Will It Vibe?RBAC rule allows all resources
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
A Role or ClusterRole lists resources: ["*"], widening the grant to every resource type in the matched API groups.
Why it matters
resources: ["*"] in an RBAC rule extends the grant to every resource type in the listed API groups, including ones the workload never touches such as secrets or configmaps. Combined with broad verbs it is close to full access. Least privilege means naming the resources the workload actually uses.
How to fix it
Replace resources: ["*"] with the specific resource names the subject needs, for example ["pods", "pods/log"]. Keep secrets out of the list unless the workload genuinely reads them. If several resource types are needed, list them explicitly rather than reaching for the wildcard.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo