ponytail-sec

Full project security audit. Scans the entire codebase across three passes: code that shouldn't exist, all dependencies assessed, all hardening findings. Produces a comprehensive numbered report with blast-radius narrative. For per-diff review use ponytail-sec instead.

Security companion for active development. Scopes to the current diff or changed files. Three passes: YAGNI code review, new-dep assessment, and up to 3 material hardening findings. Lean by design — surfaces the one thing to fix before merging, not a backlog. Use ponytail-sec-audit for a full project scan.

Binary Dockerfile image-build hardening check. Use when reviewing Dockerfiles, container image builds, multi-stage builds, runtime users, pinned bases, or reproducible dependency installs. Minimal output only: OK or NOT_OK: RULE, RULE.

Binary Kubernetes securityContext hardening check. Use when reviewing Pods, Deployments, StatefulSets, DaemonSets, Jobs, CronJobs, Helm templates, or Kubernetes manifests that define containers. Minimal output only: OK or NOT_OK: RULE, RULE.