Security posture — Sowknow
Security posture (MEASURED — every row links its evidence)
latest intake exam: 2026-07-22T12:36:33.170135+00:00
Privilege audit (C6)
| Severity | Finding | Advice | Evidence |
|---|---|---|---|
| warning | active connection as superuser 'sowknow' | Point the application at a least-privilege role instead. | {
"is_scanner_role": false,
"target_db": "sowknow",
"usename": "sowknow"
} |
| info | 1 superuser role(s) | Each one is an unrestricted account — keep the count minimal. | {
"superusers": [
"sowknow"
],
"target_db": "sowknow"
} |
Exposure map (C7)
| Severity | Finding | Advice | Evidence |
|---|---|---|---|
| warning | SSL off while listening on '*' | Enable SSL or bind to localhost / a private interface only. | {
"listen_addresses": "*",
"port": "5432",
"ssl": "off",
"target_db": "sowknow"
} |
- exposure (sowknow): pg_hba_file_rules unreadable with this role
Auth-failure posture (C7 feed)
last round: 8 source(s) read, 25 burst failure(s) in window
| Source IP | Measured burst | Incident state | Proposal (ladder) |
|---|---|---|---|
| 167.233.55.90 | 25 in 60min (threshold 10) | fix-proposed | block_brute_force_ip propose |
Image-tag freshness (C8)
27 floating (latest) image(s) among running containers — the measured claim is pinned-vs-floating plus image age; registry freshness is deliberately not guessed.
| Container | Image | Tag class | Age |
|---|---|---|---|
| ghostshell-dashboard | ghostshell-dashboard | floating (latest) | 0.3d |
| ghostshell-gnucash | ghostshell-ghostshell-gnucash | floating (latest) | 4.3d |
| ghostshell-guardian-watchdog | ghostshell-guardian-watchdog | floating (latest) | 6.9d |
| ghostshell-nats-exporter | natsio/prometheus-nats-exporter:latest | floating (latest) | 51.8d |
| ghostshell-researcher | ghostshell-ghostshell-researcher | floating (latest) | 6.2d |
| ghostshell-v3-agent-runner | ghostshell-ghostshell-v3-agent-runner | floating (latest) | 0.1d |
| ghostshell-v3-api | ghostshell-ghostshell-v3-api | floating (latest) | 0.1d |
| ghostshell-v3-guardian | ghostshell-ghostshell-v3-guardian | floating (latest) | 0.1d |
| ghostshell-v3-scheduler | ghostshell-ghostshell-v3-scheduler | floating (latest) | 0.1d |
| ghostshell-v3-telegram | ghostshell-ghostshell-v3-telegram | floating (latest) | 1.1d |
| ghostshell-v3-worker | ghostshell-ghostshell-v3-worker | floating (latest) | 0.1d |
| sowknow-backend | sowknow4-backend | floating (latest) | 0.1d |
| sowknow-celery-articles | sowknow4-celery-articles | floating (latest) | 8.0d |
| sowknow-celery-beat | sowknow4-celery-beat | floating (latest) | 8.0d |
| sowknow-celery-collections | sowknow4-celery-collections | floating (latest) | 8.0d |
| sowknow-celery-entities | sowknow4-celery-entities | floating (latest) | 8.0d |
| sowknow-celery-heavy | sowknow4-celery-heavy | floating (latest) | 8.0d |
| sowknow-celery-light | sowknow4-celery-light | floating (latest) | 8.0d |
| sowknow-certbot | certbot/certbot:latest | floating (latest) | 14.9d |
| sowknow-embed-server | sowknow4-embed-server | floating (latest) | 8.0d |
| sowknow-frontend | sowknow4-frontend | floating (latest) | 8.0d |
| sowknow-guardian-hc | sowknow4-guardian-hc | floating (latest) | 0.0d |
| sowknow-prometheus | prom/prometheus:latest | floating (latest) | 12.3d |
| sowknow-rerank-server | sowknow4-rerank-server | floating (latest) | 8.0d |
| sowknow-telegram-bot | sowknow-telegram-bot:latest | floating (latest) | 7.9d |
| sowknow4-embed-server-2 | sowknow4-embed-server-2 | floating (latest) | 21.3d |
| victim-app | victim-victim-app | floating (latest) | 6.0d |
| ghostshell-alertmanager | prom/alertmanager:v0.27.0 | version tag (mutable) | 875.2d |
| ghostshell-caddy | caddy:2.7-alpine | version tag (mutable) | 812.1d |
| ghostshell-cadvisor | gcr.io/cadvisor/cadvisor:v0.49.1 | version tag (mutable) | 871.8d |
| ghostshell-chromadb | chromadb/chroma:0.4.22 | version tag (mutable) | 931.0d |
| ghostshell-docker-proxy | tecnativa/docker-socket-proxy:0.3.0 | version tag (mutable) | 681.1d |
| ghostshell-luks-exporter | python:3.11-alpine | version tag (mutable) | 15.8d |
| ghostshell-nats | nats:2.10-alpine | version tag (mutable) | 175.6d |
| ghostshell-node-exporter | prom/node-exporter:v1.7.0 | version tag (mutable) | 982.7d |
| ghostshell-postgres | postgres:16-alpine | version tag (mutable) | 15.0d |
| ghostshell-postgres-exporter | prometheuscommunity/postgres-exporter:v0.15.0 | version tag (mutable) | 999.1d |
| ghostshell-prometheus | prom/prometheus:v2.50.0 | version tag (mutable) | 881.3d |
| ghostshell-redis | redis:7-alpine | version tag (mutable) | 76.0d |
| ghostshell-redis-exporter | oliver006/redis_exporter:v1.55.0 | version tag (mutable) | 1015.1d |
| ghostshell-searxng | searxng/searxng:2026.3.24-f8056b5e4 | version tag (mutable) | 120.1d |
| ghostshell-v1-api | sha256:e4225b552591fd2797593cb05ffad78905dd73fbf6b61e6408e3d6d4516eb47b | version tag (mutable) | unknown |
| ghostshell-vault | hashicorp/vault:1.16.2 | version tag (mutable) | 820.9d |
| mastersre-postgres | postgres:16-alpine | version tag (mutable) | 15.0d |
| mastersre-postgres-test | postgres:16-alpine | version tag (mutable) | 15.0d |
| rabbitmq | rabbitmq:3-management-alpine | version tag (mutable) | 232.6d |
| sowknow-postgres | pgvector/pgvector:pg16 | version tag (mutable) | 145.7d |
| sowknow-redis | redis:7-alpine | version tag (mutable) | 76.0d |
| sowknow4-nats | nats:2.10-alpine | version tag (mutable) | 175.6d |
| victim-db | postgres:16-alpine | version tag (mutable) | 15.0d |
| wakh-nats | nats:2.10-alpine | version tag (mutable) | 175.6d |