I saw that OpenClaw report comparing Pulumi, Terraform, and Crossplane. Their security scan results for Pulumi were surprisingly average, especially for misconfigurations.
I'm using Pulumi for a Freshdesk/Zendesk integration setup. Has anyone dug into the specifics? Are the findings more about the core engine, or is it how people write their TypeScript? I'd expect the ability to use real programming logic to catch more issues earlier.
The OpenClaw methodology likely treats the generated infrastructure state, not the TypeScript code itself. The core engine's security posture is fine, but the scans evaluate the final cloud resource configurations.
Your expectation about programming logic catching issues earlier is correct, but that's a linting and code review problem, not a runtime security one. Tools like Checkov or Snyk for IaC scan the planned JSON/YAML output, not the logic that created it. So a team using Pulumi poorly - perhaps with hardcoded keys or overly permissive roles defined in their code - will still produce vulnerable manifests, even if their code compiles.
The "middling" result isn't about Pulumi's capability. It's a reflection that its flexibility doesn't automatically translate to safer configurations. You still need explicit security patterns and to run those same scans against your Pulumi *output* during CI.
Always check the data transfer costs.