macos kics via homebrew hanging

[jessefarinacci]

Hello KICS friends, I'm a new user so I easily may be doing something obviously wrong here, but I can't get any output from KICS using the Homebrew install while on MacOS in a fairly small IAC project:

❯ brew info kics
==> kics ✔: stable 2.1.20 (bottled), HEAD
Detect vulnerabilities, compliance issues, and misconfigurations
https://kics.io/
Installed (on request)
/opt/homebrew/Cellar/kics/2.1.20 (14,268 files, 135.2MB) *
  Poured from bottle using the formulae.brew.sh API on 2026-04-16 at 11:51:10
From: https://github.com/Homebrew/homebrew-core/blob/HEAD/Formula/k/kics.rb
License: Apache-2.0
==> Options
--HEAD
	Install HEAD version
==> Caveats
KICS queries are placed under /opt/homebrew/opt/kics/share/kics/assets/queries
To use KICS default queries add KICS_QUERIES_PATH env to your ~/.zshrc or ~/.zprofile:
    "echo 'export KICS_QUERIES_PATH=/opt/homebrew/opt/kics/share/kics/assets/queries' >> ~/.zshrc"
usage of CLI flag --queries-path takes precedence.
==> Analytics
install: 532 (30 days), 1,146 (90 days), 3,724 (365 days)
install-on-request: 531 (30 days), 1,145 (90 days), 3,724 (365 days)
build-error: 0 (30 days)

❯ env | grep KICS
KICS_LIBRARIES_PATH=/opt/homebrew/Cellar/kics/2.1.20/share/kics/assets/libraries
KICS_QUERIES_PATH=/opt/homebrew/Cellar/kics/2.1.20/share/kics/assets/queries

❯ cat *.tf | wc -l
436

❯ tofu state list | wc -l
137

---

KICS seems to run fine via Docker:

❯ docker run -t -v $(pwd):/path checkmarx/kics:v2.1.20-debian kics scan -p /path
Scanning with Keeping Infrastructure as Code Secure v2.1.20
Preparing Scan Assets: Done
Executing queries: [---------------------------------------------------] 100.00%
Variable Without Description, Severity: INFO, Results: 35
Description: All variables should contain a valid description.
Platform: Terraform
CWE: 710
Risk Score: 0.0
[snip result details]
Results Summary:
CRITICAL: 0
HIGH: 0
MEDIUM: 0
LOW: 0
INFO: 42
TOTAL: 42

KICS just hangs when executed from Homebrew, 10+ minutes can pass without progress before I ^C out:

❯ kics scan --log-level DEBUG -p .
9:02AM DBG console.scan()
9:02AM DBG console.scan()
9:02AM WRN KICS crash report disabled
[snip banner]
Scanning with Keeping Infrastructure as Code Secure 2.1.20
9:02AM INF Scanning with Keeping Infrastructure as Code Secure 2.1.20
9:02AM INF Operating system: darwin
9:02AM INF Total memory: 63.1G
9:02AM INF CPU: 12.0
9:02AM INF Max file size permitted for scanning: 5 MB
9:02AM INF Max resolver depth permitted for resolving files: 15
9:02AM DBG storage.NewMemoryStorage()
9:02AM DBG Trying to load path (--queries-path) from /opt/homebrew/Cellar/kics/2.1.20/share/kics/assets/queries
9:02AM DBG Trying to load path (--libraries-path) from /opt/homebrew/Cellar/kics/2.1.20/share/kics/assets/libraries
9:02AM INF Total files in the project: 349
9:02AM INF .gitignore file was found in '/p/a/t/h/iac' and it will be used to automatically exclude paths
9:02AM INF Excluded file /p/a/t/h/iac/.terraform/modules/[many files] from analyzer
9:02AM INF Loading queries of type: terraform
9:02AM DBG source.NewFilesystemSource()
9:02AM DBG engine.NewInspector()
9:02AM DBG Excluding query ID: 23edf35f-7c22-4ff9-87e6-0ca74261cfbf category: Bill Of Materials severity: TRACE
9:02AM DBG Excluding query ID: 1e434b25-8763-4b00-a5ca-ca03b7abbb66 category: Best Practices severity: INFO
9:02AM DBG Trying to load custom libraries from /opt/homebrew/Cellar/kics/2.1.20/share/kics/assets/libraries
9:02AM DBG Trying to load custom libraries from /opt/homebrew/Cellar/kics/2.1.20/share/kics/assets/libraries
9:02AM DBG Could not open embedded library data for terraform platform
9:02AM DBG helpers.GetDefaultQueryPath()
9:02AM DBG helpers.GetExecutableDirectory()
9:02AM WRN Unable to find transition information files, similarity ID transitions will not be available
9:02AM ERR Error walking through transition information files: lstat : no such file or directory
9:02AM ERR Error getting similarity ID transition query map: lstat : no such file or directory
9:02AM INF Inspector initialized, number of queries=1099
9:02AM INF Query execution timeout=1m0s
9:02AM DBG provider.NewFileSystemSourceProvider()
9:02AM DBG parser.NewBuilder()
9:02AM DBG resolver.Add()
9:02AM DBG resolver.Build()
9:02AM DBG Starting to process file /p/a/t/h/iac/.auto.tfvars
9:02AM INF Directory ignored: /p/a/t/h/iac/.terraform
9:02AM DBG Finished to process file /p/a/t/h/iac/.auto.tfvars
^C%

---

I'd really prefer to avoid using the Docker image, and the Homebrew package exists on my system so I'd prefer to use that.. but what's going on here? Does anyone use the MacOS package via Homebrew? I'm stuck.. THANKS for any help you can lend here. :)

[jessefarinacci]

On my Mac, I have Homebrew-installed KICS kind of limping along, but it behaves in a way that is quite unexpected: the --path [dir] parameter doesn't scan the entire dir, I have to manually list each file to scan..yuck. Here's my configuration and invocation in case anyone else finds this discussion:

❯ env | grep KICS
KICS_LIBRARIES_PATH=/opt/homebrew/share/kics/assets/libraries
KICS_QUERIES_PATH=/opt/homebrew/share/kics/assets/queries


❯ cat .kics.yaml
# https://github.com/Checkmarx/kics/blob/master/docs/configuration-file.md
disable-full-descriptions: true
exclude-paths:
  - ".terraform/"
exclude-queries:
  - "084c6686-2a70-4710-91b1-000393e54c12"
log-file: true
log-level: "INFO"
log-path: "reports/kics/kics.log"
output-path: "reports/kics"
path: "."
report-formats:
  - "junit"
type:
  - "terraform"
verbose: true


❯ kics scan --bom --config .kics.yaml \
  --path $(find . -type f -name '*.tf' | grep -v .terraform | xargs | tr ' ' ',')