https://cybertoolchain.io/tools/checkov New releases and features in Checkov, tracked by The Cyber Toolchain. en Sun, 25 Jan 2026 23:02:15 GMT https://github.com/bridgecrewio/checkov/releases/tag/3.2.499 https://github.com/bridgecrewio/checkov/releases/tag/3.2.499 Sun, 25 Jan 2026 23:02:15 GMT Checkov 3.2.499 adds `BC_CA_BUNDLE` env var for custom CAs and allows secrets checks to be overridden by cortex specific logic • Adds `BC_CA_BUNDLE` environment variable support for custom CA certificates • Secrets: Override AWS generic check with cortex specific checks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.466 https://github.com/bridgecrewio/checkov/releases/tag/3.2.466 Mon, 25 Aug 2025 23:01:49 GMT Adds `aws_vpc_endpoint` to RESOURCE_TYPES_JSONIFY for expanded Terraform resource support • Adds `aws_vpc_endpoint` to the `RESOURCE_TYPES_JSONIFY` set in Checkov 3.2.466 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.424 https://github.com/bridgecrewio/checkov/releases/tag/3.2.424 Thu, 15 May 2025 23:01:51 GMT Checkov 3.2.424 adds a new SNS check for Terraform resources • Adds `sns` check to Terraform resource scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.422 https://github.com/bridgecrewio/checkov/releases/tag/3.2.422 Wed, 14 May 2025 23:01:29 GMT Checkov 3.2.422 adds `--check-secrets-commit-list` to scan secrets in a specific list of Git commits • Adds support for scanning secrets by providing a specific list of Git commit hashes via the new `--check-secrets-commit-list` CLI flag. • Excludes `__start_line__` and `__end_line__` from the 'is empty' solver in secrets detection. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.420 https://github.com/bridgecrewio/checkov/releases/tag/3.2.420 Tue, 13 May 2025 23:01:46 GMT Checkov 3.2.420 adds programmatic access to kustomize resource IDs via a new exported function. • `kustomize.resource_id` is now exposed as an exported function, enabling callers to retrieve the Kustomize resource ID programmatically. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.411 https://github.com/bridgecrewio/checkov/releases/tag/3.2.411 Mon, 28 Apr 2025 23:01:38 GMT Checkov 3.2.411 adds Git history secrets scanning and expands CKV2_AWS_5 coverage • Adds support for producer consumer patterns in Git history secrets scanning. • Extends CKV2_AWS_5 to cover `aws_elasticache_serverless_cache`. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.408 https://github.com/bridgecrewio/checkov/releases/tag/3.2.408 Thu, 24 Apr 2025 23:01:51 GMT Checkov 3.2.408 adds a new Terraform and CloudFormation detection for overly permissive Lambda CORS configurations. • Adds `LambdaCorsOverlyPermissive` check to detect overly permissive Lambda CORS configurations in Terraform and CloudFormation templates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.390 https://github.com/bridgecrewio/checkov/releases/tag/3.2.390 Wed, 19 Mar 2025 23:01:28 GMT Checkov 3.2.390 adds raw Terraform resource nodes to the internal dependency graph • `terraform` module now includes raw tf resources in the build graph Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.383 https://github.com/bridgecrewio/checkov/releases/tag/3.2.383 Tue, 11 Mar 2025 23:01:37 GMT Checkov 3.2.383 adds tags enrichment for Serverless scans • Adds tags enrichment to serverless Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.377 https://github.com/bridgecrewio/checkov/releases/tag/3.2.377 Tue, 25 Feb 2025 23:01:30 GMT Checkov 3.2.377 adds three new Terraform policies. • Adds three new Terraform policy rules with associated tests to enhance cloud security coverage. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.357 https://github.com/bridgecrewio/checkov/releases/tag/3.2.357 Thu, 23 Jan 2025 23:01:46 GMT Checkov 3.2.357 adds initial support for Python 3.13 • Adds initial support for running on Python 3.13 Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.355 https://github.com/bridgecrewio/checkov/releases/tag/3.2.355 Wed, 22 Jan 2025 23:01:47 GMT Adds OIDC claims analysis checks for GCP and Azure alongside AWS CKV_AWS_358 update. • Adds `CKV_GCP_125` detection for OIDC claims in GCP terraform resources • Adds `CKV_AZURE_249` detection for OIDC claims in Azure terraform resources • Updates `CKV_AWS_358` rule to enhance OIDC claims analysis for AWS Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.350 https://github.com/bridgecrewio/checkov/releases/tag/3.2.350 Tue, 07 Jan 2025 23:01:32 GMT Checkov 3.2.350 adds CKV_AZURE_248 detection for Azure Batch Account network access restrictions • Adds `CKV_AZURE_248` check to enforce Azure Batch Account network access restriction Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.345 https://github.com/bridgecrewio/checkov/releases/tag/3.2.345 Tue, 31 Dec 2024 23:01:25 GMT Checkov 3.2.345 adds sensitive param detection in CloudFormation, HTTP proxy support for Terraform scans, and a new Azure Cognitive Services detection. • Adds CKV_AZURE_1234 detection rule that flags Azure Cognitive Services resources with unrestricted outbound network access Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.342 https://github.com/bridgecrewio/checkov/releases/tag/3.2.342 Wed, 18 Dec 2024 23:01:53 GMT Checkov 3.2.342 adds serverless definitions context/graph integration and a Terraform block check • Adds serverless definitions context for serverless resources • Integrates a serverless graph to support relationship-based analysis • Adds a new `terraform` block check capability Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.336 https://github.com/bridgecrewio/checkov/releases/tag/3.2.336 Mon, 16 Dec 2024 23:01:31 GMT Checkov 3.2.336 adds cortex:skip for suppressions • Adds `cortex:skip` annotation to allow suppressions in Checkov scans Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.334 https://github.com/bridgecrewio/checkov/releases/tag/3.2.334 Sun, 08 Dec 2024 23:01:29 GMT Adds Serverless graph vertices for infrastructure analysis • Adds serverless graph vertices to enable node-level analysis of serverless resources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.332 https://github.com/bridgecrewio/checkov/releases/tag/3.2.332 Thu, 05 Dec 2024 23:01:49 GMT Checkov 3.2.332 adds multi-skip inline suppression for Terraform and a new Bedrock check. • Adds support for multi-line skip comments to suppress multiple Checkov checks in Terraform configurations • Introduces a new detection rule for AWS Bedrock resources Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.326 https://github.com/bridgecrewio/checkov/releases/tag/3.2.326 Mon, 02 Dec 2024 23:03:06 GMT Adds new CIDR operator for resource ID generation in ARM templates • Adds new `cidr` operator to enable CIDR-based logic in ARM template resource IDs Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.322 https://github.com/bridgecrewio/checkov/releases/tag/3.2.322 Thu, 28 Nov 2024 23:02:01 GMT Checkov 3.2.322 updates range value handling logic • Updates internal range logic to handle range values correctly Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.317 https://github.com/bridgecrewio/checkov/releases/tag/3.2.317 Tue, 26 Nov 2024 23:01:46 GMT Checkov 3.2.317 adds support for the Terraform resource_type attribute in rule evaluations • Adds `resource_type` attribute support for Terraform resources to enable rule logic targeting specific resource types Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.305 https://github.com/bridgecrewio/checkov/releases/tag/3.2.305 Tue, 19 Nov 2024 23:01:46 GMT Checkov 3.2.305 adds Java full dependency tree scanning and a new AWS CodeGuru CMK check • Adds `sca` support for Java full dependency tree scan Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.300 