KICS

No entries match these filters. Clear filters

1. v2.2.0 Sep 17, 2026 · issue 077

   KICS v2.2.0 adds Synapse managed VNetVNetA private, isolated network hosted inside Microsoft Azure that lets virtual machines and services communicate with each other and with the internet under user-defined IP ranges and routing rules. queries for Terraform and ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware., and removes the --disable-full-descriptions flag.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.2.0 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.2.0

   • Adds new Synapse Workspace Managed Virtual Network Not Enabled queries for Terraform (azurerm_synapse_workspace resource, managed_virtual_network_enabled field) and Azure Resource Manager (Microsoft.Synapse/workspaces resource, managedVirtualResource field) to detect when managed virtual network isolation is disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Removes the --disable-full-descriptions CLI flag along with the pkg/descriptions package it backed.
   • Adds new Synapse Workspace Managed Virtual Network Not Enabled queries for Terraform (azurerm_synapse_workspace resource, managed_virtual_network_enabled field) and Azure Resource Manager (Microsoft.Synapse/workspaces resource, managedVirtualResource field) to detect when managed virtual network isolation is disabled.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

   └──▷ BREAKING ON UPGRADE

   • !The --disable-full-descriptions flag has been removed; any scan command or script that passes this flag will now fail.
2. v2.1.20 Mar 3, 2026 · release notes

   New beta queries for Azure ACR permissions, storage encryption, AKSAKSAzure Kubernetes Service, Microsoft's managed Kubernetes offering, which lets cyber tools offload cluster provisioning and scaling to Azure so engineers focus on workload logic instead of control-plane operations. auditing, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. clusters and managed identity

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.20 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.1.20

   • Implements Beta - Azure Container Registry With Broad Permissions query
   • Implements Beta - Storage Account Without CMK query
   • Adds TLS 1.2+ verification for Terraform/Azure
   • Implements Beta - AKS Without Audit Logs query
   • Adds alpha cluster detection for Google Kubernetes Engine clusters

   +5 more show less

   • Implements Beta - Cluster Without Network Policy Support query
   • Ensures GKE version management uses release channels
   • Checks if managed identity is not enabled (Azure)
   • Enables integrity monitoring checks for Shielded GKE Nodes
   • Adds check for disabled Kubernetes Web UI

   10 details in Everything

3. v2.1.19 Jan 7, 2026 · release notes

   Adds private virtual network query for Azure container instances and new Beta queries for Terraform/Azure

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.19 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.1.19

   • feat(query): new query that ensures that container instances are using private virtual networks for terraform/azure
   • feat(query): 6 new Beta queries and fixes for "Azure Instance Using Basic Authentication" - terraform/azure

   2 details in Everything

4. v2.1.18 Dec 18, 2025 · release notes

   KICS v2.1.18 adds ~30 new Terraform queries for Azure/GCP compliance and optimizes engine performance with directory caching.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.18 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.1.18

   • Optimizes the Terraform parser with directory caching and LOC-based memory calculation to improve scan performance on large IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. repositories
   • Adds Beta - Activity Log Alert For Create Policy Assignment Not Configured query for Terraform/Azure
   • Adds Beta - Activity Log Alert For Delete Policy Assignment Not Configured query for Terraform/Azure
   • Adds ensure critical contacts is configured for organization query for Terraform/GCP
   • Adds Beta - Activity Log Alert For Create Or Update Network Security Group Not Configured query for Terraform/Azure

   +35 more show less

   • Adds Beta - Activity Log Alert For Delete Network Security Group Not Configured query for Terraform/Azure
   • Adds Beta - Activity Log Alert For Create or Update Security Solution Not Configured query for Terraform/Azure
   • Adds Beta - Activity Log Alert For Delete Security Solution Not Configured query for Terraform/Azure
   • Adds Beta - Activity Log Alert For Create or Update SQL Server Firewall Rule Not Configured query for Terraform/Azure
   • Adds Beta - Activity Log Alert For Delete SQL Server Firewall Rule Not Configured query for Terraform/Azure
   • Adds Beta - Activity Log Alert For Create or Update Public IP Address Rule Not Configured query for Terraform/Azure
   • Adds Beta - Activity Log Alert For Delete Public IP Address Rule Not Configured query for Terraform/Azure
   • Adds Beta - File Share Without Soft Delete query for Terraform/Azure
   • Adds Beta - Storage Account Not Using Latest SMB Protocol Version query for Terraform/Azure
   • Adds Beta - Storage Account Using Unsafe SMB Channel Encryption query for Terraform/Azure
   • Adds Beta - Blob Storage Without Soft Delete query for Terraform/Azure
   • Adds Beta - Storage Account With Shared Access Key query for Terraform/Azure
   • Adds Beta - Containers Without Soft Delete query for Terraform/Azure
   • Adds Beta - Storage Account With Cross Tenant Replication Enabled query for Terraform/Azure
   • Adds Beta - Storage Account Without Delete Lock query for Terraform/Azure
   • Adds Beta - Activity Log Alert For Service Health Not Configured query for Terraform/Azure
   • Adds Beta - Service Without Resource Logging query for Terraform/Azure
   • Adds new query "Beta - Databricks Workspace Without CMK" for Terraform/Azure
   • Adds Beta - Logs And Alerts Missing Project Ownership Assignment And Changes query for Terraform/Azure
   • Adds Beta - Logs And Alerts Missing Audit Configuration Changes query for Terraform/Azure
   • Adds Beta - Logs And Alerts Missing Custom Role Changes query for Terraform/GCP
   • Adds Beta - Resource Without Diagnostic Settings query for Terraform/Azure
   • Adds Beta - Diagnostic Settings Without Appropriate Logging query for Terraform/Azure
   • Adds Beta - Databricks Diagnostic Logging Unconfigured query for Terraform/Azure
   • Adds Beta - Cloud Asset Inventory Disabled query for Terraform/GCP
   • Adds ensure Legacy Networks Do Not Exist For Older Project query for Terraform/GCP
   • Adds Beta - Backup Vault Without Soft Delete query for Terraform/Azure
   • Adds Beta - Backup Vault Without Immutability query for Terraform/Azure
   • Adds Beta - Recovery Services Vault Without Soft Delete query for Terraform/Azure
   • Adds query checking user access administrator is not restricted for Terraform/Azure
   • Adds Beta - Recovery Services Vault Without Immutability query for Terraform/Azure
   • Adds Beta - Recovery Services Vault With Public Network Access query for Terraform/Azure
   • Adds query Beta - Key Vault Purge Protection Is Enabled for Terraform/Azure
   • Adds Beta - VM Without Managed Disk query for Terraform/Azure
   • Adds Beta - SQL Database Without Data Encryption query for Terraform/Azure

