users of those services. The reports focus on controls grouped into five categories known as Trust Service Principles.
System and Organization Controls (SOC), defined by the American Institute of Certified Public Accountants (AICPA), is the name of a set of reports that's produced during an audit. It's intended for use by service organizations (organizations that provide information systems as a service to other organizations) to issue validated reports of internal controls over those information systems to the users of those services. The reports focus on controls grouped into five categories known as Trust Service Principles.
System and Organization Controls (SOC), defined by the American Institute of Certified Public Accountants (AICPA), is the name of a set of reports that's produced during an audit. It's intended for use by service organizations (organizations that provide information systems as a service to other organizations) to issue validated reports of internal controls over those information systems to the users of those services. The reports focus on controls grouped into five categories known as Trust Service Principles.
authentication_no_stale_tokens
Vercel API tokens are assessed for staleness by checking whether each token has been active within the last 90 days. Stale tokens that remain unused for extended periods represent unnecessary access credentials that increase the attack surface. Tokens with no recorded activity are also flagged.
authentication_token_not_expired
Vercel API tokens are assessed for expiration status to identify expired tokens or those about to expire within a configurable threshold (default: 7 days). Tokens about to expire are flagged proactively so they can be rotated before causing disruptions. Tokens without an expiration date are considered valid.
deployment_production_uses_stable_target
Vercel production deployments are assessed for source branch stability by verifying they are sourced from a stable branch (main or master). Deploying to production from feature branches bypasses standard CI/CD review processes and may introduce untested or incomplete code into the production environment.
