Про статический анализатор конфигов Nginx от Яндекс (https://github.com/yandex/gixy) я пару раз упоминал у себя на канале, но уже давненько

2019
https://t.me/tech_b0lt_Genona/890

2021
https://t.me/tech_b0lt_Genona/2529

Это хороший инструмент, но он несколько лет уже не развивается.

Есть форк, который развивается и поддерживается
https://github.com/dvershinin/gixy
https://pypi.org/project/gixy-ng/

Но есть ещё один форк
https://github.com/MegaManSec/Gixy-Next

И мотивация его появления интересна

> After some time, the maintainer of gixy-ng began to commit AI-generated changes to the codebase which introduced obvious regressions, broke critical behavior of the tool (which anybody using the tool would have picked up), added random AI-tooling artifacts, and introduced code which simply did not do what it was supposed to do. Most importantly, the maintainer also added marketing for their business to all documentation, all output, and all source code of gixy-ng.

Вот два поста в блоге автора Gixy-Next по этому поводу

Gixy-Next: an overview of a Gixy fork with updated, improved, and new checks
https://joshua.hu/gixy-ng-new-version-gixy-updated-checks

From gixy-ng to Gixy-Next: rescuing Gixy from AI slop
https://joshua.hu/gixy-ng-ai-slop-gixy-next-maintained

Gixy-Next поддерживает следующие проверки

- [add_header_content_type] Setting Content-Type via add_header
- [add_header_multiline] Multiline response headers
- [add_header_redefinition] Redefining of response headers by "add_header" directive
- [alias_traversal] Path traversal via misconfigured alias
- [allow_without_deny] Allow specified without deny
- [default_server_flag] Missing default_server flag
- [error_log_off] error_log set to off
- [hash_without_default] Missing default in hash blocks
- [host_spoofing] Request's Host header forgery
- [http_splitting] HTTP Response Splitting
- [if_is_evil] If is evil when used in location context
- [invalid_regex] Invalid regex capture groups
- [low_keepalive_requests] Low keepalive_requests
- [merge_slashes_on] Enabling merge_slashes
- [missing_worker_processes] Missing worker_processes
- [origins] Problems with referer/origin header validation
- [proxy_buffering_off] Disabling proxy_buffering
- [proxy_pass_normalized] proxy_pass path normalization issues
- [regex_redos] Regular expression denial of service (ReDoS)
- [resolver_external] Using external DNS nameservers
- [return_bypasses_allow_deny] Return directive bypasses allow/deny restrictions
- [ssrf] Server Side Request Forgery
- [stale_dns_cache] Outdated/stale cached DNS records used in proxy_pass
- [try_files_is_evil_too] try_files directive is evil without open_file_cache
- [unanchored_regex] Unanchored regular expressions
- [valid_referers] none in valid_referers
- [version_disclosure] Using insecure values for server_tokens
- [worker_rlimit_nofile_vs_connections] worker_rlimit_nofile must be at least twice worker_connections

Как и много лет назад я рекомендую к использованию такие инструменты.