diff --git a/k8s-deployment.yaml b/k8s-deployment.yaml
new file mode 100644
index 0000000..c42a1a4
--- /dev/null
+++ b/k8s-deployment.yaml
@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vulnerable-app
+  namespace: default
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: vulnerable-app
+  template:
+    metadata:
+      labels:
+        app: vulnerable-app
+    spec:
+      containers:
+      - name: app
+        image: nginx:latest
+        ports:
+        - containerPort: 80
+        
+        # CRITICAL: Running as root
+        securityContext:
+          runAsUser: 0
+          privileged: true  # CRITICAL: Privileged container
+          allowPrivilegeEscalation: true
+        
+        # HIGH: Hardcoded secrets
+        env:
+        - name: DATABASE_PASSWORD
+          value: "admin123"
+        - name: API_SECRET
+          value: "sk-abcd1234567890"
+        - name: JWT_SECRET
+          value: "my-super-secret-key"
+        
+        # MEDIUM: No resource limits
+        resources: {}
+        
+        # MEDIUM: No readiness/liveness probes
+        
+      # MEDIUM: No security context at pod level
+      # MEDIUM: No network policies
+      
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vulnerable-app-service
+spec:
+  type: LoadBalancer  # MEDIUM: Exposing directly to internet
+  ports:
+  - port: 80
+    targetPort: 80
+    protocol: TCP
+  selector:
+    app: vulnerable-app
diff --git a/test-infrastructure.tf b/test-infrastructure.tf
new file mode 100644
index 0000000..f3dd9a7
--- /dev/null
+++ b/test-infrastructure.tf
@@ -0,0 +1,82 @@
+# Test infrastructure with security issues
+resource "aws_security_group" "web_server" {
+  name        = "web-server-sg"
+  description = "Security group for web server"
+
+  ingress {
+    from_port   = 22
+    to_port     = 22
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]  # CRITICAL: SSH open to world
+  }
+
+  ingress {
+    from_port   = 80
+    to_port     = 80
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+
+  ingress {
+    from_port   = 3306
+    to_port     = 3306
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]  # CRITICAL: Database port open to world
+  }
+
+  egress {
+    from_port   = 0
+    to_port     = 0
+    protocol    = "-1"
+    cidr_blocks = ["0.0.0.0/0"]
+  }
+}
+
+resource "aws_s3_bucket" "app_data" {
+  bucket = "my-app-data-bucket-${random_id.bucket.hex}"
+  # MEDIUM: No encryption configured
+}
+
+resource "aws_instance" "web" {
+  ami           = "ami-0c02fb55956c7d316"
+  instance_type = "t3.micro"
+  
+  vpc_security_group_ids = [aws_security_group.web_server.id]
+  
+  user_data = <<-EOF
+    #!/bin/bash
+    export DB_PASSWORD="supersecret123"  # HIGH: Hardcoded password
+    export API_KEY="sk-1234567890abcdef"  # HIGH: Hardcoded API key
+    
+    # Install application
+    yum update -y
+    yum install -y httpd
+    systemctl start httpd
+  EOF
+  
+  # MEDIUM: No tags for compliance tracking
+}
+
+resource "aws_db_instance" "main" {
+  identifier = "main-database"
+  
+  engine         = "mysql"
+  engine_version = "8.0"
+  instance_class = "db.t3.micro"
+  
+  allocated_storage = 20
+  
+  db_name  = "appdb"
+  username = "admin"
+  password = "password123"  # CRITICAL: Hardcoded database password
+  
+  vpc_security_group_ids = [aws_security_group.web_server.id]
+  
+  skip_final_snapshot = true
+  # MEDIUM: No encryption at rest
+  # MEDIUM: No backup retention configured
+}
+
+resource "random_id" "bucket" {
+  byte_length = 4
+}