Code
Audit your infrastructure code
The misconfigurations that actually reach production, ranked by blast radius.
Fill it in
Where the Terraform or manifests live.
Not by scanner severity.
The actual diff, not a description.
Your prompt
Audit the infrastructure code in [the repo]. Look for what actually reaches production: a security group open to the world, an unencrypted bucket, an over-permissive role, public snapshots, and logging that was never turned on. Those are the ones that appear in breach reports; the rest of a scanner's output is noise around them. Rank by BLAST RADIUS, not by scanner severity. A medium finding on the role your CI assumes is worse than a high on a sandbox, and severity labels cannot see that difference. Write the fixes as a diff. A finding with a remediation paragraph gets read; one with a patch gets merged. Say which findings are accepted risk rather than mistakes, if the code suggests somebody decided deliberately.
Use Audit your infrastructure codeOpens with everything above already filled in.
Why this works
Scanner severity cannot see blast radius: a medium finding on the role your CI assumes is worse than a high on a sandbox. This ranks by what an attacker reaches and writes the fixes as a diff, because a finding with a patch gets merged.