Security posture — Sowknow
Security posture (MEASURED — every row links its evidence)
latest intake exam: 2026-09-07T00:00:06.870161+00:00
Privilege audit (C6)
| Severity | Finding | Advice | Evidence |
|---|---|---|---|
| warning | active connection as superuser 'sowknow' | Point the application at a least-privilege role instead. | {
"is_scanner_role": false,
"target_db": "sowknow",
"usename": "sowknow"
} |
| info | 1 superuser role(s) | Each one is an unrestricted account — keep the count minimal. | {
"superusers": [
"sowknow"
],
"target_db": "sowknow"
} |
Exposure map (C7)
| Severity | Finding | Advice | Evidence |
|---|---|---|---|
| warning | SSL off while listening on '*' | Enable SSL or bind to localhost / a private interface only. | {
"listen_addresses": "*",
"port": "5432",
"ssl": "off",
"target_db": "sowknow"
} |
- exposure (sowknow): pg_hba_file_rules unreadable with this role
Auth-failure posture (C7 feed)
last round: 8 source(s) read, 335 burst failure(s) in window
| Source IP | Measured burst | Incident state | Proposal (ladder) |
|---|---|---|---|
| 172.20.0.14 | 10 in 60min (threshold 10) | fix-proposed | block_brute_force_ip propose |
Image-tag freshness (C8)
46 floating (latest) image(s) among running containers — the measured claim is pinned-vs-floating plus image age; registry freshness is deliberately not guessed.
| Container | Image | Tag class | Age |
|---|---|---|---|
| ghostshell-calendar-web | ghostshell-calendar-web | floating (latest) | 48.3d |
| ghostshell-dashboard | ghostshell-dashboard | floating (latest) | 14.3d |
| ghostshell-gnucash | ghostshell-ghostshell-gnucash | floating (latest) | 54.2d |
| ghostshell-guardian-watchdog | ghostshell-guardian-watchdog | floating (latest) | 65.8d |
| ghostshell-nats-exporter | natsio/prometheus-nats-exporter:latest | floating (latest) | 110.8d |
| ghostshell-researcher | ghostshell-ghostshell-researcher | floating (latest) | 65.2d |
| ghostshell-v1-api | ghostshell-ghostshell-v3-api | floating (latest) | 31.8d |
| ghostshell-v3-agent-runner | ghostshell-ghostshell-v3-agent-runner | floating (latest) | 35.2d |
| ghostshell-v3-api | ghostshell-ghostshell-v3-api | floating (latest) | 31.8d |
| ghostshell-v3-guardian | ghostshell-ghostshell-v3-guardian | floating (latest) | 35.2d |
| ghostshell-v3-scheduler | ghostshell-ghostshell-v3-scheduler | floating (latest) | 35.2d |
| ghostshell-v3-telegram | ghostshell-ghostshell-v3-telegram | floating (latest) | 35.9d |
| ghostshell-v3-worker | ghostshell-ghostshell-v3-worker | floating (latest) | 35.2d |
| kodam-celery-1 | kodam-celery | floating (latest) | 2.9d |
| kodam-celery-beat-1 | kodam-celery-beat | floating (latest) | 2.9d |
| kodam-prod-celery-1 | kodam-prod-celery | floating (latest) | 2.2d |
| kodam-prod-celery-beat-1 | kodam-prod-celery-beat | floating (latest) | 2.2d |
| kodam-prod-sync-listener-1 | kodam-prod-sync-listener | floating (latest) | 2.2d |
| kodam-prod-web-1 | kodam-prod-web | floating (latest) | 2.2d |
| kodam-sync-listener-1 | kodam-sync-listener | floating (latest) | 2.9d |
| kodam-web-1 | kodam-web | floating (latest) | 3.2d |
| lanterne-api | lanterne-api | floating (latest) | 0.1d |
| lanterne-api-consultant | lanterne-api:latest | floating (latest) | 0.1d |
| lanterne-api-csi-matforce | lanterne-api:latest | floating (latest) | 0.1d |
| lanterne-api-gollamsys | lanterne-api:latest | floating (latest) | 0.1d |
| lanterne-api-matservices | lanterne-api:latest | floating (latest) | 0.1d |
| lanterne-api-sandbox | lanterne-api:latest | floating (latest) | 0.1d |
| lanterne-web | lanterne-web | floating (latest) | 0.1d |
| lanterne-web-consultant | lanterne-web:latest | floating (latest) | 0.1d |
| lanterne-web-csi-matforce | lanterne-web:latest | floating (latest) | 0.1d |