https://github.com/bridgecrewio/checkov/releases/tag/3.2.300 Sun, 17 Nov 2024 23:01:25 GMT Checkov 3.2.300 adds Azure Synapse ARM policies and enables secrets file masking • `EnrichedSecret` class now includes the `check_id` field, allowing downstream processing to identify which specific policy triggered a secret detection • Added support for new security policies covering Azure Synapse ARM templates • Helm and Kustomize resources now utilize the Kubernetes graph registry for improved dependency analysis Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.296 https://github.com/bridgecrewio/checkov/releases/tag/3.2.296 Thu, 14 Nov 2024 23:01:47 GMT Checkov 3.2.296 adds Fn::Sub support for CloudFormation pseudo parameters and a Terraform resource_type attribute • `cloudformation`: Support `Fn::Sub` in cases of using a pseudo parameter Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.293 https://github.com/bridgecrewio/checkov/releases/tag/3.2.293 Wed, 13 Nov 2024 23:01:33 GMT Adds `resource_type` attribute support for Terraform resources in Checkov 3.2.293 • `terraform`: adds support for the `resource_type` attribute to resource models and checks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.286 https://github.com/bridgecrewio/checkov/releases/tag/3.2.286 Sun, 10 Nov 2024 23:01:32 GMT Checkov 3.2.286 adds an npm secret detector for scanning package dependencies. • `npm` detector is now available in the secrets engine Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.275 https://github.com/bridgecrewio/checkov/releases/tag/3.2.275 Wed, 30 Oct 2024 23:02:03 GMT Checkov 3.2.275 adds ARM definition context to improve Azure resource scanning depth • Adds `arm` definition context support, enabling deeper inspection of ARM template structures. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.270 https://github.com/bridgecrewio/checkov/releases/tag/3.2.270 Mon, 28 Oct 2024 23:01:24 GMT Checkov 3.2.270 adds ARM graph edges and custom policy support • Adds variable and parameters edges and rendering for ARM templates. • Enables custom policy support for Azure Resource Manager (ARM) templates. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.262 https://github.com/bridgecrewio/checkov/releases/tag/3.2.262 Mon, 14 Oct 2024 23:01:44 GMT Checkov 3.2.262 adds two new Terraform checks for S3 data transport • Adds 2 new Terraform checks for S3 data transport Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.256 https://github.com/bridgecrewio/checkov/releases/tag/3.2.256 Tue, 01 Oct 2024 23:01:28 GMT Checkov 3.2.256 adds new Terraform checks • Extends CKV2_AWS_5 to include DMS Serverless resources. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.253 https://github.com/bridgecrewio/checkov/releases/tag/3.2.253 Thu, 12 Sep 2024 23:01:39 GMT Checkov 3.2.253 adds a custom `--name` flag for scan runs. • Adds `--name` CLI argument to customize the tool name field in output metadata Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.245 https://github.com/bridgecrewio/checkov/releases/tag/3.2.245 Wed, 04 Sep 2024 23:01:27 GMT Checkov 3.2.245 adds git-sync injection detection policy and terraform_plan provider support. • `kubernetes`: Adds a new policy to detect code injection via `git-sync` sidecar containers • `terraform_plan`: Enables provider resolution during evaluation of Terraform plan JSON files Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.238 https://github.com/bridgecrewio/checkov/releases/tag/3.2.238 Tue, 27 Aug 2024 23:01:31 GMT Checkov 3.2.238 adds support for TF cloudsplaining evaluated_keys • Adds `evaluated_keys` to terraform's TF cloudsplining integration Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.234 https://github.com/bridgecrewio/checkov/releases/tag/3.2.234 Tue, 20 Aug 2024 23:02:21 GMT Checkov 3.2.234 adds SAST scanning