The Terraform checks that map to real incidents
The built-in set is deliberately small and targets AWS Terraform. Each rule is a Rego module you can open, and each finding carries its weakness classification: object storage readable by anyone, security groups open to the internet, databases with a public endpoint, policies granting a wildcard action or resource, volumes without encryption at rest, the instance metadata version a request forgery can read credentials from, and cluster API endpoints exposed publicly.
Bring the coverage you already trust
Regula, KICS, Trivy and other Open Policy Agent rule sets are available through the registry and load with one flag. They run in the same engine, produce the same SARIF, and answer to the same quality gate as everything else in the scan.
What is in the built-in set, and what is not
The built-in rules target AWS Terraform. Azure, Google Cloud, CloudFormation, Pulumi, Bicep and Ansible coverage comes from the rule packs, not from the binary. Nix flakes contribute dependency extraction rather than misconfiguration rules. Kubernetes and Helm files are parsed for the images they reference, which are analysed by container scanning, and there are no built-in Kubernetes security rules. Absence of a finding is not verified absence of risk.
Kubernetes manifests, Helm charts and container build files are covered by container scanning, credentials committed into a variables file by secrets scanning, and provider licences by licence compliance.