This cybersecurity news tool is a Docker Compose security grader: paste your docker-compose.yml — AI-written or hand-written — for an instant A–F score with every issue explained and a fix snippet.
It checks your docker-compose.yml for the misconfigurations attackers actually exploit: privileged containers, exposed database ports, hardcoded secrets, docker.sock mounts, unpinned :latest tags and host networking. Every issue gets an explanation and a fix snippet, and the analysis runs 100% in your browser — your file never leaves the page.
Paste your docker-compose.yml below — AI-written or hand-written. Get an instant A–F AI code security grade with every issue explained and a fix snippet. Your file never leaves this page — the analysis runs entirely in your browser.
No. The YAML parser and all checks run in JavaScript in your browser. Nothing is sent to any server — you can verify in your browser's network tab, or disconnect from the internet and it still works.
Every service starts at 100. Critical issues cost 25 points, high 12, medium 6, low 2. A: 90+, B: 78+, C: 62+, D: 45+, F: below 45. Multiple issues stack — a file can score below zero and still show F.
No — this is a static configuration check, not a guarantee. It doesn't scan your images for CVEs, audit your application code, or check your firewall. Treat the grade as "configuration hygiene," one layer of a real security posture.
The subset docker-compose files actually use: nested maps, lists, quoted and unquoted scalars, comments, and the long (map) syntax for ports. Exotic YAML features (anchors, multi-line blocks) may not parse — if it fails, simplify or paste one service at a time.
:latest moves under you — a redeploy can silently pull a different, possibly vulnerable build, and you can't roll back to the exact image you tested. Pinning a version or digest makes deploys reproducible.
Run a static-analysis (SAST) scanner over the repo — open-source options include Semgrep and vibe-code-focused AI code security scanners — plus a secrets scan for hardcoded API keys, then a dynamic (DAST) scan against the running app. No scanner replaces a human review of authentication, data handling, and business logic.
Vibe coding security is the practice of checking AI-generated code for the flaws models commonly introduce: hardcoded secrets, injection flaws, cross-site scripting, disabled TLS verification, and insecure defaults. Research (Veracode's 2025 GenAI Code Security Report) found 45% of AI-generated code shipped a real vulnerability.
Heuristic static analysis for education and hardening. It finds misconfigurations; it is not a penetration test and not a substitute for one.