github.com/anthropics/claude-code

Opening up ports to connect out to the public internet is generally to be avoided. You should restrict access to IP addresses or ranges that are explicitly required where possible.

Avoid using 'RUN' with 'sudo' commands, as it can lead to unpredictable behavior.

Passing unknown or invalid headers through to the target poses a potential risk of compromise. By setting drop_invalid_header_fields to true, anything that doe not conform to well known, defined headers will be removed by the load balancer.

In-transit data should be encrypted so that if traffic is intercepted data will not be exposed in plaintext to attackers.

Base64 High Entropy String on 5db4fda239a71e4b4b511f9dd7bf87fb260340d0

Ensure all Cloud SQL database instance have backup configuration enabled on google_sql_database_instance.db

Ensure all Cloud SQL database instance requires all incoming connections to use SSL on google_sql_database_instance.db

Ensure Artifact Registry Repositories are encrypted with Customer Supplied Encryption Keys (CSEK) on google_artifact_registry_repository.repo

Ensure CloudWatch log groups retains logs for at least 1 year on aws_cloudwatch_log_group.gateway

Ensure container insights are enabled on ECS cluster on aws_ecs_cluster.cluster

Ensure DB instance gets all minor upgrades automatically on aws_db_instance.db

Ensure GCP network defines a firewall and does not use the default firewall on google_compute_network.vpc

Ensure GCP PostgreSQL logs SQL statements on google_sql_database_instance.db

Ensure hostnames are logged for GCP PostgreSQL databases on google_sql_database_instance.db

Ensure pgAudit is enabled for your GCP PostgreSQL database on google_sql_database_instance.db

Ensure PostgreSQL database 'log_checkpoints' flag is set to 'on' on google_sql_database_instance.db

Ensure PostgreSQL database 'log_connections' flag is set to 'on' on google_sql_database_instance.db

Ensure PostgreSQL database 'log_disconnections' flag is set to 'on' on google_sql_database_instance.db

Ensure PostgreSQL database 'log_lock_waits' flag is set to 'on' on google_sql_database_instance.db

Ensure PostgreSQL database flag 'log_duration' is set to 'on' on google_sql_database_instance.db

Ensure RDS database has IAM authentication enabled on aws_db_instance.db

Ensure RDS instance with copy tags to snapshots is enabled on aws_db_instance.db

Ensure RDS Performance Insights are encrypted using KMS CMKs on aws_db_instance.db

Ensure Secrets Manager secrets should have automatic rotation enabled on aws_secretsmanager_secret.postgres_url

Ensure Secrets Manager secrets should have automatic rotation enabled on aws_secretsmanager_secret.jwt

Ensure Secrets Manager secrets should have automatic rotation enabled on aws_secretsmanager_secret.oidc

Ensure that ALB drops HTTP headers on aws_lb.gateway

Ensure that CloudWatch Log Group is encrypted by KMS on aws_cloudwatch_log_group.gateway

Ensure that ECR repositories are encrypted using KMS on aws_ecr_repository.repo

Ensure that enhanced monitoring is enabled for Amazon RDS instances on aws_db_instance.db

Ensure that HEALTHCHECK instructions have been added to container images on /examples/gateway/aws/Dockerfile.

Ensure that HEALTHCHECK instructions have been added to container images on /examples/gateway/gcp/Dockerfile.

Ensure that private_ip_google_access is enabled for Subnet on google_compute_subnetwork.subnet

Ensure that RDS instances have Multi-AZ enabled on aws_db_instance.db

Ensure that RDS instances have performance insights enabled on aws_db_instance.db

Ensure that respective logs of Amazon Relational Database Service (Amazon RDS) are enabled on aws_db_instance.db

Ensure that Secrets Manager secret is encrypted using KMS CMK on aws_secretsmanager_secret.postgres_url

Ensure that Secrets Manager secret is encrypted using KMS CMK on aws_secretsmanager_secret.jwt

Ensure that Secrets Manager secret is encrypted using KMS CMK on aws_secretsmanager_secret.oidc

Ensure that VPC Flow Logs is enabled for every subnet in a VPC Network on google_compute_subnetwork.subnet

Ensure the ELBv2 (Application/Network) has access logging enabled on aws_lb.gateway

Ensure the GCP PostgreSQL database log levels are set to ERROR or lower on google_sql_database_instance.db

Ensure top-level permissions are not set to write-all on on(Claude Issue Triage)

Ensure top-level permissions are not set to write-all on on(Log Issue Events to Statsig)

Ensure top-level permissions are not set to write-all on on(Claude Code)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Possible hardcoded secret assigned to a credential-like variable. Move it to a secret store / env var. (First-party socbox rule; Apache-2.0.)

Automated backups are not enabled by default. Backups are an easy way to restore data in a corruption or data-loss scenario.

Logging checkpoints provides useful diagnostic data, which can identify performance issues in an application and potential DoS vectors.

Logging connections provides useful diagnostic data such as session length, which can identify performance issues in an application and potential DoS vectors.

Logging disconnections provides useful diagnostic data such as session length, which can identify performance issues in an application and potential DoS vectors.

Lock waits are often an indication of poor performance and often an indicator of a potential denial of service vulnerability, therefore occurrences should be logged for analysis.

RDS backup retention for clusters defaults to 1 day, this may not be enough to identify and respond to an issue. Backup retention periods should be set to a period that is a balance on cost and limiting risk.

Ensure IAM Database Authentication is enabled for RDS database instances to manage database access

Temporary files are not logged by default. To log all temporary files, a value of `0` should set in the `log_temp_files` flag - as all files greater in size than the number of bytes set in this flag will be logged.