No. Helm lint checks that a chart is well formed. It reports errors for problems that would make installation fail and warnings for departures from convention or recommendation. It is not a security scanner, so pair it with a policy check on the rendered manifests before anything reaches a cluster.
What helm lint does
The Helm reference describes it as running a series of tests to verify the chart is well formed. Useful options include:
--strictto fail on warnings, not just errors.--kube-versionto set the Kubernetes version used for capabilities and deprecation checks.--with-subchartsto lint dependent charts as well.--valuesand--setso you lint with realistic values.- JSON schema validation of values, which you can skip with a flag. Do not skip it in CI.
What it does not do
Lint has no opinion on whether a rendered pod runs privileged, mounts a host path, runs as root, or has a wildcard role. A chart can pass lint cleanly and still produce a risky workload. It also does not look inside values for credentials.
Rendering locally and its limits
helm template renders chart templates locally. The reference says values that would normally be looked up in cluster are faked locally, and none of the server side testing of chart validity, such as whether an API is supported, is done. That means a template run is excellent input for policy checks but does not prove the cluster will accept the result.
A pipeline that covers the gaps
helm lint --strictwith the values files you really deploy with.helm templatewith those same values, writing the YAML to a file.- Policy checks on that YAML: no privileged containers, no hostPath, runAsNonRoot, resource limits, no wildcard RBAC.
- A server side dry run against a test cluster, so admission policies get a say.
- Review the rendered diff, not just the chart diff.
| Check | Catches | Misses |
|---|---|---|
| helm lint | Malformed charts, deprecated APIs, schema errors | Insecure settings |
| helm template plus policy | Insecure rendered settings | Cluster specific behaviour |
| Server side dry run | Admission and API errors | Anything after install |
Try it yourself
Click through it at your own pace, or open it full screen.
Watch how checks run before merge in the demo. Lint, render and policy steps belong in the same gate for chart changes.
Quick check
Should I use strict mode?
For CI, yes. Strict mode fails on warnings, so convention problems are fixed rather than ignored.
Is rendering with helm template the same as installing?
No. It renders locally and does not do server side testing, so use a server side dry run for that.
Safeguard runs policies and gates on pull requests, so a failed rule can hold a merge, and its dependency and SBOM scanning covers the packages your infrastructure code pulls in. You can try a free scan at gold.safeguard.sh/scan.
Sources
Last reviewed: 19 October 2026.
