Paste your docker-compose.yml below. Get an instant A–F security grade with every issue explained and a fix snippet. Your file never leaves this page — the analysis runs entirely in your browser.
No. The YAML parser and all checks run in JavaScript in your browser. Nothing is sent to any server — you can verify in your browser's network tab, or disconnect from the internet and it still works.
Every service starts at 100. Critical issues cost 25 points, high 12, medium 6, low 2. A: 90+, B: 78+, C: 62+, D: 45+, F: below 45. Multiple issues stack — a file can score below zero and still show F.
No — this is a static configuration check, not a guarantee. It doesn't scan your images for CVEs, audit your application code, or check your firewall. Treat the grade as "configuration hygiene," one layer of a real security posture.
The subset docker-compose files actually use: nested maps, lists, quoted and unquoted scalars, comments, and the long (map) syntax for ports. Exotic YAML features (anchors, multi-line blocks) may not parse — if it fails, simplify or paste one service at a time.
:latest moves under you — a redeploy can silently pull a different, possibly vulnerable build, and you can't roll back to the exact image you tested. Pinning a version or digest makes deploys reproducible.
Heuristic static analysis for education and hardening. It finds misconfigurations; it is not a penetration test and not a substitute for one.