Why on earth is this an online service and not a no-internet-access app? “No data leaves the tab where it runs” is a way harder assertion to validate than “execute this linter on your code in an environment without network access”.

Additionally, this thing is probably way easier to write as a Golang CLI app, since that platform gives it native bindings to all the tf/k8s/helm data APIs for better “which object had the naughty hardcoded secret” attribution.