helmsniff is a command-line tool written in Go that scans rendered Kubernetes and Helm manifests for security misconfigurations. It walks through YAML files in a given directory (or reads from stdin) and produces a CSV or JSON report. Each row starts with two context columns—parent directory (chart) path and full YAML file path—followed by one column per security check. Checks include things like privileged containers (SEC_CONT_OVER_PRIVIL), missing resource limits (NO_RESO), hostNetwork usage (TRUE_HOST_NET), and many more. Violations are marked as “1,” safe settings as “0,” while K8S_STATUS and HELM_STATUS show true/false. To run it, you need Go 1.22 or higher and GNU Make. Building is as simple as “make build,” which compiles the binary to bin/helmsniff. A typical scan looks like “./bin/helmsniff --root rendered_dir --out report.csv.” You can switch to JSON output with “--format json.” If you have multiple charts, you can feed them in parallel using GNU parallel. It also supports piping Helm template output directly into helmsniff, eliminating temporary files. The code lives under helmsniff/ with a clear structure. cmd/main.go handles flags, directory walking, and output formatting. Under internal you’ll find config/constants.go for CSV headers, parser/parser.go for loading YAML docs, and scanner/ for orchestrating the checks (scanner.go), defining the row data structure (row.go), and individual checks (security_checks.go). Tests accompany parsers and scanners. Makefile targets cover build, clean, tidy, vet, lint, and test. An ARCHITECTURE.md file explains design choices and details each security check.