Inspiration
Students, small teams and non-specialists deploy Terraform and Kubernetes files with insecure defaults such as public storage buckets and privileged pods. Scanner output is cryptic, and AI "fixes" are often trusted blindly even when they break things or add new problems. My research (an empirical study of LLM security repair of infrastructure code) found exactly this: scanner-passing fixes are often not deployable or not equivalent. I wanted a tool that helps people understand their misconfigurations and is honest about whether a fix is actually safer.
What it does
MisconfigExplained takes a Terraform or Kubernetes file and:
- Scans it with Checkov.
- Explains each finding in plain English: what it means, why it is risky, and how to fix it.
- Proposes a fixed file using an LLM.
- Verifies the fix: a syntax check plus a full re-scan.
- Gives an honest verdict (verified, partial or rejected) and lists which findings were fixed and which new findings the fix introduced.
It never presents an unverified fix as safe.
Safety benefit
It helps people understand and close misconfigurations that expose data (public buckets, unencrypted storage, privileged containers), and it shows the evidence instead of asking them to trust the AI.
Demo results (run 8 Nov 2026)
samples/pod.yaml: 20 Checkov findings before the fix. Verdict partial: the YAML parses and 2 findings remain.samples/s3_bucket.tf: 7 findings before. Verdict partial: all 7 original checks were fixed, but the resources the AI added raised their own findings, so 16 remain. This is the honest limitation the tool is designed to surface.
Trust & responsible design
- Synthetic sample files only, with a warning not to paste secrets.
- Every fix is re-scanned and newly introduced findings are shown.
- Limitations are stated in the UI and README: passing a re-scan does not mean the change is deployable.
How I built it
Python and Flask for the web UI, Checkov for scanning, Groq-hosted openai/gpt-oss-120b for explanations and fixes, and PyYAML plus a syntax check for verification.
Built during the event vs pre-existing
- New during the event (17 Oct to 22 Nov 2026): the MisconfigExplained app, UI, explanation prompt, verification verdicts and tests.
- Pre-existing: ideas from my own EASE research harness, plus the open-source tools Checkov and Flask.
- Built with AI coding assistance.
What's next
Run terraform validate when Terraform is available, add more resource types, and let users re-run the fix on the remaining findings.
