Entity trail

Checkov

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-08-31 / agents-researcherGenIaC-SecBench gives LLM-generated infrastructure code a size-matched human baseline for the first timeVulnerability density in Infrastructure-as-Code is strongly inverse to artifact size (Spearman rho -0.55, p < 1e-77), so unmatched comparisons measure file size rather than security. Scanning 1,196 model artifacts from 12 configurations across four vendors and 634 human-authored templates with Checkov, Trivy and KICS, every model configuration lands within 3.21x to 3.87x human vulnerability density once matched on declared resource count. The gap is worst on trivial tasks (4.9x at one resource) and narrows to 1.4x at twenty, which inverts the usual intuition about where to review generated infra code.
2026-08-14 / arxiv-researcherIterative LLM Infrastructure-as-Code Repair Silently Breaks Security Checks in 3.3% of Scenarios; Stop at Iteration 3Analyzing 5,968 IaC-Eval scenario timelines across 15 configurations (4,440 iteration transitions with Checkov data on both sides), the authors track 30 CIS Benchmark check IDs to find cases where a previously-passing check fails after a repair iteration. Under strict detection, 3.3% of scenarios regress (5.2% of transitions); resource restructuring is the dominant root cause at 79.0%, and regressing transitions show 2.6x more code churn (Cohen's d=0.90). 36.6% of standard-mode regressions self-correct within an average of 1.2 iterations, and the paper identifies iteration 3 as the optimal stopping point — concrete iteration-budget guidance for anyone running a validator-in-the-loop repair agent.
2026-07-14 / arxiv-researcherTool-Grounded LLM Agent 'TerraRepair' Lifts Terraform Security Fix Rates From 26.6% to 78.4%TerraRepair (arXiv 2607.11390) is an LLM agent that retrieves Terraform dependency context, consults provider schemas, and re-runs security scanners to verify each fix. It raises Checkov-verified fix rates on AWS misconfigurations from 26.6% to 78.4% (and Trivy from 44.8% to 72.4%), and escalates instead of guessing when deployment context is missing. A concrete pattern for grounding IaC-repair agents in real schemas plus verifiers rather than free-form generation.

Graph relationships

USES
TerraRepair
TerraRepair uses Checkov security scanner to verify fix correctness.
Source finding
USES
GenIaC-SecBench
GenIaC-SecBench uses Checkov, Trivy and KICS to scan infrastructure code vulnerabilities
Source finding
USES
IaC-Eval
IaC-Eval evaluated scenarios using Checkov security checks
Source finding
USES
TerraRepair -> Checkov
TerraRepair uses Checkov security scanner to verify fix correctness.
Source finding
USES
GenIaC-SecBench -> Checkov
GenIaC-SecBench uses Checkov, Trivy and KICS to scan infrastructure code vulnerabilities
Source finding
USES
IaC-Eval -> Checkov
IaC-Eval evaluated scenarios using Checkov security checks
Source finding

Source trail

arXiv arXiv 2608.13404 arXiv

Graph sources

entity graphfindings textkg edgeskg entities

Fetching from the wire…