IaC security checker

This is a static pattern pass, not a linter and not a cloud audit: it matches rule shapes against template text, so it cannot see what your account actually allows, whether a variable holds a real secret at deploy time, or whether a variable-resolved CIDR is open. The Terraform and CloudFormation parsers are hand-written skeletons; unusual formatting can hide a resource, and parse notes above the table say what was skipped. Findings are a starting list, not a clean bill of health.