Checks

Amazon DocumentDB clusters are assessed for storage encryption at rest via the cluster's encrypted setting.

It identifies clusters where data volumes, automated backups, and snapshots aren't protected by AWS KMS-managed encryption.

Vercel domains are assessed for DNS configuration to verify records properly point to Vercel's infrastructure. Misconfigured DNS can result in domains that fail to serve content, SSL certificate provisioning failures, and degraded user experience.

Vercel domains are assessed for SSL certificate validity including provisioning, expiration, and upcoming expiry. Vercel automatically provisions and renews SSL certificates for properly configured domains. A missing, expired, or soon-to-expire certificate indicates a configuration issue that may leave traffic unencrypted.

Vercel domains are assessed for ownership verification status. Unverified domains may not serve traffic correctly and could indicate a pending or incomplete domain setup. Domain verification confirms that the domain owner has authorized Vercel to manage the domain.

The domain-wide Access Checker configuration ensures that when a user shares a Drive file via a Google product other than Drive itself (e.g. by pasting a link in Gmail), the suggestions never expand sharing to a wider audience or to anyone with the link. Access Checker is set to recipients only.

The domain-wide default disables Google Drive for desktop for the organization. The Drive for desktop client synchronizes Drive content to local devices and uses its own "offline" mechanism that does not respect the central offline-access device policy, so disabling it closes a synchronization channel that would otherwise place organizational content on potentially unmanaged endpoints.

The domain-wide Drive and Docs configuration warns users when they attempt to share a file with users outside the organization. This prompt gives users an opportunity to reconsider before exposing organizational content to external parties, reducing the likelihood of accidental data disclosure through everyday sharing actions.

The domain-wide default restricts distributing organizational content to shared drives owned by another organization to eligible internal users only. This prevents external collaborators with manager access to internal shared drives from moving content out of the organization.

The domain-wide Drive and Docs default prevents users from publishing files to the web or making them visible to the world as public or unlisted. Publishing a file to the web exposes its content to anyone on the internet, often without any audit trail, making it one of the highest-impact misconfigurations available to end users.

The domain-wide default allows users to create new shared drives. Shared drives are owned by the organization (not the individual user), so content stored in them survives the deletion of the original creator's account, supporting data continuity and reducing the risk of accidental data loss.

The domain-wide default prevents viewers and commenters of files stored in shared drives from downloading, printing, or copying the file contents. They can only read and comment on the existing content, preventing bulk extraction of sensitive material from shared drives.

The domain-wide default prevents members with manager access to a shared drive from overriding the shared drive settings established by administrators. This ensures that security controls — such as external access, member-only access, and download restrictions — cannot be relaxed at the individual shared drive level.

The domain-wide default restricts shared drive file access to explicit members only. Non-members cannot be added to individual files inside the drive, preserving the shared drive's membership boundary as the authoritative access control surface.

The domain-wide default restricts external sharing of Drive and Docs files to a curated list of allowlisted domains, rather than allowing sharing with arbitrary external recipients. This converts external sharing from an open default into a controlled allow-list that aligns with documented business relationships.

At the domain level, even when external sharing is restricted to allowlisted domains, Google Drive warns users before they share a file with a user in an allowlisted domain. This second-step prompt helps users recognize when they are crossing the organizational boundary, even within permitted destinations.

AWS Elastic Disaster Recovery is assessed per Region to verify the service is initialized and that at least one recovery or drill job exists, demonstrating that failover has been exercised.

When using a 'FROM' statement you should use a specific tag to avoid uncontrolled behavior when the image is updated.

Running containers with 'root' user can lead to a container escape situation. It is a best practice to run containers as non-root users, which can be done by adding a 'USER' statement to the Dockerfile.

Exposing port 22 might allow users to SSH into the container.

You should use COPY instead of ADD unless you want to extract a tar file. Note that an ADD command will extract a tar file, which adds the risk of Zip-based vulnerabilities. Accordingly, it is advised to use a COPY command, which does not extract tar files.

COPY '--from' should not mention the current FROM alias, since it is impossible to copy from itself.

There can only be one ENTRYPOINT instruction in a Dockerfile. Only the last ENTRYPOINT instruction in the Dockerfile will have an effect.

UNIX ports outside the range 0-65535 are exposed.

For clarity and reliability, you should always use absolute paths for your WORKDIR.