Show HN: A security product for cloud misconfigurations

As more organizations migrate to the cloud, developers are increasingly responsible for managing cloud resources. However, many developers—especially those without a cybersecurity background—may not realize how easily a misconfiguration can lead to serious security risks. From accidentally exposing storage buckets to the internet, to granting overly broad permissions, small mistakes can have big consequences.

That’s where CloudRec comes in. CloudRec is an open-source Cloud Security Posture Management (CSPM) platform designed to help developers and organizations secure their cloud environments across multiple providers, including AWS, Alibaba Cloud, and GCP.

Why should developers care about cloud security? Cloud platforms offer flexibility and scalability, but they also introduce a shared responsibility model: while the provider secures the infrastructure, you are responsible for configuring your resources securely. Common misconfigurations--like open databases, weak identity policies, or missing audit logs--are among the leading causes of data breaches.

What does CloudRec do?

1. Asset Discovery: Automatically scans and inventories your cloud resources across multiple providers, giving you visibility into what’s running in your environment.

2. Risk Detection: Continuously checks configurations against real-world security rules. For example, it can flag databases that are publicly accessible or detect overly permissive network rules.

3. Custom Policies: Uses Open Policy Agent (OPA) for flexible, declarative security policies. You can adapt rules to your organization’s needs without redeploying.

4. Multi-Cloud Support: Built-in support for AWS, Alibaba Cloud, GCP, and extensibility for others.

5. User-Friendly Interface: Provides a web UI for managing assets, editing rules, and tracking risks—no deep security expertise required.

Getting started is easy: CloudRec offers a DockerCompose-based quick start, so you can deploy the platform locally or in your environment with just one-line command.

Why open source? Transparency and community-driven development are critical in security. By being open source, CloudRec invites contributions and scrutiny, helping ensure the platform remains trustworthy and up-to-date.

If you’re a developer working with the cloud--even if security isn’t your main focus--CloudRec can help you avoid common pitfalls and strengthen your cloud posture. Check out the project on GitHub or try the live demo at demo.cloudrec.cloud.