support on Windows. • Adds Windows support for SAST scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.228 https://github.com/bridgecrewio/checkov/releases/tag/3.2.228 Thu, 15 Aug 2024 23:01:35 GMT Adds `--skip-build-policy` logic for API methods lacking auth in Checkov 3.2.228 • Enables matching Terraform build policies to run policies specifically for API Gateway methods without authentication Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.219 https://github.com/bridgecrewio/checkov/releases/tag/3.2.219 Mon, 05 Aug 2024 23:01:26 GMT Checkov 3.2.219 adds multi-framework support in custom policies and a new RDS encryption-in-transit run policy. • Supports multiple frameworks in one custom policy Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.213 https://github.com/bridgecrewio/checkov/releases/tag/3.2.213 Mon, 29 Jul 2024 23:01:42 GMT Checkov adds CKV_AZURE_212 detection for ARM AppServiceInstanceMinimum and CKV_AWS check for AWS Bedrock Agent encryption with CMK • Adds `CKV_AZURE_212` detection for ARM AppServiceInstanceMinimum resource configuration • Adds Terraform and CloudFormation policy to ensure AWS Bedrock Agent is encrypted with a Customer Managed Key (CMK) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.208 https://github.com/bridgecrewio/checkov/releases/tag/3.2.208 Thu, 25 Jul 2024 23:02:36 GMT Adds `--filter-by-provider` capability and multiple metadata value support • Adds the ability to filter resources by provider across all resource types (PR #6598) • Updates CKV_SECRET_192 check to include GENERIC_PRIVATE_KEY_CHECK_IDS for broader secret detection coverage Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.204 https://github.com/bridgecrewio/checkov/releases/tag/3.2.204 Wed, 24 Jul 2024 23:01:40 GMT Checkov 3.2.204 adds CKV_AZURE_191 detection for Azure Event Grid Topic managed identity. • Adds `CKV_AZURE_191` check to detect when the Managed Identity provider is not enabled for Azure Event Grid Topics. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.201 https://github.com/bridgecrewio/checkov/releases/tag/3.2.201 Tue, 23 Jul 2024 23:01:37 GMT Checkov 3.2.201 adds 14 new Terraform rules for the TencentCloud provider • Adds 14 new detection rules for the tencentcloud Terraform provider in `terraform` scanning Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.199 https://github.com/bridgecrewio/checkov/releases/tag/3.2.199 Mon, 22 Jul 2024 23:01:31 GMT Checkov 3.2.199 adds Azure Defender and VNet DNS checks plus prereun for secrets • Adds ARM VnetSingleDNSServer check to Validate virtual network single DNS server configuration. • Adds Azure key vault `prereun` option in secrets config to execute logic before multiline pattern scanning. • Adds new CKV_AZURE_87 detection to ensure Azure Defender is On for Key Vault. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.196 https://github.com/bridgecrewio/checkov/releases/tag/3.2.196 Sun, 21 Jul 2024 23:01:35 GMT Checkov 3.2.196 adds a metadata exception filter for GitHub Actions workflows. • Adds `metadata` exception filter to GHA action • Refactors resource type handling internally Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.194 https://github.com/bridgecrewio/checkov/releases/tag/3.2.194 Thu, 18 Jul 2024 23:01:57 GMT Checkov 3.2.194 adds ARM checks for AKSEncryptionAtHostEnable, AKSEphemeralOSDisks, and managed disks. • Adds `AKSEncryptionAtHostEnable` rule for Azure Resource Manager templates to check if AKS host disk encryption is enabled • Adds `AKSEphemeralOSDisks` rule for Azure Resource Manager templates to verify ephemeral OS disk usage in AKS • Adds `CKV_AZURE_92` rule for Azure Resource Manager templates ensuring Virtual Machines use managed disks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.189 https://github.com/bridgecrewio/checkov/releases/tag/3.2.189 Sun, 14 Jul 2024 