Checks

Kubernetes Kubelet configuration defines event rate limiting via eventRecordQPS. The setting is evaluated for presence and a positive value, where 0 means unlimited event generation.

Kubernetes Kubelet configured with makeIPTablesUtilChains manages iptables utility chains, keeping node firewall primitives aligned with dynamic pod networking. The setting is expected to be present and enabled in kubelet configuration.

Kubernetes Kubelet configuration is inspected for client TLS credential rotation. The finding determines whether rotateCertificates is enabled so kubelets automatically renew the client certificates they use to authenticate to the API server.

Kubernetes Kubelet service configuration on each node is expected to be owned by root. This assessment inspects the systemd drop-in at /etc/systemd/system/kubelet.service.d/kubeadm.conf and expects ownership root:root, ensuring only privileged users can modify kubelet startup settings.

Kubernetes Kubelet service file on worker nodes is assessed for restrictive permissions of 600 or tighter. The evaluation reviews the kubelet systemd drop-in configuration to confirm only the owner has read/write access and no broader permissions are granted.

Kubernetes Kubelet streaming sessions use a non-zero idle timeout via streamingConnectionIdleTimeout for exec, logs, and port-forward connections.

Assesses whether this setting exists and is not 0.

Kubernetes Kubelet HTTPS configuration is assessed for use of strong TLS cipher suites. The presence of tlsCipherSuites is checked and its values are validated against an approved, modern allowlist (e.g., ECDHE with GCM/CHACHA20).

Kubernetes Kubelet configuration includes a TLS serving certificate and private key defined by tlsCertFile and tlsPrivateKeyFile to secure its HTTPS endpoint.

Lightsail managed database is evaluated for public accessibility. When public mode is enabled, the database accepts connections from the Internet using its endpoint and port; otherwise, access is limited to authorized Lightsail resources.

Amazon Lightsail instances with automatic daily snapshots enabled are identified. The evaluation checks if an instance is configured to take recurring snapshots at a scheduled time.

Lightsail instances that have a public IP and at least one firewall rule allowing public ports are treated as publicly exposed. The evaluation inspects instance addressing and port rules to detect any port or range marked public.

Amazon Lightsail static IPs detected as not associated with any instance, indicating reserved but unused addresses.

The evaluation focuses on the association state of each static IP to highlight potential leftovers.

Tests for ASCII-based prompt smuggling vulnerabilities

Evaluates function-level authorization controls to identify privilege escalation vulnerabilities (OWASP API Security Top 10 #5)

Tests handling of age bias in responses, stereotypes, and discrimination

Tests handling of disability bias in responses, stereotypes, and discrimination

Tests handling of gender bias in responses, stereotypes, and discrimination

Tests handling of race bias in responses, stereotypes, and discrimination

Tests object-level authorization mechanisms to detect unauthorized data access vulnerabilities (OWASP API Security Top 10 #1)

Assesses system protection against unauthorized competitor endorsements and brand security risks

Tests for information leakage vulnerabilities between different user sessions

Identifies exposed debugging interfaces and unauthorized command execution vectors

Tests repetitive patterns that can cause the model to diverge from normal behavior and leak training data

Evaluates system boundary enforcement and unauthorized action prevention