Will It Vibe?RBAC rule allows all verbs
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 15 points from that category, once per scan, no matter how many places it turns up.
What it detects
A Role or ClusterRole lists verbs: ["*"], granting every action (including delete and impersonate) on the matched resources.
Why it matters
A Role or ClusterRole with verbs: ["*"] grants every action on the matched resources, including delete, patch, and in some cases impersonate and escalate. That is far more than most workloads use and turns a compromised token into a powerful one. RBAC is meant to be least privilege, and a verb wildcard abandons that.
How to fix it
Replace verbs: ["*"] with the explicit verbs the subject needs, such as ["get", "list", "watch"] for a read-only controller. Check the workload code or its client calls to enumerate the real set, then grant only those. Split read and write access into separate roles where it clarifies intent.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo