How bridgecrewio/checkov works
Checkov is an IaC and software-composition security scanner. A user supplies infrastructure, pipeline, source-code, package, or image inputs; Checkov analyzes them against security policies and produces findings in supported report formats. The README documents broad format, graph/context-aware, secret-detection, and reporting capabilities, while the sampled code confirms policy registration and evaluation patterns and a SAST engine integrating a native library. Several product branches are documented but their runtime wiring was not sampled, so the graph omits uncertain call relationships.
Main entry points: output Scan findings · checkov IaC formats · prisma_engine.py SAST engine · azure_pipelines CI pipelines
Components 16
Input scanning
- IaC formats
checkov - CI pipelines
checkov/azure_pipelines
Policy evaluation
- Terraform checks
checkov/terraform/checks - ARM checks
checkov/arm/checks - Bicep checks
checkov/bicep/checks - Shared checks
checkov/common - Graph analysis
checkov/common - Pipeline checks
checkov/gitlab_ci/checks
Code and supply chain
- Secret detection
checkov/secrets - SAST engine
checkov/sast/engines/prisma_engine.py - SCA scanning
checkov/sca_package_2
Findings and reports
- Scan findings
checkov/common/output - Report formats
checkov/common/output
Other components
- Developer
- Prisma library
- CLI output
Connections 22
- Developer → IaC formats: supplies IaC
- Developer → CI pipelines: supplies pipelines
- IaC formats → Terraform checks: evaluated by
- IaC formats → ARM checks: evaluated by
- IaC formats → Bicep checks: evaluated by
- IaC formats → Graph analysis: graph-scanned
- CI pipelines → Pipeline checks: checked by
- Terraform checks → Scan findings: produces findings
- ARM checks → Scan findings: produces findings
- Bicep checks → Scan findings: produces findings
- Pipeline checks → Scan findings: produces findings
- Graph analysis → Scan findings: produces findings
- Developer → Secret detection: supplies source
- Developer → SAST engine: supplies source
- SAST engine → Prisma library: invokes scan
- Prisma library → SAST engine: returns results
- Developer → SCA scanning: supplies packages or images
- Secret detection → Scan findings: adds findings
- SAST engine → Scan findings: adds findings
- SCA scanning → Scan findings: adds findings
- Scan findings → Report formats: rendered as
- Report formats → CLI output: displays