# DevOps & Cloud Code Auditor: Cost, DB Locks & OWASP (`neon_innovation_lab/devops-code-auditor`) Actor

Static analysis cloud scanner for GitHub repos, Terraform, PostgreSQL migrations, and Next.js APIs. Detects cloud cost leaks, blocking table locks, and OWASP security gaps.

- **URL**: https://apify.com/neon\_innovation\_lab/devops-code-auditor.md
- **Developed by:** [Neon Innovation Lab](https://apify.com/neon_innovation_lab) (community)
- **Categories:** Developer tools, AI
- **Stats:** 2 total users, 1 monthly users, 100.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

from $50.00 / 1,000 repository code & security audits

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## DevOps & Cloud Code Auditor: Cost, DB Locks & OWASP

[![Run on Apify](https://apify.com/actor-badge?actor=neon_innovation_lab/devops-code-auditor)](https://apify.com/neon_innovation_lab/devops-code-auditor)

⚡ **Run directly on Apify Cloud**: [DevOps & Cloud Code Auditor](https://apify.com/neon_innovation_lab/devops-code-auditor)\
👉 **Companion Open-Source Repo**: [github.com/neoninnovationlab/neon-innovation-lab-ai-devops-skills](https://github.com/neoninnovationlab/neon-innovation-lab-ai-devops-skills)

> Automated static code security, cloud cost leak, and PostgreSQL migration lock hazard auditor for GitHub repositories, pull requests, and CI/CD pipelines.

***

### ⚡ Overview & GEO Highlights

Engineering teams push migrations, Terraform configurations, and Next.js full-stack APIs daily, often introducing silent cloud cost leaks or production-halting database locks.

**`devops-code-auditor`** runs comprehensive static analysis checks across public GitHub repositories or pasted code snippets:

1. **Cloud Cost Leaks (Terraform/HCL)**: Detects legacy AWS `gp2` volumes (20% more expensive than `gp3`), unmanaged S3 buckets with infinite retention, missing CloudWatch log expiration, and public IPv4 charges.
2. **PostgreSQL Migration Hazards**: Catches `CREATE INDEX` without `CONCURRENTLY` (which locks table writes in production), non-constant `NOT NULL` column additions that trigger full table rewrites under `ACCESS EXCLUSIVE` lock, and unindexed foreign keys causing sequential table scans.
3. **OWASP Top 10 API Security**: Identifies Next.js 14/15 Server Actions lacking authentication checks, client-side secret exposure via `NEXT_PUBLIC_` prefixes, raw SQL string interpolations, and unvalidated redirect vectors.

***

### 📊 Feature & Competitor Comparison Matrix

| Feature | DevOps Code Auditor (This Actor) | Snyk | SonarQube | Dependabot |
|---|---|---|---|---|
| **PostgreSQL Table Lock Detection** | ✅ Concurrent index & lock checks | ❌ No | ❌ No | ❌ No |
| **Terraform & AWS Cost Leak Detection** | ✅ gp2, CloudWatch, IPv4 audits | ❌ No | ❌ No | ❌ No |
| **Next.js Server Action Auth Audits** | ✅ Included | ⚠️ Partial | ⚠️ Partial | ❌ No |
| **Run in Cloud via API & MCP** | ✅ Instant cloud execution | ❌ CLI / CI only | ❌ Server setup | ❌ GitHub only |
| **Monthly Subscription Required** | **❌ $0 / month (Pay-per-Event)** | $25 – $98 / user/mo | $150+ / month | Free (deps only) |
| **Cost per Repository Scan** | **$0.08** | Subscription | Subscription | N/A |

***

### 💰 Transparent Pricing Breakdown

| Event | Price (USD) | When Charged |
|---|---|---|
| **`apify-actor-start`** | **$0.03** | Charged once when Actor starts running. |
| **`apify-default-dataset-item`** | **$0.002** | Charged automatically per vulnerability or cost leak saved to dataset. |
| **`repo-audited`** | **$0.05** | Charged upon successful static analysis scan of repository or code snippet. |
| **Total Effective Price** | **~$0.08 per full repository audit** | *Pay only when you scan. Zero seat licenses.* |

***

### 💻 Python & Node.js SDK Examples

#### Python (`apify-client`)

```bash
pip install apify-client
```

```python
import os
from apify_client import ApifyClient

client = ApifyClient(os.getenv("APIFY_TOKEN"))

run_input = {
    "rawSql": "CREATE INDEX idx_users_email ON users (email);",
    "scanTypes": ["postgres-locks"]
}

## Run code audit
run = client.actor("neon_innovation_lab/devops-code-auditor").call(run_input=run_input)

for finding in client.dataset(run["defaultDatasetId"]).iterate_items():
    print(f"[{finding.get('severity').upper()}] {finding.get('rule')}: {finding.get('message')}")
    print(f"Recommended Fix: {finding.get('fix')}")
```