   40 details in Everything

5. v2.1.17 Dec 2, 2025 · release notes

   KICS v2.1.17 adds three Beta queries for SQL logging thresholds and Databricks networking

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.17 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.1.17

   • Adds Beta - SQL DB Instance With Unrecommended Logging Threshold query for detecting misconfigured database logging.
   • Adds Beta - SQL DB Instance With Unrecommended Error Logging Threshold query to identify databases with inappropriate error logging levels.
   • Adds Beta - Databricks Workspace Using Default Virtual Network query covering Terraform/Azure configurations.

   3 details in Everything

6. v2.1.15 Oct 24, 2025 · release notes

   Adds risk score values to queries and results summaries in logs

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.15 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.1.15

   • Adds a riskScore field to all query objects for prioritization
   • Adds results and queries summaries to the log output

   2 details in Everything

7. v2.1.14 Sep 23, 2025 · release notes

   KICS v2.1.14 adds over 15 new detection queries for AWS, Azure, and Kubernetes

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.14 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.1.14

   └──▷ TRY IT
   Scan infrastructure code to find AWS EKSEKSAmazon's managed Kubernetes service, run by AWS, that handles control-plane provisioning so teams can deploy containerized workloads without operating the underlying cluster infrastructure themselves. clusters missing encryption configuration.
   copy

   $ kics scan --path ./infrastructure/ --query-id eks_cluster_encryption_disabled

   Detect IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies in Terraform code that may allow data exfiltrationdata exfiltrationMoving data out of a system or organization without authorization. It can happen through network transfers, removable media or other channels. risks.
   copy

   $ kics scan --path ./terraform/ --query-id iam_policy_allows_for_data_exfiltration

   Find ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. services assigned with public IP addresses in Terraform, Ansible, or CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. projects.
   copy

   $ kics scan --path ./src/ --query-id ecs_services_assigned_with_public_ip_address

   • Adds ElasticSearch Without Audit Logs query detection (CloudFormation/AWS)
   • Adds iam policy allows for data exfiltration query detection (Terraform/AWS, CloudFormation/AWS)
   • Adds ecr_repository_not_encrypted_with_CMK query detection (CloudFormation/AWS)
   • Adds Redshift_Cluster_Without_VPC query detection (CloudFormation/AWS)
   • Adds EKS Cluster Encryption Disabled query detection (CloudFormation/AWS)

   +14 more show less

   • Adds lambda function without dead letter queue query detection (Terraform/AWS)
   • Adds ECS Services assigned with public IP address query detection (Ansible/AWS, Terraform/AWS, CloudFormation/AWS)
   • Adds Instance Uses Metadata Service IMDSv1 query detection (Terraform/AWS, Ansible/AWS, CloudFormation/AWS)
   • Adds elasticsearch domain encryption should be enabled node to node query detection (CloudFormation/AWS)
   • Adds DAX_Cluster_Not_Encrypted query detection (CloudFormation/AWS)
   • Adds aws eip not attached to any ec2 instance query detection (Terraform/AWS)
   • Adds S3_Bucket_Notifications_Disabled query detection (Terraform/AWS)
   • Adds Neptune_Logging_Is_Disabled query detection (CloudFormation/AWS)
   • Adds tags not copied to rds cluster snapshot query detection (Terraform/AWS, CloudFormation/AWS)
   • Adds Postgres_RDS_Logging_Disabled query detection (Terraform/AWS)
   • Adds ELBv2_LB_Access_Log_Disabled query detection (Terraform/AWS)
   • Adds Secretmanager Secret Without KMS query detection (CloudFormation/AWS)
   • Adds IAM DB Cluster Auth Not Enabled query detection (Terraform/AWS, CloudFormation/AWS)
   • Adds support for folder-based query test cases via the new test structure

   19 details in Everything

8. v2.1.9 May 27, 2025 · release notes

   KICS v2.1.9 adds a blacklist to the Analyzer to exclude FHIR files.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.9 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.1.9

9. v2.1.7 Apr 21, 2025 · release notes

   KICS v2.1.7 adds support for nested HCL identifier parsing in Terraform queries.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.1.7 https://github.com/Checkmarx/kics.git
   # already have the repo? check out this version:
   $ git checkout v2.1.7

10. v2.1.4 Jan 22, 2025 · release notes

    Adds a new QueryID pattern to the engine.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.4 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v2.1.4

11. v2.1.3 Oct 1, 2024 · release notes

    KICS v2.1.3 adds CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. information to SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. reports and updates query metadata for multiple platforms.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.3 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v2.1.3

    • Adds CWE information field to SARIF report output generated by the scanner
    • Updates Nifcloud query metadata and functionality in the scanning engine

