Ferrule

Ferrule reviews Terraform for security and design problems without sending a byte of it anywhere. A deterministic rule engine — 52 rules across AWS, Azure, GCP and Terraform hygiene, every one with a known-bad and a known-good fixture test — finds the issues inside your browser. Optionally, a language model running on your own GPU explains each finding in plain English and suggests what to fix first. Two ways to scan: • A folder on this machine — no token, no account, no network requests at all. • A GitHub repository — with a fine-grained token that has Contents: read-only. What it catches: world-open security groups and firewall rules, wildcard IAM, unencrypted storage and databases, public buckets, missing logging, weak TLS, and expression-hidden problems like a world-open CIDR behind a variable default. Suppress a finding with a # ferrule:ignore comment in your Terraform; suppressed findings are listed, never silently dropped. See what changed since your last scan, and export the report as Markdown or self-contained HTML. Privacy is the design, not a promise. The extension installs with access to exactly one host, api.github.com, used only when you scan a repository. The optional model download asks for Hugging Face access the first time you use it, and the settings page hands that access back. Independent full-tree privacy audits — including the two findings that failed — are published verbatim in the repository. Open source, MIT licensed: github.com/Erya-Labs/Ferrule