▸case-17 Perform a container security audit on Docker container `prod-api-v1` for platform `docker`. Return a JSON response formatted strictly with `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. Make sure the timestamp uses standard ISO-8601 formatting with timezone offset. | pass→pass | 11,016 | 25,797 | +134% | 1 | 1 | 0% | 2,346 | 5,635 | +140% | 0 | 0 | — |
▸case-01 We are preparing to deploy a new set of services to our Kubernetes production environment (`prod-cluster-us-east`). Please perform a complete security evaluation covering images, runtime settings, RBAC, and network configurations against CIS benchmarks. Format the output strictly as a JSON object containing keys for `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings` (an array of findings where each record contains `id`, `check_type`, `resource_type`, `resource_name`, `severity`, `cvss_score`, `title`, `description`, `cis_control`, `remediation`, and `remediation_manifest`), `cis_compliance` (including benchmark details and control pass/fail lists), and a `summary` block capturing total findings, critical count, high count, and overall risk. | fail→pass | 15,786 | 24,665 | +56% | 1 | 1 | 0% | 890 | 5,086 | +471% | 0 | 0 | — |
▸case-02 Our security team needs a container security assessment for our standalone Docker deployment hosts following a recent audit request. Please analyze our Dockerfile and container runtime configs for security issues and compliance gaps. Provide the result in a JSON response structured with top-level attributes: `platform` ('docker'), `cluster_identifier` (null), `check_scope` ('all'), `timestamp`, an array of `findings` (where each finding details `id`, `check_type`, `resource_type`, `resource_name`, `severity`, `cvss_score`, `title`, `description`, `cis_control`, `remediation`, and `remediation_manifest`), a `cis_compliance` object listing benchmark name and lists of assessed/passed/failed controls, plus a `summary` section with total findings and risk level. | pass→pass | 20,081 | 23,675 | +18% | 1 | 1 | 0% | 2,176 | 4,859 | +123% | 0 | 0 | — |
▸case-03 I need to audit the RBAC roles and network policy rules on our Kubernetes cluster `k8s-sec-eval-01` before an upcoming compliance review. Please review our RBAC assignments and network policies. Return the evaluation in a JSON structure containing `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. Ensure each finding includes a unique ID, check type, resource name and type, severity rating, CVSS score, description, relevant CIS benchmark reference, remediation advice, and actionable YAML or Dockerfile fix snippet. | fail→pass | 10,071 | 10,424 | +4% | 1 | 1 | 0% | 2,218 | 4,377 | +97% | 0 | 0 | — |
▸case-04 We have built a container image `registry.internal/apps/payment-api:v2.1` and need a software bill of materials (SBOM) scanning report listing all known CVE vulnerabilities in operating system packages (such as libssl or glibc) and language dependencies (npm packages). Please run a CVE scan on this image and list vulnerable package versions with matching CVE identifiers and CVSS scores in a JSON summary report. | fail→fail | 14,389 | 12,002 | -17% | 1 | 1 | 0% | 892 | 2,654 | +198% | 0 | 0 | — |
▸case-05 We observed unexpected shell executions (`/bin/bash`) and outbound socket connections inside container `payment-gateway-7f98b` running in namespace `finance`. Please set up real-time syscall monitoring, kernel event hooks, and active threat detection rules to alert our SOC on unexpected process executions in running containers. Format the response as a JSON audit log. | fail→fail | 14,133 | 15,338 | +9% | 1 | 1 | 0% | 3,063 | 5,577 | +82% | 0 | 0 | — |
▸case-06 Please audit our Terraform IaC configuration files for AWS infrastructure, specifically checking our S3 bucket policy public access block, IAM role trust relationships, and Security Group ingress rules on port 22 across `us-west-2`. Format the evaluation findings as a JSON report. | fail→fail | 12,772 | 15,268 | +20% | 1 | 1 | 0% | 2,974 | 5,481 | +84% | 0 | 0 | — |
▸case-07 Review this Dockerfile for security defects before we push to production: `FROM node:18-alpine WORKDIR /app COPY . . RUN npm install CMD ["node", "server.js"]`. You might think since node runs fine as default, no USER directive is required. Provide your findings in a JSON report containing `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings` (with `id`, `check_type`, `resource_type`, `resource_name`, `severity`, `cvss_score`, `title`, `description`, `cis_control`, `remediation`, `remediation_manifest`), `cis_compliance`, and `summary`. | fail→fail | 17,281 | 13,960 | -19% | 1 | 1 | 0% | 1,935 | 4,462 | +131% | 0 | 0 | — |
▸case-08 Analyze this Pod manifest deployed in cluster `staging-k8s-01`: `apiVersion: v1 kind: Pod metadata: name: monitor-agent spec: hostNetwork: true hostPID: true containers: - name: agent image: internal/agent:1.0`. Common practice in legacy monitoring is to enable hostNetwork and hostPID. Return a JSON security report structured with `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→pass | 13,828 | 13,122 | -5% | 1 | 1 | 0% | 3,300 | 3,809 | +15% | 0 | 0 | — |
