# bridgecrewio/checkov architecture

> Architecture diagram of the GitHub repository bridgecrewio/checkov, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-27). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/bridgecrewio/checkov
- Repository: https://github.com/bridgecrewio/checkov

## Overview

Checkov is an IaC and software-composition security scanner. A user supplies infrastructure, pipeline, source-code, package, or image inputs; Checkov analyzes them against security policies and produces findings in supported report formats. The README documents broad format, graph/context-aware, secret-detection, and reporting capabilities, while the sampled code confirms policy registration and evaluation patterns and a SAST engine integrating a native library. Several product branches are documented but their runtime wiring was not sampled, so the graph omits uncertain call relationships.

Main entry points: [`checkov/common/output`](https://github.com/bridgecrewio/checkov/tree/main/checkov/common/output) (Scan findings), [`checkov`](https://github.com/bridgecrewio/checkov/tree/main/checkov) (IaC formats), [`checkov/sast/engines/prisma_engine.py`](https://github.com/bridgecrewio/checkov/blob/main/checkov/sast/engines/prisma_engine.py) (SAST engine), [`checkov/azure_pipelines`](https://github.com/bridgecrewio/checkov/tree/main/checkov/azure_pipelines) (CI pipelines)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_scan["Input scanning"]
  node_iac["IaC formats"]
  node_pipelines["CI pipelines"]
end

subgraph group_policy["Policy evaluation"]
  node_terraform["Terraform checks"]
  node_arm["ARM checks"]
  node_bicep["Bicep checks"]
  node_common["Shared checks"]
  node_graph["Graph analysis"]
  node_pipelinechecks["Pipeline checks"]
end

subgraph group_security["Code and supply chain"]
  node_secrets["Secret detection"]
  node_sast["SAST engine<br/>[prisma_engine.py]"]
  node_sca["SCA scanning"]
end

subgraph group_reporting["Findings and reports"]
  node_results["Scan findings"]
  node_formats["Report formats"]
end

node_user(("Developer"))
node_native["Prisma library"]
node_cli(("CLI output"))

node_user -->|"supplies IaC"| node_iac
node_user -->|"supplies pipelines"| node_pipelines
node_iac -->|"evaluated by"| node_terraform
node_iac -->|"evaluated by"| node_arm
node_iac -->|"evaluated by"| node_bicep
node_iac -->|"graph-scanned"| node_graph
node_pipelines -->|"checked by"| node_pipelinechecks
node_terraform -->|"produces findings"| node_results
node_arm -->|"produces findings"| node_results
node_bicep -->|"produces findings"| node_results
node_pipelinechecks -->|"produces findings"| node_results
node_graph -->|"produces findings"| node_results
node_user -->|"supplies source"| node_secrets
node_user -->|"supplies source"| node_sast
node_sast -->|"invokes scan"| node_native
node_native -->|"returns results"| node_sast
node_user -->|"supplies packages or images"| node_sca
node_secrets -->|"adds findings"| node_results
node_sast -->|"adds findings"| node_results
node_sca -->|"adds findings"| node_results
node_results -->|"rendered as"| node_formats
node_formats -->|"displays"| node_cli

click node_iac "https://github.com/bridgecrewio/checkov/tree/main/checkov"
click node_pipelines "https://github.com/bridgecrewio/checkov/tree/main/checkov/azure_pipelines"
click node_terraform "https://github.com/bridgecrewio/checkov/tree/main/checkov/terraform/checks"
click node_arm "https://github.com/bridgecrewio/checkov/tree/main/checkov/arm/checks"
click node_bicep "https://github.com/bridgecrewio/checkov/tree/main/checkov/bicep/checks"
click node_common "https://github.com/bridgecrewio/checkov/tree/main/checkov/common"
click node_graph "https://github.com/bridgecrewio/checkov/tree/main/checkov/common"
click node_pipelinechecks "https://github.com/bridgecrewio/checkov/tree/main/checkov/gitlab_ci/checks"
click node_secrets "https://github.com/bridgecrewio/checkov/tree/main/checkov/secrets"
click node_sast "https://github.com/bridgecrewio/checkov/blob/main/checkov/sast/engines/prisma_engine.py"
click node_sca "https://github.com/bridgecrewio/checkov/tree/main/checkov/sca_package_2"
click node_results "https://github.com/bridgecrewio/checkov/tree/main/checkov/common/output"
click node_formats "https://github.com/bridgecrewio/checkov/tree/main/checkov/common/output"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_iac,node_pipelines toneBlue
class node_terraform,node_arm,node_bicep,node_common,node_graph,node_pipelinechecks toneAmber
class node_secrets,node_sast,node_sca toneMint
class node_results,node_formats toneRose
class node_user,node_native,node_cli toneIndigo
```

## Components

### Input scanning

- [IaC formats](https://github.com/bridgecrewio/checkov/tree/main/checkov): `checkov`
- [CI pipelines](https://github.com/bridgecrewio/checkov/tree/main/checkov/azure_pipelines): `checkov/azure_pipelines`

### Policy evaluation

- [Terraform checks](https://github.com/bridgecrewio/checkov/tree/main/checkov/terraform/checks): `checkov/terraform/checks`
- [ARM checks](https://github.com/bridgecrewio/checkov/tree/main/checkov/arm/checks): `checkov/arm/checks`
- [Bicep checks](https://github.com/bridgecrewio/checkov/tree/main/checkov/bicep/checks): `checkov/bicep/checks`
- [Shared checks](https://github.com/bridgecrewio/checkov/tree/main/checkov/common): `checkov/common`
- [Graph analysis](https://github.com/bridgecrewio/checkov/tree/main/checkov/common): `checkov/common`
- [Pipeline checks](https://github.com/bridgecrewio/checkov/tree/main/checkov/gitlab_ci/checks): `checkov/gitlab_ci/checks`

### Code and supply chain

- [Secret detection](https://github.com/bridgecrewio/checkov/tree/main/checkov/secrets): `checkov/secrets`
- [SAST engine](https://github.com/bridgecrewio/checkov/blob/main/checkov/sast/engines/prisma_engine.py): `checkov/sast/engines/prisma_engine.py`
- [SCA scanning](https://github.com/bridgecrewio/checkov/tree/main/checkov/sca_package_2): `checkov/sca_package_2`

### Findings and reports

- [Scan findings](https://github.com/bridgecrewio/checkov/tree/main/checkov/common/output): `checkov/common/output`
- [Report formats](https://github.com/bridgecrewio/checkov/tree/main/checkov/common/output): `checkov/common/output`

### Other components

- **Developer**
- **Prisma library**
- **CLI output**

## Connections

- Developer → IaC formats: supplies IaC
- Developer → CI pipelines: supplies pipelines
- IaC formats → Terraform checks: evaluated by
- IaC formats → ARM checks: evaluated by
- IaC formats → Bicep checks: evaluated by
- IaC formats → Graph analysis: graph-scanned
- CI pipelines → Pipeline checks: checked by
- Terraform checks → Scan findings: produces findings
- ARM checks → Scan findings: produces findings
- Bicep checks → Scan findings: produces findings
- Pipeline checks → Scan findings: produces findings
- Graph analysis → Scan findings: produces findings
- Developer → Secret detection: supplies source
- Developer → SAST engine: supplies source
- SAST engine → Prisma library: invokes scan
- Prisma library → SAST engine: returns results
- Developer → SCA scanning: supplies packages or images
- Secret detection → Scan findings: adds findings
- SAST engine → Scan findings: adds findings
- SCA scanning → Scan findings: adds findings
- Scan findings → Report formats: rendered as
- Report formats → CLI output: displays