    2 details in Everything

12. v2.1.1 Jul 1, 2024 · release notes

    Adds new detection queries for TencentCloud CVM, VPCVPCA logically isolated virtual network inside a public cloud provider's infrastructure, letting tools deploy resources with private addressing, controlled routing, and firewall rules without managing physical hardware., TKE, CDB, and CLB resources.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v2.1.1

    • Adds tencentcloud query support for CVM (Compute Virtual Machine) resources
    • Adds tencentcloud query support for VPC (Virtual Private Cloud) resources
    • Adds tencentcloud query support for TKE (Tencent Kubernetes Engine) resources
    • Adds tencentcloud query support for CDB (Cloud Database) resources
    • Adds tencentcloud query support for CLB (Cloud Load Balancer) resources

    5 details in Everything

13. v2.1.0 Jun 12, 2024 · release notes

    KICS v2.1.0 adds Bicep support, --max-resolver-depth flag, and improves similarity IDs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.1.0 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v2.1.0

    • Adds bicep language support for infrastructure-as-code scanning
    • Adds --max-resolver-depth CLI flag to control template resolution depth
    • Improves similarity ID generation for better duplicate detection

    3 details in Everything

14. v2.0.1 May 2, 2024 · release notes

    Adds govulncheck and grype integration to the GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. cyber tool

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v2.0.1

    • feat(githubactions): adding govulncheck and grype

    1 detail in Everything

15. v2.0.0 Apr 17, 2024 · release notes

    KICS v2.0.0 adds a critical severity level to scans and all report formats.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v2.0.0 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v2.0.0

    └──▷ USE IT
    Filter scan results to only show critical findings for rapid triage.
    shell copy

    kics scan -p /path/to/code --output-format json | jq '.results[] | select(.severity == "critical")'

    View the new critical severity alongside high/medium/low in standard reports.
    shell copy

    kics scan -p /path/to/code --output-format sarif

    • critical added as a new severity level in the KICS CLI engine
    • critical severity output supported in all report formats

    2 details in Everything

16. v1.7.13 Feb 29, 2024 · release notes

    KICS v1.7.13 adds parallel scanning via --parallel flag and CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances. data in SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface./report output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.13 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.13

    └──▷ USE IT
    Scan infrastructure code in parallel to reduce execution time for large repositories.
    shell copy

    kics scan --path . --parallel true

    Generate a SARIF report that includes CWE identifiers for each finding, useful for tools consuming the report.
    shell copy

    kics scan --path . --output-format sarif --output-path findings.sarif

    • Adds --parallel flag to enable parallel scanning capability
    • Includes CWE information in the --output-format sarif output and KICS CLI results
    • Updates CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. report format support to version 1.5
    • Adds new Terraform queries for NifCloud, Tencent Cloud CBS encrypted disks, CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. DynamoDB/Table Point In Time Recovery/ECSECSElastic Common Schema, an open specification maintained by Elastic that defines a standard field naming convention for log and event data, letting cyber tools share and correlate records without per-source field mapping. Container Insights/API Gateway access logging, Pulumi ECS Container Insights, Docker Compose shared volumes/networks, Crossplane ECS Container Insights, and fixes several query definitions
    • Ignores Terraform cache folders during engine scanning

    5 details in Everything

17. v1.7.12 Dec 20, 2023 · release notes

    KICS v1.7.12 adds --max-file-size flag, NifCloud engine support, and platform field to SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.12 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.12

    └──▷ TRY IT
    Scan a directory but skip any single file larger than 10MB to prevent out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. errors or long scans.
    copy

    $ kics scan --path . --output-format json --max-file-size 10485760

    Enable NifCloud engine to scan IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. templates for NifCloud-specific misconfigurations.
    copy

    $ kics scan --path ./iac-templates --engines nifcloud,terraform

    • Adds the --max-file-size CLI flag to control the maximum file size scanned
    • Adds NifCloud engine support for scanning NifCloud infrastructure as code
    • Adds a platform field to SARIF format results output
    • Adds file reference resolution between files during analysis

    4 details in Everything

18. v1.7.11 Nov 8, 2023 · release notes

    KICS v1.7.11 introduces experimental queries feature flag and improves Ansible detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.11 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.11

    • Improves detection accuracy for Ansible files in the scan engine
    • Automatically creates a kics-queries-repo branch during release builds

    2 details in Everything

19. v1.7.8 Sep 14, 2023 · release notes

    KICS v1.7.8 adds GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow scanning and unpins SHA references in queries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.8 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.8

    • feat(engine): Added native scan support for GitHub Workflows.

    1 detail in Everything

20. v1.7.6 Aug 21, 2023 · release notes

    Adds kics analyze CLI command and parsers for Ansible inventory/configuration.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.6 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.6

    └──▷ USE IT
    Run a KICS scan using the new analyze subcommand instead of the legacy root command.
    shell copy

    kics analyze --path ./infrastructure --output-format sarif

    • Introduces the kics analyze subcommand for running scans
    • Adds parser support for Ansible inventory files
    • Adds parser support for Ansible configuration files

    3 details in Everything

21. v1.7.5 Aug 3, 2023 · release notes

    KICS v1.7.5 adds GitHub workflows for PR title validation and issue labeling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.5 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.5

    • Adds github workflow to validate pr title via .github/workflows/validate-pr-title.yml

    1 detail in Everything

22. v1.7.3 Jul 4, 2023 · release notes

    KICS v1.7.3 adds Terraform vars path support and Ignored Lines in logs

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.3 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.3

    • Add terraform vars path feature
    • feature(logs): Add Ignored Lines

    2 details in Everything

23. v1.7.2 Jun 22, 2023 · release notes

    Adds new IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. detection queries for Aurora, DynamoDB, EFS, Elasticsearch, GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure., and DMS across Terraform, CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., Pulumi, and Ansible.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.2 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.2

