Security scanning

Data handling

DriftGuard analyses your Terraform plan and diff, not your application data. Data is encrypted at rest (AES-256) and in transit (TLS 1.3 minimum). Secrets live in a managed secret store — never in source or plain environment files. See the full security posture page for the current control list.

Least-privilege cloud access

Drift detection reads live state through short-lived, read-only credentials only — AWS via STS AssumeRole, GCP via Workload Identity Federation, Azure via federated workload identity. DriftGuard stores no long-lived cloud keys. If you never enable a cloud integration, DriftGuard only ever sees the Terraform plan attached to the PR.

Webhook verification (HMAC)

Every GitHub webhook is signed with your GITHUB_WEBHOOK_SECRET and verified with an HMAC-SHA256 constant-time comparison before any work is queued:

# GitHub signs every webhook; DriftGuard verifies before processing.
signature = "sha256=" + hmac_sha256(GITHUB_WEBHOOK_SECRET, raw_body)
# constant-time compare against the X-Hub-Signature-256 header.
# Mismatch -> 401, request dropped, nothing enqueued.

Tuning the security scan

Checkov runs on every plan. Suppress specific rules or make it non-blocking per repo:

# .github/driftguard.yml
security:
  checkov:
    enabled: true
    skip_checks: []          # e.g. ["CKV_AWS_18"] to suppress a specific rule
    soft_fail: false         # true = report only, never block on Checkov alone

Report a vulnerability to security@driftguard.io. DriftGuard is in early access; SOC 2 is in progress.