▸case-09 Evaluate this ClusterRole manifest for compliance in cluster `prod-us-west`: `apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRole metadata: name: operator-role rules: - apiGroups: ["*"] resources: ["*"] verbs: ["*"]`. Developers often argue operator roles need full wildcard access. Return a JSON assessment containing `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→fail | 8,435 | 7,478 | -11% | 1 | 1 | 0% | 1,978 | 3,717 | +88% | 0 | 0 | — |
▸case-10 Examine namespace `billing-service` in cluster `k8s-east-02`. Currently there are no NetworkPolicy resources defined in this namespace, allowing all ingress and egress traffic by default. DevOps assumes default internal connectivity is fine. Output a JSON audit object with top-level keys `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→pass | 6,834 | 4,637 | -32% | 1 | 1 | 0% | 1,464 | 3,122 | +113% | 0 | 0 | — |
▸case-11 Assess a Pod spec in namespace `app-sec-test` on cluster `k8s-sec-01` where `securityContext` is completely omitted and `readOnlyRootFilesystem` is not specified. Provide a JSON report formatted with `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→fail | 17,134 | 18,700 | +9% | 1 | 1 | 0% | 1,600 | 4,288 | +168% | 0 | 0 | — |
▸case-12 Please run a security audit on our application configs. I haven't specified whether this is Docker or Kubernetes or both yet. Format your response in JSON with `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→pass | 6,575 | 8,926 | +36% | 1 | 1 | 0% | 1,369 | 3,269 | +139% | 0 | 0 | — |
▸case-13 We need a Kubernetes security audit for platform `kubernetes`, but cluster API access is unavailable and `cluster_identifier` is null. We have provided raw YAML deployment manifests for review. Format the analysis in a JSON object with keys `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→fail | 11,251 | 14,501 | +29% | 1 | 1 | 0% | 1,756 | 4,573 | +160% | 0 | 0 | — |
▸case-14 Evaluate two findings on Kubernetes cluster `prod-core-01`: Finding A is a pod running with `securityContext.privileged: true`. Finding B is a RoleBinding granting wildcard permissions to a service account. Output a JSON security evaluation containing `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | pass→pass | 10,468 | 6,695 | -36% | 1 | 1 | 0% | 2,222 | 3,584 | +61% | 0 | 0 | — |
▸case-15 Audit this Docker container configuration: `docker run -d -e DATABASE_PASSWORD="SuperSecretPassword123!" -e API_KEY="sk-live-9988776655" myapp:latest`. Developers often pass passwords in environment variables for convenience. Return a JSON structure with `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→pass | 11,797 | 15,152 | +28% | 1 | 1 | 0% | 2,472 | 5,478 | +122% | 0 | 0 | — |
▸case-16 Audit a Docker run command: `docker run -d --name web-service -p 80:80 nginx:latest` where memory and CPU limits (`--memory`, `--cpus`) are omitted. Some team members claim resource limits are optional for small apps. Provide a JSON response formatted with `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→pass | 10,411 | 10,567 | +1% | 1 | 1 | 0% | 2,297 | 4,406 | +92% | 0 | 0 | — |
▸case-18 Conduct a security assessment specifically focused on RBAC roles and bindings for platform `kubernetes` on cluster `auth-k8s-cluster`. Set `check_scope` to `rbac`. Provide the output in JSON format with top-level keys `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→pass | 23,990 | 23,051 | -4% | 1 | 1 | 0% | 2,595 | 4,332 | +67% | 0 | 0 | — |
▸case-19 Perform a CIS Kubernetes benchmark security check on cluster `k8s-prod-us`. Output the results in a JSON object with `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. Ensure `cis_compliance` details benchmark details and control arrays. | fail→pass | 16,917 | 25,631 | +52% | 1 | 1 | 0% | 2,148 | 5,587 | +160% | 0 | 0 | — |
▸case-20 Audit cluster `k8s-cluster-beta` which has 1 critical finding (privileged container) and 2 high findings (wildcard ClusterRole and missing NetworkPolicy). Output the JSON report with top-level keys `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→pass | 7,192 | 7,467 | +4% | 1 | 1 | 0% | 1,747 | 3,656 | +109% | 0 | 0 | — |
▸case-21 Review this ServiceAccount and ClusterRoleBinding on cluster `k8s-prod-02`: `apiVersion: rbac.authorization.k8s.io/v1 kind: ClusterRoleBinding metadata: name: global-admin-binding subjects: - kind: ServiceAccount name: default namespace: default roleRef: kind: ClusterRole name: cluster-admin apiGroup: rbac.authorization.k8s.io`. Developers bound default service account to cluster-admin for quick testing. Output JSON with `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | fail→pass | 8,866 | 7,318 | -17% | 1 | 1 | 0% | 2,124 | 3,759 | +77% | 0 | 0 | — |
▸case-22 Inspect this Docker image deployment configuration: `docker pull untrusted-registry.io/vendor/app:1.0.0` where Docker Content Trust (DCT) is disabled and image signatures are not verified. Developers feel third-party registries can be trusted blindly. Format your response in a JSON object with keys `platform`, `cluster_identifier`, `check_scope`, `timestamp`, `findings`, `cis_compliance`, and `summary`. | pass→pass | 9,819 | 8,201 | -16% | 1 | 1 | 0% | 2,086 | 3,629 | +74% | 0 | 0 | — |