xss, headers, exposed routes
base images, os packages
sast, vulnerable packages
cloud config, iam, buckets