| lanterne-web-gollamsys | lanterne-web:latest | floating (latest) | 0.1d |
| lanterne-web-matservices | lanterne-web:latest | floating (latest) | 0.1d |
| lanterne-web-sandbox | lanterne-web:latest | floating (latest) | 0.1d |
| sowknow-backend | sowknow4-backend | floating (latest) | 4.3d |
| sowknow-celery-articles | sowknow4-celery-articles | floating (latest) | 4.3d |
| sowknow-celery-beat | sowknow4-celery-beat | floating (latest) | 4.3d |
| sowknow-celery-collections | sowknow4-celery-collections | floating (latest) | 4.3d |
| sowknow-celery-entities | sowknow4-celery-entities | floating (latest) | 4.3d |
| sowknow-celery-heavy | sowknow4-celery-heavy | floating (latest) | 4.3d |
| sowknow-celery-light | sowknow4-celery-light | floating (latest) | 4.3d |
| sowknow-embed-server | sowknow4-embed-server | floating (latest) | 4.3d |
| sowknow-embed-server-2 | sowknow4-embed-server-2 | floating (latest) | 4.3d |
| sowknow-frontend | sowknow4-frontend | floating (latest) | 4.3d |
| sowknow-guardian-hc | sowknow4-guardian-hc | floating (latest) | 4.3d |
| sowknow-rerank-server | sowknow4-rerank-server | floating (latest) | 4.3d |
| sowknow-telegram-bot | sowknow-telegram-bot:latest | floating (latest) | 4.3d |
| ghostshell-alertmanager | prom/alertmanager:v0.27.0 | version tag (mutable) | 934.2d |
| ghostshell-caddy | caddy:2.7-alpine | version tag (mutable) | 871.1d |
| ghostshell-cadvisor | gcr.io/cadvisor/cadvisor:v0.49.1 | version tag (mutable) | 930.8d |
| ghostshell-chromadb | chromadb/chroma:0.4.22 | version tag (mutable) | 990.0d |
| ghostshell-docker-proxy | tecnativa/docker-socket-proxy:0.3.0 | version tag (mutable) | 740.1d |
| ghostshell-luks-exporter | python:3.11-alpine | version tag (mutable) | 18.7d |
| ghostshell-nats | nats:2.10-alpine | version tag (mutable) | 234.6d |
| ghostshell-node-exporter | prom/node-exporter:v1.7.0 | version tag (mutable) | 1041.7d |
| ghostshell-postgres | postgres:16-alpine | version tag (mutable) | 73.9d |
| ghostshell-postgres-exporter | prometheuscommunity/postgres-exporter:v0.15.0 | version tag (mutable) | 1058.1d |
| ghostshell-prometheus | prom/prometheus:v2.50.0 | version tag (mutable) | 940.2d |
| ghostshell-redis | redis:7-alpine | version tag (mutable) | 134.9d |
| ghostshell-redis-exporter | oliver006/redis_exporter:v1.55.0 | version tag (mutable) | 1074.0d |
| ghostshell-searxng | searxng/searxng:2026.3.24-f8056b5e4 | version tag (mutable) | 179.0d |
| ghostshell-vault | hashicorp/vault:1.16.2 | version tag (mutable) | 879.8d |
| kodam-db-1 | pgvector/pgvector:pg15 | version tag (mutable) | 36.8d |
| kodam-prod-db-1 | postgres:15-alpine | version tag (mutable) | 73.9d |
| kodam-prod-redis-1 | redis:7-alpine | version tag (mutable) | 134.9d |
| kodam-redis-1 | redis:7-alpine | version tag (mutable) | 134.9d |
| lanterne-db | postgres:15-alpine | version tag (mutable) | 73.9d |
| lanterne-db-consultant | postgres:15-alpine | version tag (mutable) | 73.9d |
| lanterne-db-csi-matforce | postgres:15-alpine | version tag (mutable) | 73.9d |
| lanterne-db-gollamsys | postgres:15-alpine | version tag (mutable) | 73.9d |
| lanterne-db-matservices | postgres:15-alpine | version tag (mutable) | 73.9d |
| lanterne-db-sandbox | postgres:15-alpine | version tag (mutable) | 73.9d |
| lanterne-drill-pg | postgres:15-alpine | version tag (mutable) | 73.9d |
| lanterne-suite-pg | postgres:15-alpine | version tag (mutable) | 73.9d |
| mastersre-postgres | postgres:16-alpine | version tag (mutable) | 73.9d |
| sowknow-nats | nats:2.10-alpine | version tag (mutable) | 234.6d |
| sowknow-postgres | pgvector/pgvector:pg16 | version tag (mutable) | 36.8d |
| sowknow-redis | redis:7-alpine | version tag (mutable) | 134.9d |