Private, on-device Terraform security review for Chrome
Date: 2026-07-22
Model: gemma-4-E4B-it-web.litertlm (2.8 GB) via @litert-lm/core 0.14.0, WebGPU
Mode: narrate (model given the rule-engine finding, asked to explain + rate + fix)
Verdict: PASS — 10/10 fixtures correct, zero fabrications.
≥8/10 fixtures: correct, specific explanation with zero fabricated resources/attributes, at usable speed (>10 tok/s).
| # | Fixture | Correct? | Severity given | Fabrication? |
|---|---|---|---|---|
| 01 | public S3 bucket ACL | yes | Critical | none |
| 02 | SSH open to the world | yes | Critical | none |
| 03 | unencrypted EBS volume | yes | High | none |
| 04 | publicly accessible RDS | yes (both issues) | Critical | none |
| 05 | hardcoded credentials | yes | Critical | none |
| 06 | wildcard IAM policy | yes | Critical | none |
| 07 | bucket without versioning/logging | yes (both) | High | none* |
| 08 | KMS key rotation disabled | yes | High | none |
| 09 | secret in Lambda env var | yes | Critical | none |
| 10 | public Azure blob container | yes | Critical | none |
* #07 used the older inline versioning {} / logging {} blocks rather than the
newer standalone aws_s3_bucket_versioning resources — valid HCL, stylistically dated,
not a fabrication. Worth steering with a prompt/style note in M3.
Measured chunks/sec in the automation browser pane ranged 6.2–14.6; one earlier warm single-shot of fixture 01 hit 28.8. The pane throttles WebGPU (software fallback / background de-prioritization), so these numbers under-represent real hardware. The speed criterion must be confirmed in the user’s actual Chrome; the single warm reading already clears 10 tok/s comfortably. Cold first-conversation latency is ~2x warm.
The core bet holds: on-device Gemma 4 E4B produces accurate, specific, non-hallucinated Terraform security analysis when handed a finding to narrate. Proceed to M1 (scanner core). Keep the narrate architecture — the model is a reliable explainer, which is exactly the role CLAUDE.md assigns it.