TL;DR: Application code isn't the only thing that ships vulnerabilities — your Terraform does too. I wrote an intentionally insecure AWS configuration, scanned it with Checkov (a SAST tool for Infrastructure as Code, listed on the OWASP Source Code Analysis Tools page), went from 35 failed checks to 0 , and wired the scan into GitHub Actions. Full code: GitHub repo → SAST for infrastructure? Yes, that's a thing In my previous article I used Bandit to find security b...