Security posture — Ghostshell
Security posture (MEASURED — every row links its evidence)
latest intake exam: 2026-11-09T00:00:07.442318+00:00
Privilege audit (C6)
| Severity | Finding | Advice | Evidence |
|---|---|---|---|
| warning | active connection as superuser 'ghostshell' | Point the application at a least-privilege role instead. | {
"is_scanner_role": false,
"target_db": "ghostshell_v3",
"usename": "ghostshell"
} |
| info | 1 superuser role(s) | Each one is an unrestricted account — keep the count minimal. | {
"superusers": [
"ghostshell"
],
"target_db": "ghostshell_v3"
} |
Exposure map (C7)
| Severity | Finding | Advice | Evidence |
|---|---|---|---|
| warning | SSL off while listening on '*' | Enable SSL or bind to localhost / a private interface only. | {
"listen_addresses": "*",
"port": "5432",
"ssl": "off",
"target_db": "ghostshell_v3"
} |
- exposure (ghostshell_v3): pg_hba_file_rules unreadable with this role
Auth-failure posture (C7 feed)
last round: 9 source(s) read, 0 burst failure(s) in window
| Source IP | Measured burst | Incident state | Proposal (ladder) |
|---|---|---|---|
| No open brute-force flags. | |||
Image-tag freshness (C8)
47 floating (latest) image(s) among running containers — the measured claim is pinned-vs-floating plus image age; registry freshness is deliberately not guessed.
| Container | Image | Tag class | Age |
|---|---|---|---|
| colynx-web | colynx-web | floating (latest) | 0.0d |
| ghostshell-calendar-web | ghostshell-calendar-web | floating (latest) | 103.3d |
| ghostshell-dashboard | ghostshell-dashboard | floating (latest) | 0.1d |
| ghostshell-gnucash | ghostshell-ghostshell-gnucash | floating (latest) | 109.1d |
| ghostshell-guardian-watchdog | ghostshell-guardian-watchdog | floating (latest) | 120.8d |
| ghostshell-nats-exporter | natsio/prometheus-nats-exporter:latest | floating (latest) | 165.8d |
| ghostshell-researcher | ghostshell-ghostshell-researcher | floating (latest) | 120.2d |
| ghostshell-v1-api | ghostshell-ghostshell-v3-api | floating (latest) | 28.1d |
| ghostshell-v3-agent-runner | ghostshell-ghostshell-v3-agent-runner | floating (latest) | 90.2d |
| ghostshell-v3-api | ghostshell-ghostshell-v3-api | floating (latest) | 28.1d |
| ghostshell-v3-guardian | ghostshell-ghostshell-v3-guardian | floating (latest) | 90.2d |
| ghostshell-v3-scheduler | ghostshell-ghostshell-v3-scheduler | floating (latest) | 90.2d |
| ghostshell-v3-telegram | ghostshell-ghostshell-v3-telegram | floating (latest) | 90.8d |
| ghostshell-v3-worker | ghostshell-ghostshell-v3-worker | floating (latest) | 90.2d |
| kodam-celery-1 | kodam-celery | floating (latest) | 38.3d |
| kodam-celery-beat-1 | kodam-celery-beat | floating (latest) | 38.3d |
| kodam-frontend-1 | kodam-frontend | floating (latest) | 40.1d |
| kodam-prod-celery-1 | kodam-prod-celery | floating (latest) | 37.8d |
| kodam-prod-celery-beat-1 | kodam-prod-celery-beat | floating (latest) | 37.8d |
| kodam-prod-sync-listener-1 | kodam-prod-sync-listener | floating (latest) | 37.8d |
| kodam-prod-web-1 | kodam-prod-web | floating (latest) | 37.8d |
| kodam-sync-listener-1 | kodam-sync-listener | floating (latest) | 38.3d |
| kodam-web-1 | kodam-web | floating (latest) | 38.3d |
| lanterne-api-consultant | lanterne-api:latest | floating (latest) | 1.0d |
| lanterne-api-csi-matforce | lanterne-api:latest | floating (latest) | 1.0d |
