Infrastructure Config Hardening API Documentation

POSThttps://www.brainiac.software/api/v1/devops/config-hardening-grade$0.04 USDC

Grade infrastructure config hardening

Grade a caller-supplied Dockerfile, Kubernetes YAML document, or Terraform JSON file for root execution, exposed ports, missing resource limits, and insecure defaults. Parsing stays in memory. The file is not applied, fetched, or stored.

Body

Field	Required	Notes
`config`	Yes	string

Request exampleJSON

{
  "config": "FROM ubuntu:latest\nUSER root\nEXPOSE 22\nRUN curl https://example.com/install.sh | sh\nCMD [\"bash\"]\n"
}

Response exampleJSON

{
  "security_grade": "F",
  "vulnerability_percentage": 100,
  "prioritized_findings": [
    {
      "code": "runs_as_root",
      "line": 2,
      "block": "USER root",
      "detail": "The last USER in the final stage is root.",
      "remediation": "Add a USER instruction with a non-root uid before the final command.",
      "impact_score": 34
    },
    {
      "code": "piped_remote_script",
      "line": 4,
      "block": "RUN curl https://example.com/install.sh | sh",
      "detail": "A remote script is piped into a shell. The script was not downloaded or executed.",
      "remediation": "Download a pinned script, check its checksum, and run that file.",
      "impact_score": 30
    },
    {
      "code": "exposed_sensitive_port",
      "line": 3,
      "block": "EXPOSE 22",
      "detail": "Port 22 is published by EXPOSE. This records the port in the image metadata. It does not open a host firewall.",
      "remediation": "Remove the sensitive port or publish a non-default application port instead.",
      "impact_score": 28
    },
    {
      "code": "floating_image_tag",
      "line": 1,
      "block": "FROM ubuntu:latest",
      "detail": "The base image has no pinned tag or uses latest. A later pull can change the image.",
      "remediation": "Pin the image to a version tag or a sha256 digest.",
      "impact_score": 18
    },
    {
      "code": "missing_healthcheck",
      "line": 5,
      "block": "CMD [\"bash\"]",
      "detail": "The final stage has no HEALTHCHECK. Docker will not mark the container unhealthy on its own.",
      "remediation": "Add a HEALTHCHECK that calls the process readiness endpoint.",
      "impact_score": 8
    }
  ],
  "audit_receipt": "sha256:fba37df1e56ca384b4942834c386359eab0c441bf7843afdb7f2fb7faf995c31"
}

cURL

curl -i -X POST "https://www.brainiac.software/api/v1/devops/config-hardening-grade" \
  -H 'content-type: application/json' \
  -H 'Idempotency-Key: <fresh-64-character-random-hex-key>' \
  --data-binary @- <<'JSON'
{
  "config": "FROM ubuntu:latest\nUSER root\nEXPOSE 22\nRUN curl https://example.com/install.sh | sh\nCMD [\"bash\"]\n"
}
JSON