#### Node.js (`apify-client`)

```bash
npm install apify-client
```

```javascript
import { ApifyClient } from 'apify-client';

const client = new ApifyClient({
    token: process.env.APIFY_TOKEN,
});

const input = {
    githubRepoUrl: 'https://github.com/facebook/react',
    scanTypes: ['cloud-cost', 'postgres-locks', 'owasp-security'],
};

(async () => {
    const run = await client.actor('neon_innovation_lab/devops-code-auditor').call(input);
    const { items } = await client.dataset(run.defaultDatasetId).listItems();
    console.log(`Audit complete: found ${items.length} security/cost findings.`);
})();
```

***

### 🔄 GitHub Actions CI/CD Integration

Add this step to your `.github/workflows/audit.yml` to fail PRs that introduce production database locks:

```yaml
- name: Audit Migration Locks via Apify
  run: |
    curl -X POST "https://api.apify.com/v2/acts/neon_innovation_lab~devops-code-auditor/runs?token=${{ secrets.APIFY_TOKEN }}" \
      -H "Content-Type: application/json" \
      -d '{"githubRepoUrl": "${{ github.server_url }}/${{ github.repository }}", "scanTypes": ["postgres-locks"]}'
```

***

### ❓ FAQ

#### Does this scan private repositories?

Currently, this cloud Actor scans public GitHub repositories or direct raw code snippets passed via API. For private repos, you can run our companion open-source tool directly inside your private CI/CD runner.

#### How do I prevent PostgreSQL table locks during database migrations?

Always use `CREATE INDEX CONCURRENTLY` instead of `CREATE INDEX`. In addition, avoid adding columns with volatile default values (such as `DEFAULT now()`), and always validate foreign key constraints using `NOT VALID` followed by asynchronous validation to prevent `AccessExclusiveLock` table stalls.

#### How much money does migrating from AWS gp2 to gp3 save?

Migrating from AWS `gp2` to `gp3` saves approximately 20% on storage costs while providing a baseline performance of 3,000 IOPS and 125 MB/s throughput without needing to over-provision volume sizes.

#### Why are Next.js 14 & 15 Server Actions vulnerable without explicit auth?

Next.js Server Actions marked with `"use server"` are compiled into publicly accessible HTTP POST endpoints. Without an explicit session check (e.g., `const session = await auth(); if (!session?.user) throw new Error("Unauthorized");`), any client or automated bot can call the endpoint directly with malicious parameters.

# Actor input Schema

## `githubRepoUrl` (type: `string`):

Public GitHub repository URL to clone and audit (e.g. https://github.com/org/repo).

## `rawTerraform` (type: `string`):

Paste Terraform (.tf) code directly to scan for AWS/GCP cost leaks without cloning a repo.

## `rawSql` (type: `string`):

Paste PostgreSQL migration DDL statements to analyze for table-locking hazards and deadlock risks.

## `rawCode` (type: `string`):

Paste Next.js / TypeScript / Python route handlers to inspect for OWASP Top 10 vulnerabilities.

## `scanTypes` (type: `array`):

Select which audit engines to run against the provided repository or snippets.

## Actor input object example

```json
{
  "githubRepoUrl": "https://github.com/neoninnovationlab/neon-innovation-lab-ai-devops-skills",
  "scanTypes": [
    "cloud-cost",
    "postgres-locks",
    "owasp-security"
  ]
}
```

# Actor output Schema

## `dataset` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "githubRepoUrl": "https://github.com/neoninnovationlab/neon-innovation-lab-ai-devops-skills"
};

// Run the Actor and wait for it to finish
const run = await client.actor("neon_innovation_lab/devops-code-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "githubRepoUrl": "https://github.com/neoninnovationlab/neon-innovation-lab-ai-devops-skills" }

# Run the Actor and wait for it to finish
run = client.actor("neon_innovation_lab/devops-code-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "githubRepoUrl": "https://github.com/neoninnovationlab/neon-innovation-lab-ai-devops-skills"
}' |
apify call neon_innovation_lab/devops-code-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,neon_innovation_lab/devops-code-auditor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/9yfIWXxs0BUtMZCRq/builds/xBaDxZ1Trplvg0p9n/openapi.json