Freedom251 › Infrastructure as Code Security Software
Winfunc Infrastructure Scanner
What Winfunc Infrastructure Scanner is
Winfunc Infrastructure Scanner examines infrastructure-as-code, cloud configurations, and container definitions for misconfigurations, exposed secrets, and compliance violations before production. It supports Terraform, CloudFormation, Pulumi, Kubernetes manifests, and Dockerfiles. Cloud analysis reviews IAM policies, identifies network exposure and storage misconfigurations, and checks for drift between declared infrastructure and actual cloud state. It maps CIS Benchmark compliance for AWS, GCP, and Azure using provider APIs for real-time posture assessment. Container scans cover known CVEs, permissions, and base images, with CI pre-deploy gates. Findings are prioritized by severity and business context, with suggested fixes and IaC patch generation. Compliance mapping includes CIS, SOC 2, ISO 27001, PCI DSS, and HIPAA, with audit-ready reports containing evidence and remediation guidance. Deployment can be self-hosted on premises or in a private cloud, keeping data within the customer’s perimeter. Winfunc says source code is processed in memory and discarded after analysis, while finding metadata is retained. A one-time surface scan costs 500.00 USD; deep scans are priced by scope.
Who it suits
The scanner suits teams assessing infrastructure configurations and cloud posture before production. Its enterprise options and customer-controlled hosting may also fit regulated teams, based on the listed terms and deployment choices.
What it does well
- Supports Terraform, CloudFormation, Pulumi, Kubernetes, and Dockerfiles.
- Assesses AWS, GCP, and Azure configurations.
- Findings include suggested fixes and IaC patch generation.
- Offers self-hosted deployment within the customer perimeter.
- Source code is discarded after analysis.
What to know first
- No free plan is listed.
- One-time surface scans cost 500.00 USD.
- Deep scan pricing depends on scope.
Limits
The one-time plan covers one surface or deep scan, with deep scans priced by scope. Pay-as-you-go uses purchased credits, while recurring allowances renew monthly; exact recurring allowance and discount are confirmed on a pricing call.
Plans
| Plan | Billed and limits | Price |
|---|---|---|
| One-time | from $500 per surface scan; deep scan priced by scope · one surface or deep scan · findings workspace and report · prioritized findings · suggested remediation · no subscription | $500, paid once |
| Recurring | monthly credit allowance; discounted annual billing · everything in Pay as you go · allowance renews monthly · reconciled usage per scan | On request |
| Enterprise | committed usage; terms set in agreement · customer-controlled hosting · isolated tenants · bring-your-own model keys · organization policies · named support | On request |
| Pay as you go | credits bought as needed · incremental, scheduled and pull-request review · reproduction evidence where feasible · patch pull requests · AI triage · MCP · team access · Slack alerts · analytics | On request |
As winfunc.com lists them, read 21 Oct 2026. The maker's own page has the final word.
Getting started
- Open the Infrastructure Scanner website
- Choose API, self-hosted, or web deployment
- Select a one-time, pay-as-you-go, recurring, or Enterprise plan
- Connect a listed code, CI, ticketing, messaging, or developer integration
- Submit Terraform, CloudFormation, Pulumi, Kubernetes, Dockerfile, or container inputs for scanning
- Review prioritized findings and generated remediation guidance
Verdict
Winfunc covers infrastructure code, cloud posture, container checks, and compliance reporting, with both hosted and self-hosted deployment options. The listed one-time price is $500 per surface scan; deep scans and other plans have no fixed price listed.
Questions
How much does a one-time scan cost?
The One-time plan costs $500 per surface scan. Deep scans are priced by scope.
Is there a free plan?
No. Winfunc Infrastructure Scanner is listed as paid with no free plan.
Which infrastructure formats are supported?
Supported formats include Terraform, CloudFormation, Pulumi, Kubernetes manifests, and Dockerfiles.
Can it be self-hosted?
Yes. Self-hosted deployment is available on premises or in a private cloud, keeping data within the customer perimeter.
Which compliance frameworks are mapped?
Findings map to CIS, SOC 2, ISO 27001, PCI DSS, and HIPAA.
