Audit your Kubernetes manifest.

A YAML that deploys fine can still hand an attacker the node. Paste your Deployment or Pod manifest and get a security audit — privileged, hostPath, runAsRoot, missing limits, :latest, dangerous capabilities — each with the fix.

Deploys fine, owns the node

Kubernetes will happily run an insecure pod. A privileged: true, a hostPath mounting the node filesystem, a container running as root with no resource limits — none of it errors, and all of it widens the blast radius from “one compromised app” to “the node, and maybe the cluster.” These are the defaults people copy from a tutorial and never revisit. This catches the common ones in seconds, with the one-line fix.

Catching it once in a manifest is the start; keeping it caught across every workload and every cluster, and proving the posture held, is the standing job — the kind of continuous, inspectable control a control plane gives you over the infrastructure you run.