23:01:23 GMT Checkov 3.2.189 adds two new ARM checks (AKS Paid SKU, Windows VM auto-updates) and updates CloudFormation audit_logs values • Adds `CKV_AZURE_169` to enforce AKS clusters use the Paid SKU for SLA compliance • Adds `CKV_AZURE_177` to ensure Windows VMs have automatic updates enabled • Updates valid values for `audit_logs` in CloudFormation template checks Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.186 https://github.com/bridgecrewio/checkov/releases/tag/3.2.186 Thu, 11 Jul 2024 23:02:24 GMT Checkov 3.2.186 adds Azure Synapse policies and Bicep custom policy support • `bicep_custom_policy_dir` config key to load custom policies for Bicep files • New detection rules covering Azure Synapse resources in Terraform (`*.tf`) and ARM templates (`*.json`) Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.183 https://github.com/bridgecrewio/checkov/releases/tag/3.2.183 Wed, 10 Jul 2024 23:01:35 GMT Checkov 3.2.183 adds tf_plan after_unknown enrichment for terraform_plan analysis. • `terraform_plan` now supports `after_unknown` field enrichment from Terraform plan files. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.179 https://github.com/bridgecrewio/checkov/releases/tag/3.2.179 Tue, 09 Jul 2024 23:01:33 GMT Checkov 3.2.179 adds new Azure ARM checks for storage replication and Synapse Analytics policies. • Adds `CKV_AZURE_206` to enforce that Azure Storage Accounts use replication • Adds `BCE-33785` check to validate Azure Synapse Analytics policies Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.174 https://github.com/bridgecrewio/checkov/releases/tag/3.2.174 Thu, 04 Jul 2024 23:01:30 GMT Checkov 3.2.174 adds seven new Azure Resource Manager detection checks for AKS, API Management, App Service Plan, Azure Search, SQL Database, and Azure Synapse. • Adds `CKV_AZURE_172` check to ensure autorotation of Secrets Store CSI Driver secrets for AKS clusters • Adds `CKV_AZURE_173` check to ensure API Management uses at least TLS 1.2 • Adds `AppServicePlanZoneRedundant` check for ARM templates • Adds `AzureSearchSLAIndex` check for ARM templates • Adds `SQLDatabaseZoneRedundant` check for ARM templates • Adds new policies for Azure Synapse in the azure detector Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.171 https://github.com/bridgecrewio/checkov/releases/tag/3.2.171 Wed, 03 Jul 2024 23:01:42 GMT Checkov 3.2.171 adds eight new ARM/Azure security checks (CKV_AZURE and rule IDs) • Adds `CKV_AZURE_171` check for AKS cluster upgrade channel selection • Adds `CKV_AZURE_175` check for Web PubSub SKU with SLA • Adds `CKV_AZURE_178` check for Linux VM SSH key configuration • Adds `CKV_AZURE_85` check for Azure Defender status on Kubernetes • Adds `CKV_AZURE_99` check for Cosmos DB restricted access • Adds `DataFactoryNoPublicNetworkAccess` check for Data Factory public network access • Adds `DataLakeStoreEncryption` check for Data Lake Store encryption • Adds `EventHubNamespaceMinTLS12` check for Event Hub Namespace minimum TLS version Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov https://github.com/bridgecrewio/checkov/releases/tag/3.2.163 https://github.com/bridgecrewio/checkov/releases/tag/3.2.163 Mon, 01 Jul 2024 23:02:03 GMT Checkov v3.2.163 adds new ARM checks for API Management public access, App Service PHP version and public access, Key Vault purge protection, and Pub/Sub identity. • Adds `CKV_AZURE_174` check to enforce Azure API Management public access is disabled • Adds `AppServicePHPVersion` check for Azure Resource Manager (ARM) templates • Adds `AppServicePublicAccessDisabled` check for Azure App Service in ARM templates • Adds `KeyVaultEnablesPurgeProtection` check for Azure Key Vault in ARM templates • Adds `PubsubSpecifyIdentity` check for Pub/Sub identity in ARM templates Full history on Cyber Toolchain: https://cybertoolchain.io/tools/checkov