What happens to source code after analysis?
Source code is processed in memory and discarded after analysis; only finding metadata is retained.
Facts from Winfunc Infrastructure Scanner's own pages
- Access model
- The web security console is invite-only and requires signing in with an invited GitHub account. · app.winfunc.com, 21 Oct 2026
- API and keys
- Enterprise documentation says API and MCP keys are stored as SHA-256 hashes and can be revoked. · winfunc.com, 21 Oct 2026
- Cloud analysis
- Reviews cloud IAM policies, detects network exposure and storage misconfigurations, and checks for drift between declared infrastructure and actual cloud state. · winfunc.com, 7 Oct 2026
- Cloud integrations
- Cloud-provider API connections provide real-time posture assessment for AWS, GCP and Azure. · winfunc.com, 21 Oct 2026
- Cloud posture
- Continuous cloud assessment compares environments with CIS benchmarks and detects drift from declared infrastructure. · winfunc.com, 21 Oct 2026
- Cloud providers
- Maps CIS Benchmark compliance for AWS, GCP, and Azure and uses cloud provider APIs for real-time posture assessment. · winfunc.com, 7 Oct 2026
- Code retention
- The Trust Center says source code is processed in memory and discarded after analysis, retaining only finding metadata. · winfunc.com, 7 Oct 2026
- Company backing
- The maker says it is backed by Y Combinator's Summer 2024 batch. · winfunc.com, 21 Oct 2026
- Company founding
- Stition, Inc. was incorporated in Delaware in 2024. · winfunc.com, 21 Oct 2026
- Compliance frameworks
- Maps findings to CIS, SOC 2, ISO 27001, PCI DSS, and HIPAA and offers audit-ready reports with evidence and remediation guidance. · winfunc.com, 7 Oct 2026
- Compliance mapping
- Findings can be mapped to CIS, SOC 2, ISO 27001, PCI DSS and HIPAA with evidence-based reports. · winfunc.com, 21 Oct 2026
- Containers
- Scans Dockerfiles and container images for known CVEs, misconfigured permissions, and insecure base images, with CI pre-deploy gates. · winfunc.com, 7 Oct 2026
- Container scanning
- Dockerfiles and Docker images are checked for CVEs, permission problems and insecure base images. · winfunc.com, 21 Oct 2026
- Data retention
- The security terms state that source code is analyzed in ephemeral workspaces and deleted after each scan while findings are retained. · winfunc.com, 21 Oct 2026
- Deployment
- The Trust Center describes self-hosted deployment on premises or in a private cloud, with data remaining within the customer’s perimeter. · winfunc.com, 7 Oct 2026
- Documentation depth
- Product pages link to documentation, but no public API or SDK reference with endpoint details is presented on the reviewed pages. · winfunc.com, 21 Oct 2026
- Hypothesis scans
- A hypothesis scan turns a bounded security question into a repository-scoped investigation with traces, supporting evidence, conclusions and limitations. · winfunc.com, 21 Oct 2026
- IaC support
- The infrastructure scanner supports Terraform, CloudFormation and Pulumi templates. · winfunc.com, 21 Oct 2026
- IAM review
- Cloud IAM analysis identifies overly permissive roles and unused credentials. · winfunc.com, 21 Oct 2026
- Independent company profile
- Y Combinator describes Winfunc as an active San Francisco SaaS, B2B security and AI company. · ycombinator.com, 21 Oct 2026
- Independent employee fact
- LinkedIn names Vivek R and Mufeed VH among the employees shown for winfunc. · linkedin.com, 21 Oct 2026
- Independent founders fact
- Y Combinator lists Mufeed VH as founder/CEO and Vivek R as founder/CTO. · ycombinator.com, 21 Oct 2026
- Independent news
- LinkedIn reports that Winfunc-associated research found two NGINX CVEs while scans cost under $100 and generated $4,500 in Chrome VRP bounties. · linkedin.com, 21 Oct 2026
- Independent size fact
- LinkedIn lists winfunc as privately held with 2–10 employees. · linkedin.com, 21 Oct 2026