[Sandbox] Terrascan

### Application contact email(s)

prai@tenable.com, tlikhar@tenable.com, nbajaj@tenable.com, bhollowed@tenable.com, vchhabria@tenable.com, cajah@tenable.com

### Trademark and accounts

- [x] If the project is accepted, I agree to donate all project trademarks and accounts to the CNCF

### Contributing or sponsoring entity contact email(s)

N/A

### Project summary

Terrascan is a static code analyzer for Infrastructure as Code(IaC).

### Project description

Terrascan is an open source static code analyzer that helps secure modern infrastructure by detecting compliance and security violations across Infrastructure as Code (IaC). It enables DevOps teams to identify misconfigurations and policy violations before infrastructure is provisioned, reducing risk and accelerating secure cloud-native deployments.

Terrascan supports a wide range of IaC providers including Terraform, Kubernetes YAML, Helm, Kustomize, and AWS CloudFormation. It uses a powerful policy-as-code engine built on Open Policy Agent (OPA), offering hundreds of out-of-the-box security and compliance policies while allowing teams to define and enforce custom rules tailored to their organization’s requirements.

By integrating seamlessly into CI/CD pipelines, GitOps workflows, and developer tools, Terrascan enables organizations to adopt a shift-left security approach—catching issues early in the development lifecycle. This improves security posture, ensures regulatory compliance, and enhances the reliability of cloud-native infrastructure.

### Org repo URL (provide if all repos under the org are in scope of the application)

N/A

### Project repo URL in scope of application

https://github.com/tenable/terrascan

### Additional repos in scope of the application

_No response_

### Website URL

https://runterrascan.io/

### Roadmap

N/A

### Roadmap context

N/A

### Contributing guide

https://github.com/tenable/terrascan/blob/master/CONTRIBUTING.md

### Code of Conduct (CoC)

https://github.com/tenable/terrascan/blob/master/code_of_conduct.md

### Adopters

_No response_

### Maintainers file

https://github.com/orgs/tenable/teams/terrascan-maintainers?query=role%3Amaintainer

### Security policy file

https://github.com/tenable/terrascan?tab=security-ov-file

### IP policy

- [x] If the project is accepted, I agree the project will follow the CNCF IP Policy

### Will the project require a license exception?

N/A

### Standard or specification?

N/A

### Why CNCF?

We believe CNCF is the best home for Terrascan because it ensures open governance, accelerates community adoption, and aligns with our shared mission to secure cloud-native infrastructure. Being part of CNCF will help Terrascan mature, integrate deeply with other CNCF projects, and stay vendor-neutral, ultimately benefiting both the project and the broader ecosystem.

### Benefit to the landscape

Terrascan enhances the CNCF landscape by providing a robust, open source static analysis tool designed to detect security misconfigurations and compliance violations in Infrastructure as Code (IaC). It supports widely used IaC frameworks like Terraform, Kubernetes, Helm, and more. By integrating security checks early into the development lifecycle, Terrascan helps teams shift security left, reduce risk, and improve the overall security posture of cloud-native deployments, aligning well with CNCF’s goals of fostering secure, scalable, cloud-native ecosystems.

### Cloud native 'fit'

Terrascan sits at the intersection of cloud native security, DevSecOps, and policy enforcement, ensuring that infrastructure is secure and compliant before it is deployed into cloud native environments. It helps teams achieve secure, automated, declarative, and resilient infrastructure — key tenets of the cloud native paradigm.

### Cloud native 'integration'

Terrascan itself is intentionally lightweight and doesn’t have runtime dependencies on other CNCF projects — it’s designed to run locally, in CI/CD, or inside build systems. However:

- It leverages OPA/Rego under the hood for policy evaluation. While it embeds OPA, its approach is aligned with and dependent on the open policy ecosystem OPA defines.
- It integrates with Kubernetes tools (like kubectl, Helm, and YAML manifests) as input sources. So while it does not strictly depend on these projects at runtime, it is deeply aligned with them.

### Cloud native overlap

Terrascan’s primary overlap is with CNCF projects like OPA/Gatekeeper and Kyverno, which also enforce policies on Kubernetes resources. However, Terrascan addresses these concerns earlier in the SDLC by scanning IaC files across multiple formats (Kubernetes, Terraform, Helm, CloudFormation) in CI/CD pipelines, complementing runtime and admission-based tools. It also overlaps conceptually with Kubernetes-focused security scanners (like Kubescape), but differentiates through multi-IaC coverage and a developer-first shift-left approach.

### Similar projects

N/A

### Landscape

N/A

### Business Product or Service to Project separation

This project is unrelated to any product or service.

### Project "Domain Technical Review"

_No response_

### CNCF contacts

_No response_

### Additional information

_No response_

This is a CNCF Sandbox application rather than an implementation task. Read the Terrascan repository and its CONTRIBUTING.md, then review the application sections and existing comments for the information needed by reviewers. Done would require a project-review decision, not a code change.

Written by the indexing model from the issue text.