    • Adds Aurora With Disabled at Rest Encryption query for Terraform
    • Adds DynamoDB Table not Encrypted query
    • Adds EFS Volume With Disabled Transit Encryption query
    • Adds Elasticsearch with HTTPS disabled queries for Ansible, CloudFormation, Pulumi, and Terraform
    • Adds ec2 instance monitoring disabled query for CloudFormation

    +3 more show less

    • Adds GKE Shielded Nodes is Disabled query for Terraform
    • Adds Elasticsearch Log Disabled query
    • Adds Publicly Accessible Amazon DMS query

    8 details in Everything

24. v1.7.1 May 10, 2023 · release notes

    KICS v1.7.1 adds a query page generator to automate documentation for security queries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.7.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.7.1

25. v1.6.14 Apr 11, 2023 · release notes

    Adds --exclude-type flag for query filtering; improves security_group_rules_without_description detection coverage

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.14 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.14

    └──▷ USE IT
    Skip compliance checks you don't care about to speed up the scan or reduce noise in results.
    shell copy

    kics scan --path ./infra --exclude-type compliance

    • Adds --exclude-type flag to CLI commands to filter out specific query result types during scans
    • Enables security_group_rules_without_description detection on security_group_rule resources

    2 details in Everything

26. v1.6.13 Mar 28, 2023 · release notes

    KICS v1.6.13 adds LOC metrics to analyzer output and supports case-insensitive policy effects

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.13 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.13

    • Adds expected lines of code in analyzer output

    1 detail in Everything

27. v1.6.12 Mar 14, 2023 · release notes

    KICS v1.6.12 adds checks for legacy GCP auth in Terraform and new Azure storage and auth queries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.12 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.12

    • Adds detection of legacy authentication in Google Cloud Platform Terraform configurations via the tf-gcp-auth feature.

    1 detail in Everything

28. v1.6.11 Feb 28, 2023 · release notes

    KICS v1.6.11 adds detection for outdated GKEGKEGoogle Kubernetes Engine, Google's managed Kubernetes service, which lets cyber tools run containerized workloads without managing the underlying cluster infrastructure. versions and extracts query metadata for automation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.11 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.11

    • Adds a new Terraform security query that detects outdated Google Kubernetes Engine (GKE) cluster versions
    • Extracts categories, frameworks, and queries as structured data to enable automated catalog generation

    2 details in Everything

29. v1.6.10 Feb 13, 2023 · release notes

    KICS v1.6.10 adds a resolver for serverless file references

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.10 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.10

30. v1.6.9 Jan 31, 2023 · release notes

    Adds AWS SSOSSOSingle sign-on, using one identity provider to sign in to multiple applications. It reduces separate passwords and centralizes account and access management. security queries and SendGrid API key secrets detection

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.9 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.9

    • Adds AWS SSO security queries support to the query engine
    • Adds password and secrets detection for SendGrid API keys

    2 details in Everything

31. v1.6.8 Jan 17, 2023 · release notes

    Adds ingress IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. security group checks for Terraform AWS queries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.8 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.8

32. v1.6.7 Jan 3, 2023 · release notes

    KICS v1.6.7 adds default value checks for ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. parameters and RDS backup_retention_period

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.7 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.7

    • Adds checks for ARM parameters with default values to detect misconfigurations where defaults might bypass security policies
    • Adds a check for the backup_retention_period default value in AWS RDS instances

    2 details in Everything

33. v1.6.6 Dec 7, 2022 · release notes

    Adds Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. support for multiple GCP resources including Dataflow, Redis, Filestore, Storage Bucket, Pub/Sub, and general GCP infra in Terraform.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.6 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.6

    • Adds Bill of Materials (BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly.) data extraction for GCP Dataflow jobs defined in Terraform configurations
    • Adds BOM support for GCP Redis instances in Terraform
    • Adds BOM coverage for GCP Filestore instances in Terraform
    • Adds BOM coverage for GCP Storage Buckets
    • Adds BOM support for GCP Pub/Sub topics in both Terraform and Google Deployment Manager (GDM)

    +1 more show less

    • Extends general Bill of Materials capability to broader GCP infrastructure resources

    6 details in Everything

34. v1.6.4 Nov 9, 2022 · release notes

    KICS v1.6.4 adds CVE detection for vulnerable OpenSSL in Dockerfiles, plus Cassandra and Kinesis BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. support for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. and Terraform.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.4 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.4

    └──▷ USE IT
    Scan Dockerfiles for dependencies using outdated OpenSSL versions.
    shell copy

    kics scan -p ./Dockerfile --query-ids <id_of_new_openssl_query>

    Generate a Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. for a CloudFormation stack to identify used Cassandra and Kinesis resources.
    shell copy

    kics bom -p ./cloudformation.yml

    • Adds a new query that detects Vulnerable OpenSSL Version in Dockerfile assets
    • Extends the Bill of Materials (BOM) feature to include Apache Cassandra for CloudFormation templates
    • Adds Amazon Kinesis support to the BOM generator for both CloudFormation and Terraform resources

    3 details in Everything

35. v1.6.2 Oct 12, 2022 · release notes

    KICS v1.6.2 adds Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly.) generation for AWS RDS (CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call./Terraform) and DynamoDB.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.2 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.2

    • Adds bom support for AWS RDS resources in CloudFormation templates
    • Adds bom support for AWS RDS resources in Terraform configurations
    • Adds bom support for AWS DynamoDB resources

    3 details in Everything

36. v1.6.1 Sep 28, 2022 · release notes

    Adds --ci flag to gitlab examples and a workflow to check latest software versions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.1

    • Adds --ci flag to GitLab CI example configurations
    • Adds a new GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. workflow to check for the latest software versions

    2 details in Everything

37. v1.6.0 Sep 14, 2022 · release notes

    KICS v1.6.0 adds Kubernetes runtime scanning, Pulumi/Serverless query support, and secret masking

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • Automatically excludes paths listed in .gitignore during scan without manual flags.

