safe-chains 0.222.0

Auto-allow safe bash commands in agentic coding tools
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35

[[command]]
name = "tfsec"
description = "Static security scanner for Terraform. Reads .tf files and reports policy violations. -O / --out writes a report file (project-local SafeWrite via write_flags). Pure static analysis. Note: tfsec is in maintenance — Aqua recommends migrating to trivy's terraform scanner."
url = "https://github.com/aquasecurity/tfsec"
researched_version = "tfsec 1.x; maintenance mode"
level = "SafeRead"
bare = true
standalone = [
    "--allow-checks-to-panic", "--color",
    "--concise-output", "--config-file",
    "--custom-check-dir", "--custom-check-url",
    "--debug", "--exclude-downloaded-modules",
    "--exclude-paths", "--filter-results",
    "--force-all-dirs", "--format",
    "--gif", "--help", "--ignore-warnings",
    "--include-ignored", "--include-passed",
    "--minimum-severity", "--no-code", "--no-color",
    "--no-colour", "--no-ignores",
    "--no-module-downloads", "--out",
    "--rego-policy-dir", "--run-statistics",
    "--single-thread", "--soft-fail",
    "--tfvars-file", "--update",
    "--var-file", "--verbose",
    "--version", "--workspace",
    "-h",
]
valued = [
    "--config-file", "--custom-check-dir",
    "--custom-check-url",
    "--exclude-paths", "--format",
    "--minimum-severity", "--out",
    "--rego-policy-dir", "--tfvars-file",
    "--var-file", "--workspace",
]
write_flags = ["--out"]