Hi Product Hunt 👋 I built Cairn because of a mistake I kept watching teams make (myself included). Your security scanner flags a security group that's open to the world. Your cost tooling flags the same box as over-provisioned. Both are right. So you right-size it, and you've just made the breach that's still possible cheaper to run. Two tools, two lists, no relationship between them. Cairn does one pass over your Terraform and scores four lenses: security, cost, reliability, governance, then reconciles them. When findings collide on the same resource, it emits an explicit ordering: fix the exposure first, then right-size. And it gives you the patch ; the actual line to change, not a rule ID and a shrug. A few things I deliberately chose: 🔒 It runs entirely on your machine. No account, no telemetry, zero network calls. The only egress is an opt-in --explain flag using your own API key, and it refuses any endpoint that isn't HTTPS or localhost, so a malicious repo config can't exfiltrate your key. 📊 It won't lie about coverage. If it has no rules for your provider it says "not scanned" instead of a confident green "clean". A scanner that reports clean on files it never understood is worse than no scanner. That behaviour is enforced by a test. ✍️ It writes fixes, carefully. cairn fix --apply only applies a hard-coded whitelist of non-destructive changes, is dry-run by default, refuses to run on a dirty git worktree, and records before/after hashes. It's v0.6.0 and honest about it; 42 rules across AWS, Azure, GCP, Kubernetes and on-prem. MIT, free forever (enforced in code, not by promise). pip install cairn-iac cairn scan ./infra I'd genuinely love for you to point it at real Terraform and tell me what it gets wrong. False positives are the fastest way to make it better, and a new rule is one small Python function, which makes it a great first open-source PR. ~ Tarun

Cairn

Local-first IaC auditor: cost + security in one pass

Local-first IaC auditor: cost + security in one pass