    1 detail in Everything

38. v1.5.15 Aug 31, 2022 · release notes

    KICS v1.5.15 adds AWS IAMAWS IAMAWS Identity and Access Management is Amazon's service for controlling who and what can call AWS APIs, by attaching policies that allow or deny actions on resources. Cyber tools use it to scope credentials to least privilege. privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources. detection and an Azure App Service Python version query for Terraform.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.15 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.15

    • Adds aws iam privilege escalation queries to detect identity and access management misuse in AWS environments

    1 detail in Everything

39. v1.5.13 Aug 3, 2022 · release notes

    KICS v1.5.13 adds 4 new CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. queries to detect additional infrastructure misconfigurations.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.13 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.13

    • added 4 queries for CloudFormation

    1 detail in Everything

40. v1.5.12 Jul 15, 2022 · release notes

    New KICS queries for Kubernetes RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. attach permissions and Lambda invocation policies

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.12 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.12

    • Adds a new query to detect Kubernetes RBAC attach permissions in scanned infrastructure-as-code files.
    • Adds a new query to check IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. policies that allow invoking Lambda functions.

    2 details in Everything

41. v1.5.10 Jun 8, 2022 · release notes

    KICS v1.5.10 adds filesystem double-star exclusion support and includes resourceType/name in CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call./Terraform results

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.10 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.10

    • Adds ** double-star support to exclude folders in the filesystem feature
    • Adds resourceType and resourceName fields to CloudFormation queries results
    • Adds resourceType and resourceName fields to Terraform queries results

    3 details in Everything

42. v1.5.9 May 25, 2022 · release notes

    KICS v1.5.9 adds resourceType and resourceName fields to query results and an OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. file resolver.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.9 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.9

    • resourceType and resourceName fields are now included in Kubernetes query results.
    • resourceType and resourceName fields are now included in Azure Resource Management query results.
    • resourceType and resourceName fields are now included in Google Deployment Management query results.
    • resourceType and resourceName fields are now included in Ansible query results.
    • OpenAPI file resolver for JSON and YAML parsers is added (feat(resolver)).

    5 details in Everything

43. v1.5.8 May 11, 2022 · release notes

    KICS v1.5.8 adds four new Kubernetes RBACRBACRole-based access control, where permissions are assigned to roles such as reader or administrator and users receive those roles. It makes access easier to manage than individual permission lists. detection queries for port-forwarding, impersonation, privilege escalationprivilege escalationGaining permissions beyond those an account or process initially had. It can turn limited access into administrator control or access to another user's resources., and exec permissions.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.8 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.8

    • Adds a query to detect port-forwarding into containers via RBAC
    • Adds a query to detect account impersonation via RBAC
    • Adds a query to detect bind or escalate permissions via RBAC
    • Adds a query to detect exec permissions via RBAC

    4 details in Everything

44. v1.5.7 May 2, 2022 · release notes

    KICS v1.5.7 adds Code Climate report format and 19 new queries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.7 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.7

    • --report-format codeclimate now generates reports in Code Climate format
    • Adds 19 new detection queries for Terraform and Kubernetes

    2 details in Everything

45. v1.5.6 Apr 18, 2022 · release notes

    KICS v1.5.6 adds BoM support for CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. and a new query metadata validation script

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.6 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.6

    • Adds feat(bom) to generate Bills of Materials for CloudFormation stacks
    • Adds feat(scripts) with a new query metadata validation script (PR #5167)

    2 details in Everything

46. v1.5.5 Mar 30, 2022 · release notes

    KICS v1.5.5 adds Docker Compose analysis, Kubelet Configuration support, and CSV report output.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.5 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.5

    • feat(analyzer): added Docker Compose initial support enables scanning of Docker Compose files
    • feat(logs): added lines scanned and lines parsed exposes metrics on scan volume in logs
    • feat(report): added CSV report allows exporting findings to CSV format
    • feat(analyzer & parser): added Kubeblet Configuration support adds analysis for Kubernetes kubelet configuration files

    4 details in Everything

47. v1.5.4 Mar 16, 2022 · release notes

    KICS v1.5.4 adds Alicloud Terraform support and on-the-fly Ansible Vault decryption

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.4 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.4

    • Adds alicloud provider support for Terraform scanning
    • Adds on-the-fly decryption of Ansible Vault files via the analyzer and parser

    2 details in Everything

48. v1.5.2 Feb 16, 2022 · release notes

    KICS v1.5.2 adds Azure/GCP Terraformer, Bamboo/CodeBuild integrations, and multiple query paths CLI support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.2 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.2

    └──▷ USE IT
    Scan Terraform configurations from multiple directories in a single pass.
    shell copy

    kics scan -p /path/to/module1 -p /path/to/module2

    • Adds terraformer integration with Azure
    • Adds terraformer integration with GCP
    • Adds Bamboo integration for documentation/scanning workflows
    • Adds AWS CodeBuild integration for documentation/scanning workflows
    • Enables scanning from multiple paths via the CLI

    +1 more show less

    • Improves IAMIAMIdentity and Access Management — a framework of policies and services for controlling who can authenticate to systems and what resources they are authorized to use, letting cyber tools enforce least-privilege and audit access. Policy evaluation and adds basic terraform resource relationship querying

    6 details in Everything

49. v1.5.1 Feb 2, 2022 · release notes

    Adds Cloud Development Kit for Terraform (CDKTF) and Buildah support to KICS queries

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.1

    • feat(analyzer): Adds support to Cloud Development Kit for Terraform (CDKTF)
    • feat(buildah): Adds initial Buildah support

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Binaries are being deprecated in GitHub releases assets; KICS 1.5.2 will stop publishing binaries, requiring migration to Docker Images.
50. v1.5.0 Jan 19, 2022 · release notes

    KICS v1.5.0 adds Terraformer integration, AWS SAM support, ASFF reports, YAML alias parsing, BOMBOMA Bill of Materials listing every component, library, and dependency in a software project; cyber tools use it to track what is in a codebase and flag known-vulnerable components quickly. SQS policy analysis, and secret comment enable/disable commands.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    └──▷ USE IT
    Scan infrastructure managed by Terraformer and output findings in AWS Security Finding Format
    shell copy

    kics scan --path ./infra --report-formats json,asff --integrations terraformer

    Suppress secrets inspection on a specific line in code using the new comment command
    shell copy

    # kics-scan disable
    const password = 'hardcoded_secret'; # This line will be ignored by secrets inspector

    • Adds terraformer integration for scanning infrastructure defined via the Terraformer tool
    • Adds support for analyzing AWS Serverless Application Model (SAM) templates
    • Adds ASFF (AWS Security Finding Format) report output format via the --report-formats flag or config
    • Adds YAML alias parsing capability in the query parser
    • Adds SQS Queue Policy analysis to the Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. (BOM) output

    +2 more show less

    • Splits encryption and accessibility attributes in BOM outputs for more granular resource metadata
    • Enables # kics-scan disable and # kics-scan enable comment commands to control secrets inspection on specific lines

    7 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !GitHub releases assets no longer include binary files; use Docker images instead
51. v1.4.9 Dec 20, 2021 · release notes

    KICS v1.4.9 adds CycloneDXCycloneDXAn open standard for describing software components and their dependencies, vulnerabilities and other supply-chain information. Tools use it to exchange bills of materials and related evidence. and JUnit report formats, plus GDM and gRPCgRPCAn open-source remote procedure call framework from Google that uses HTTP/2 and Protocol Buffers to let services call each other's functions across a network, giving tools low-latency, strongly typed inter-process communication. query support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.9 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.9

    • Adds --report-types value cyclonedx to generate CycloneDX SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. reports in JSON format
    • Adds --report-types value junit to output scan results as JUnit XMLJUnit XMLA widely adopted test-report file format, originally from the Java JUnit framework, that records test suite results as XML; cyber tools emit it so their output plugs into CI systems like Jenkins or GitLab without custom parsers.
    • Adds Google Deployment Manager query support via the new gdm language key
    • Adds gRPC query support via the new grpc language key

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Reports now use 1 instead of -1 to indicate a failure to find the line containing the vulnerability
52. v1.4.8 Nov 24, 2021 · release notes

    Adds SonarQube report output, expected values in PDF reports, and a pre-commit hook.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.8 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.8

    └──▷ USE IT
    Export findings directly to SonarQube for continuous integration monitoring
    shell copy

    kics scan --path ./infrastructure --output-format sonarqube -o results.sonarqube.json

    Configure your .pre-commit-config.yaml to run kics-scan before every commit
    📍repos: - repo: https://github.com/Checkmarx/kics rev: v1.4.8 hooks: - id: kics-pre-commit
    • Adds SonarQube format support for scan results to integrate with SonarQube dashboards
    • Adds the expected value field to PDF export reports for better compliance context
    • Adds a kics-scan pre-commit hook to block commits containing infrastructure-as-code vulnerabilities

    3 details in Everything

53. v1.4.7 Nov 10, 2021 · release notes

    KICS v1.4.7 adds 11 Terraform queries, include-query/exclude-query flags for secrets scanning, and parser line-ignore support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.7 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.7

    • Added 11 new Terraform queries to expand detection coverage.
    • Added MegaLinter to the list of supported integrations.

    2 details in Everything

54. v1.4.6 Oct 27, 2021 · release notes

    Adds terraform cloud integration and -v version check command

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.6 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.6

    • Adds Terraform Cloud integration for automated scanning workflows

    1 detail in Everything

55. v1.4.5 Oct 14, 2021 · release notes

    KICS v1.4.5 adds --bom flag for SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. support and Terraform plan scanning via new parser.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.5 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.5

    • Adds --bom flag to enable Bill of MaterialsBill of MaterialsA structured list of every component, library, and dependency that makes up a piece of software or hardware, used by cyber tools to track what is inside a product and surface known vulnerabilities in its parts. generation in results.json
    • Adds terraform plan parsing capability through a new parser backend
    • Adds terraform ternary expression resolution in the parser

    3 details in Everything

56. v1.4.4 Sep 29, 2021 · release notes

    KICS v1.4.4 adds AWS JSON filter expressions for CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. alarms and .tfvars parsing

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.4 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.4

    • Adds support for AWS JSON filter pattern expressions in CIS benchmark rules related to alarms via the --include-cis-benchmarks option.
    • Enables password and secrets detection in .tfvars files, previously only scanned in standard .tf sources.
    • Adds a TeamCity integration example for CI/CD pipeline reporting.

    3 details in Everything

57. v1.4.3 Sep 15, 2021 · release notes

    KICS v1.4.3 adds --disable-secrets and --secrets-regexes-path flags to control secret scanningsecret scanningChecking files, code or other data for exposed credentials such as passwords, API keys and tokens. Findings help teams remove the secret and revoke or rotate it. queries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.3 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.3

    └──▷ TRY IT
    Run a scan excluding the default password and secrets detection logic.
    copy

    $ kics scan --path . --disable-secrets

    Provide custom regex rules for secret detection by pointing to a local file.
    copy

    $ kics scan --path . --secrets-regexes-path /custom/regexes.json

    • Add flag --disable-secrets to disable passwords and secrets query
    • Add flag --secrets-regexes-path to override password and secrets query configuration rules
    • --libraries-path supports git repositories and compressed files

    3 details in Everything

58. v1.4.2 Sep 1, 2021 · release notes

    Adds --exclude-severities flag, embedded Rego libraries, and go-getter support in --queries-path.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.2 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.2

    • --exclude-severities flag filters scan results by severity level
    • --libraries-path flag overrides the bundled Rego libraries when provided
    • --queries-path flag now accepts go-getter URLs to fetch queries from archives and git repos

    3 details in Everything

59. v1.4.1 Aug 18, 2021 · release notes

    KICS v1.4.1 adds --disable-full-descriptions, scan flags from JSON files, -b lib path, and comment-based query controls

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.1

    └──▷ TRY IT
    Disable full descriptions for a scan using the new flag.
    copy

    $ kics scan -p . --disable-full-descriptions

    Specify a custom library path for query execution using the new -b flag.
    copy

    $ kics scan -p . -b /path/to/library

    • Adds --disable-full-descriptions flag to suppress full descriptions during scans (replaces deprecated --disable-cis-descriptions).
    • Enables passing scan flags via a JSON file with the refactored JSON flag input mechanism.
    • Adds -b CLI flag to specify the library path for queries, fixing prior behavior of -q.
    • Adds support for ignore/disabled/enabled states on queries within commented files.

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --disable-cis-descriptions flag is deprecated; use --disable-full-descriptions instead.
60. v1.4.0 Aug 4, 2021 · release notes

    KICS v1.4.0 adds Azure Resource Manager support, cloud provider filtering flag, and Terraform function recognition

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    └──▷ USE IT
    Scan Azure ARMARMA family of RISC processor architectures designed by Arm Holdings and licensed to chip makers worldwide; tools target it to run natively on mobile, embedded, and increasingly server and desktop hardware. templates alongside Terraform files to leverage new ARM support and function evaluation.
    shell copy

    kics scan --path /infrastructure/arm -q /path/to/kics/queries

    • --providers flag allows filtering scans by specific cloud provider.
    • Scanner now recognizes and evaluates Terraform functions for improved query accuracy.
    • CISCISA nonprofit that publishes consensus-based configuration benchmarks and controls for hardening operating systems, cloud environments, and software; cyber tools use it as a ready-made compliance baseline. benchmark descriptions are now included in query metadata.

    3 details in Everything

61. v1.3.5 Jul 14, 2021 · release notes

    KICS v1.3.5 adds --input-data flag and go-getter integration for sample downloads

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.5 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.3.5

    • Adds --input-data CLI option to pass data during scan execution
    • Integrates go-getter into the engine to download samples before scanning

    2 details in Everything

62. v1.3.4 Jun 30, 2021 · release notes

    KICS v1.3.4 adds support for scanning zip archives via --path and new queries.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.4 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.3.4

    └──▷ USE IT
    Scan a zipped infrastructure bundle directly without manual extraction
    shell copy

    kics scan --path ./infra.zip

    • Adds extraction of zip files passed as the --path scan target
    • Adds 38 new detection queries (33 OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth., 4 Terraform, 1 CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call.)
    • Changes report output to always use relative file paths

    3 details in Everything

63. v1.3.3 Jun 16, 2021 · release notes

    KICS v1.3.3 adds PDF report output, OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 2.0 support in queries, and 89 new detection rules

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.3 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.3.3

    • Adds pdf as an output format for reports via the CLI
    • Enables querying OpenAPI 2.0 (Swagger) specifications using shared query logic
    • Includes +89 new security detection queries

    3 details in Everything

64. v1.3.2 Jun 2, 2021 · release notes

    KICS v1.3.2 adds GitLab SASTSASTStatic application security testing, analyzing source code or compiled code for vulnerabilities without running the application. It helps developers find problems before deployment. reporting, query filtering via CLI flag, and HTML report metadata.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.2 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.3.2

    • Adds --gitlab-sast CLI flag to export findings in GitLab SAST format
    • Adds platform, start time, and end time fields to the generated HTML report

    2 details in Everything

65. v1.3.1 May 19, 2021 · release notes

    Adds 112 new query detections for IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup. and code scanning

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.3.1

    • +112 new queries

    1 detail in Everything

66. v1.3.0 May 6, 2021 · release notes

    KICS v1.3.0 adds --path array support, configurable timeout via --query-execution-timeout, telemetry opt-out, and metrics logging.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • --path flag now accepts multiple paths (e.g., --path /dir1 --path /dir2) for granular scanning targets
    • Adds --query-execution-timeout CLI flag to control query execution duration
    • Prints CPUCPUThe main general-purpose processor in a computer. It runs application instructions and coordinates work with memory and other hardware. and Memory usage metrics in logs during scan execution

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !scan command is no longer executed by default when running KICS without a subcommand; users must explicitly call kics scan
    • !Exit code now reflects the semantic status of scan results (e.g., findings found) rather than execution success/failure
67. v1.2.4 Apr 21, 2021 · release notes

    KICS v1.2.4 adds OpenAPIOpenAPIA vendor-neutral specification for describing REST APIs in a machine-readable format, maintained by the OpenAPI Initiative. Cyber tools use it to auto-generate clients, documentation, and validation from a single source of truth. 3.0 query support and --log-format CLI flag for JSON logging

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.4 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.2.4

