Drill Hub

Open, tested drills for Firedrill. Each drill checks one safeguard against real systems, read-only, and ships passing, failing and not-applicable test cases.

29 drills in 6 packs ยท built 2026-11-07 13:55 UTC

firedrill hub search <words> firedrill hub add <pack/slug>

access

access/admins-use-mfa Every admin has MFA enforced, beyond merely enrolled. identity.users criticalofficial3 tests access/all-users-use-mfa Every active user, not only admins, has 2-Step Verification enforced. identity.users highofficial3 tests@sk1122 access/leavers-locked-out People who left have no active account. hr.leavers, identity.users criticalofficial3 tests access/no-dormant-admins No admin user or role unused for 90 days, apart from excluded break-glass roles. identity.users, aws.principals highofficial4 tests access/no-shared-prod-keys Staging and production never share a secret. repos, files.secrets highofficial3 tests access/no-unused-aws-keys No IAM user with access keys has gone 90 days without using its credentials. aws.principals mediumofficial4 tests@sk1122

agent

agent/destructive-commands-gated Committed agent settings require approval for destructive commands. repos, files.agent_configs highofficial3 tests agent/no-destructive-tokens AWS keys within an agent's reach cannot delete or run as admin. aws.agent_keys criticalofficial3 tests agent/no-prod-secrets-in-agent-reach No production or unclassified credential sits in a file a coding agent can read. repos, files.secrets, files.agent_configs criticalofficial5 tests agent/no-shared-agent-keys Each agent and MCP server has its own credential. repos, files.agent_configs mediumofficial3 tests

change

change/actions-pinned Third-party GitHub Actions are pinned to a commit. repos, files.workflows mediumofficial3 tests change/code-owner-review Changes to the default branch need approval from the code owners of the files they touch. github.repos, github.branch_rules highofficial4 tests@sk1122 change/human-review-required A human approves every change to main, and new pushes reset approval. github.repos, github.branch_rules, github.actions_permissions highofficial3 tests change/no-force-push-main History on main cannot be rewritten or deleted, by anyone. github.repos, github.branch_rules highofficial3 tests change/no-solo-ship Nobody can merge to main and deploy to production alone. github.repos, github.branch_rules, github.environment, github.actions_permissions criticalofficial6 tests change/prod-deploy-gated Production deploys come only from protected branches, with a reviewer wherever the plan offers one. github.repos, github.environment highofficial4 tests change/workflow-tokens-read-only Every workflow declares read-only token permissions unless a job needs more, and no pull_request_target job checks out pull request code. repos, files.workflows highofficial3 tests

code

code/rules-clean The team's own Semgrep rules report no error-level findings. semgrep.results highofficial3 tests

doors

doors/every-host-owned Every host in the company's public certificates has a named owner. config.domains, ctlog.hosts, config.hosts mediumofficial3 tests doors/no-dangling-dns No CNAME points at a name that no longer resolves, the usual start of a subdomain takeover. config.domains, dns.cnames highofficial3 tests doors/no-public-api-docs Swagger, OpenAPI and runtime config files are not public in production. config.domains, web.api_docs highofficial3 tests doors/no-public-buckets-in-terraform No S3 bucket defined in Terraform is public. repos, files.terraform highofficial3 tests doors/no-public-source-maps Production JavaScript serves no source maps. config.domains, web.source_maps mediumofficial3 tests

gcp

gcp/buckets-uniform-access Every Cloud Storage bucket uses uniform bucket-level access, so no single file can be shared through an object ACL. gcp.projects, gcp.buckets mediumofficial3 tests@sk1122 gcp/no-editor-service-accounts No service account holds Owner or Editor on a Google Cloud project, including the default Compute account. gcp.projects, gcp.iam_bindings highofficial3 tests gcp/no-outside-owners Only accounts in the company's own domains hold Owner or Editor on a Google Cloud project. gcp.projects, gcp.iam_bindings criticalofficial5 tests gcp/no-project-wide-impersonation No person or group can act as every service account in a Google Cloud project. gcp.projects, gcp.iam_bindings highofficial4 tests@sk1122 gcp/no-public-buckets No Cloud Storage bucket is open to everyone on the internet. gcp.projects, gcp.buckets criticalofficial4 tests gcp/sa-keys-short-lived No user-managed service account key is older than 90 days or unused for 90 days. gcp.projects, gcp.sa_keys highofficial4 tests

Drills are YAML with named facts and CEL conditions. They cannot run code, and every call Firedrill makes for them is read-only. Licensed Apache-2.0.