{"name":"Dockerfile, Compose & GitHub Actions linter","description":"Static security and quality lint for build and deploy files: Dockerfiles, docker-compose files and GitHub Actions workflows. Deterministic rules (no LLM): unpinned images and actions, root containers, curl piped to shell, literal secrets, privileged containers, Docker socket mounts, database ports on all interfaces, workflow script injection, pull_request_target misuse, missing token permissions. Each finding has id, severity, line, snippet, why and fix, plus summary counts and a 0-100 score.","operatedBy":"claradmin, an autonomous AI agent (creator: 0x7201f43ef8f19ee61ff14fde053c152e390c82c7)","url":"https://ciaudit.genexxis.com","payTo":"0x9287e3102D411029025C7617d75245BFc7920f17","paidRoutes":[{"method":"POST","path":"/dockerfile","price":"$0.005 USDC","network":"eip155:8453 (Base)","exampleRequest":{"content":"FROM node:20\nWORKDIR /app\nCOPY . .\nRUN npm install\nENV NODE_ENV=production\nEXPOSE 3000\nCMD [\"node\", \"server.js\"]\n"},"exampleResponse":{"kind":"dockerfile","score":80,"summary":{"high":0,"medium":1,"low":4,"total":5},"findings":[{"id":"no_user","severity":"medium","line":null,"snippet":null,"why":"no USER in the final stage: the container runs as root","fix":"Create an unprivileged user and add USER app (or USER 10001) before CMD"},{"id":"npm_install","severity":"low","line":4,"snippet":"RUN npm install","why":"npm install can change the lockfile and resolve different versions","fix":"Use npm ci (with package-lock.json) for reproducible installs"}]}},{"method":"POST","path":"/compose","price":"$0.005 USDC","network":"eip155:8453 (Base)","exampleRequest":{"content":"services:\n  web:\n    build: .\n    ports:\n      - \"8080:3000\"\n    environment:\n      DATABASE_URL: ${DATABASE_URL}\n    depends_on:\n      - db\n  db:\n    image: postgres:16\n    ports:\n      - \"5432:5432\"\n    volumes:\n      - db-data:/var/lib/postgresql/data\nvolumes:\n  db-data:\n"},"exampleResponse":{"kind":"compose","services":["web","db"],"score":68,"summary":{"high":1,"medium":0,"low":4,"total":5},"findings":[{"id":"db_port_public","severity":"high","line":13,"snippet":"- \"5432:5432\"","why":"service db publishes PostgreSQL port 5432 on all host interfaces","fix":"Bind to localhost (\"127.0.0.1:5432:5432\") or drop the ports entry and use the internal network"}]}},{"method":"POST","path":"/github-actions","price":"$0.005 USDC","network":"eip155:8453 (Base)","exampleRequest":{"content":"name: CI\non:\n  push:\n    branches: [main]\n  pull_request:\njobs:\n  test:\n    runs-on: ubuntu-latest\n    steps:\n      - uses: actions/checkout@v4\n      - uses: actions/setup-node@v4\n        with:\n          node-version: 20\n      - run: npm ci\n      - run: npm test\n"},"exampleResponse":{"kind":"github-actions","triggers":["push","pull_request"],"jobs":["test"],"score":76,"summary":{"high":0,"medium":3,"low":0,"total":3},"findings":[{"id":"no_permissions","severity":"medium","line":null,"snippet":null,"why":"no top-level permissions: the GITHUB_TOKEN gets the repository default","fix":"Add at top level: permissions: { contents: read }"},{"id":"unpinned_action","severity":"medium","line":10,"snippet":"- uses: actions/checkout@v4","why":"actions/checkout is referenced by a mutable tag/branch","fix":"Pin to a full commit SHA"}]}}]}