    └──▷ USE IT
    Output logs in JSON format for easier parsing by log aggregation systems.
    shell copy

    kics scan -p /path/to/code --log-format json

    • Adds OpenAPI 3.0 platform support with +6 new queries in the catalog
    • Adds --log-format CLI argument to enable JSON structured logging

    2 details in Everything

68. v1.2.2 Apr 7, 2021 · release notes

    Adds --ci flag for CI-friendly stdout-only output and supports Terraform variable files

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.2 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.2.2

    └──▷ USE IT
    Run a scan in CI/CD pipelines where only structured logs are needed and the UI is suppressed.
    shell copy

    kics scan --path ./infrastructure --ci

    • Adds --ci flag that prints only logs to stdout (no CLI UI output)
    • Add support to terraform vars
    • Added --log-level flag that determines log verbosity
    • Added --log-path flag that determines the log file location

    4 details in Everything

69. v1.2.1 Mar 24, 2021 · release notes

    KICS v1.2.1 adds Helm scanning support, HTML output format, and an official one-line install script.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.2.1

    └──▷ TRY IT
    Scan a local Helm chart directory for security issues and generate an HTML report.
    copy

    $ kics scan -p ./my-chart -o html --output-path results.html

    Install KICS on Linux or macOS using the provided one-liner.
    copy

    $ curl -s https://raw.githubusercontent.com/Checkmarx/kics/master/scripts/install.sh | bash

    • Adds helm support to detect misconfigurations in Kubernetes Helm charts
    • Adds html as a supported output format for results via the -o flag
    • Provides an official one-line install script for faster deployment

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The value field is no longer included in query results, which may break downstream parsers relying on its presence.
70. v1.2.0 Mar 10, 2021 · release notes

    KICS v1.2.0 adds SARIFSARIFStatic Analysis Results Interchange Format, a standard for sharing code-analysis findings, including locations and rule details. It lets scanners report results to a common review interface. output, --exclude-queries filter, list-platforms subcommand, and config file array support

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.0 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.2.0

    └──▷ USE IT
    Output scan results in SARIF format for CI/CD integration.
    shell copy

    kics scan --path . --report-formats sarif

    Exclude specific queries from the scan results using a comma-separated list.
    shell copy

    kics scan --path . --exclude-queries query1,query2

    List all supported platforms to know which values are valid for the --type filter.
    shell copy

    kics list-platforms

    • Adds --report-formats sarif to the scan command for SARIF results output format
    • Adds --exclude-queries flag to exclude specific queries from the results
    • Adds list-platforms subcommand to list all supported platforms (names to use when filtering with --type flag)
    • Supports arrays in KICS config file

    4 details in Everything

71. v1.1.4 Feb 24, 2021 · release notes

    KICS v1.1.4 adds AWS CloudFormationAWS CloudFormationAn AWS service for declaring cloud infrastructure as code in JSON or YAML templates, letting cyber tools provision and tear down entire environments reproducibly without manual console steps. JSON support, global config file, and exclude-results flag

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.4 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.1.4

    • Adds --exclude-results flag to filter unwanted results from scan output
    • Adds configuration file support to handle all KICS flags centrally
    • Supports JSON files as input format for AWS CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call. templates

    3 details in Everything

72. v1.1.3 Feb 10, 2021 · release notes

    KICS v1.1.3 adds --type, --exclude-paths, --config flags, macOS binaries, and common query for secrets in IaCIaCInfrastructure as Code: the practice of defining and provisioning compute infrastructure through machine-readable config files rather than manual processes, giving cyber tools repeatable, version-controlled environment setup.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.3 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.1.3

    • Adds --type flag to CLI to select the scan type (e.g., Terraform, Dockerfile)
    • Adds --exclude-paths flag to exclude specific folders or files from scanning
    • Adds --config flag to load all CLI flags from a .json or .yaml configuration file
    • Adds macOS binaries to the release distribution

    4 details in Everything

73. v1.1.2 Jan 29, 2021 · release notes

    KICS v1.1.2 adds version subcommand, moves generate-id to command, and adds new result fields

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.2 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.1.2

    └──▷ USE IT
    Check which version of KICS is installed before running scans.
    shell copy

    kics version

    • Changes -g flag to generate-id subcommand for generating result identifiers
    • Adds SimilarityID field to scan results for unique vulnerability identification
    • Includes ScanDuration in output and logs to track scan performance

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The -g flag for generating identifiers is replaced by the new generate-id subcommand; scripts relying on kics scan -g will fail until updated.
74. v1.1.1 Jan 12, 2021 · release notes

    KICS v1.1.1 adds results summary to console/JSON output and switches query IDs to UUIDUUIDA universally unique identifier, usually a 128-bit value used to identify an object across systems. It is designed to make independently generated identifiers unlikely to collide. format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.1 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.1.1

    • Results summary now appears in both console and JSON output after a scan completes
    • Query identifiers for the query support API have been replaced with a UUID format

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Query identifiers previously accepted as integers or strings are now rejected; you must provide valid UUID values for the query support interface.
75. v1.1.0 Dec 31, 2020 · release notes

    KICS v1.1.0 adds query support for Kubernetes, CloudFormationCloudFormationAn AWS service that lets you describe and provision cloud infrastructure as declarative YAML or JSON templates, so a cyber tool can reproducibly spin up or tear down its entire AWS environment with a single API call., Dockerfile, and Ansible.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.1.0 https://github.com/Checkmarx/kics.git
    # already have the repo? check out this version:
    $ git checkout v1.1.0

    • Adds queries for Kubernetes resources
    • Adds queries for CloudFormation templates
    • Adds support for analyzing Dockerfile files with dedicated queries
    • Adds support for analyzing Ansible .yaml files with dedicated queries

    4 details in Everything