| lanterne-api-gollamsys | lanterne-api:latest | floating (latest) | 1.0d |
| lanterne-api-matservices | lanterne-api:latest | floating (latest) | 1.0d |
| lanterne-api-sandbox | lanterne-api:latest | floating (latest) | 1.0d |
| lanterne-web-consultant | lanterne-web:latest | floating (latest) | 1.0d |
| lanterne-web-csi-matforce | lanterne-web:latest | floating (latest) | 1.0d |
| lanterne-web-gollamsys | lanterne-web:latest | floating (latest) | 1.0d |
| lanterne-web-matservices | lanterne-web:latest | floating (latest) | 1.0d |
| lanterne-web-sandbox | lanterne-web:latest | floating (latest) | 1.0d |
| sowknow-backend | sowknow4-backend | floating (latest) | 39.9d |
| sowknow-celery-articles | sowknow4-celery-articles | floating (latest) | 46.9d |
| sowknow-celery-beat | sowknow4-celery-beat | floating (latest) | 46.9d |
| sowknow-celery-collections | sowknow4-celery-collections | floating (latest) | 46.9d |
| sowknow-celery-entities | sowknow4-celery-entities | floating (latest) | 46.9d |
| sowknow-celery-heavy | sowknow4-celery-heavy | floating (latest) | 46.9d |
| sowknow-celery-light | sowknow4-celery-light | floating (latest) | 46.9d |
| sowknow-certbot | certbot/certbot:latest | floating (latest) | 72.9d |
| sowknow-embed-server | sowknow4-embed-server | floating (latest) | 59.2d |
| sowknow-embed-server-2 | sowknow4-embed-server-2 | floating (latest) | 59.2d |
| sowknow-guardian-hc | sowknow4-guardian-hc | floating (latest) | 59.2d |
| sowknow-prometheus | prom/prometheus:latest | floating (latest) | 49.3d |
| sowknow-rerank-server | sowknow4-rerank-server | floating (latest) | 59.2d |
| sowknow-telegram-bot | sowknow-telegram-bot:latest | floating (latest) | 59.2d |
| awamarketer-dex | dexidp/dex:v2.41.1 | version tag (mutable) | 827.9d |
| awamarketer-mysql | mysql:8.4 | version tag (mutable) | 10.6d |
| colynx-api | sha256:ce4e9c827f1f61d56d7ea9fb3a3ceaa31ca9104adbbd380aaf9ab6fbf64ee533 | version tag (mutable) | unknown |
| colynx-db | postgres:15-alpine | version tag (mutable) | 128.9d |
| colynx-pgbouncer | pgbouncer/pgbouncer:1.24.1 | version tag (mutable) | 57.9d |
| colynx-test-pg | postgres:15-alpine | version tag (mutable) | 128.9d |
| gendarme-gendarme-1 | gendarme:local | version tag (mutable) | 7.3d |
| ghostshell-alertmanager | prom/alertmanager:v0.27.0 | version tag (mutable) | 989.1d |
| ghostshell-caddy | caddy:2.7-alpine | version tag (mutable) | 926.0d |
| ghostshell-cadvisor | gcr.io/cadvisor/cadvisor:v0.49.1 | version tag (mutable) | 985.8d |
| ghostshell-chromadb | chromadb/chroma:0.4.22 | version tag (mutable) | 1044.9d |
| ghostshell-docker-proxy | tecnativa/docker-socket-proxy:0.3.0 | version tag (mutable) | 795.0d |
| ghostshell-luks-exporter | python:3.11-alpine | version tag (mutable) | 7.8d |
| ghostshell-nats | nats:2.10-alpine | version tag (mutable) | 289.5d |
| ghostshell-node-exporter | prom/node-exporter:v1.7.0 | version tag (mutable) | 1096.6d |
| ghostshell-postgres | postgres:16-alpine | version tag (mutable) | 128.9d |
| ghostshell-postgres-exporter | prometheuscommunity/postgres-exporter:v0.15.0 | version tag (mutable) | 1113.0d |
| ghostshell-prometheus | prom/prometheus:v2.50.0 | version tag (mutable) | 995.2d |
| ghostshell-redis | redis:7-alpine | version tag (mutable) | 189.9d |
| ghostshell-redis-exporter | oliver006/redis_exporter:v1.55.0 | version tag (mutable) | 1129.0d |
| ghostshell-searxng | searxng/searxng:2026.3.24-f8056b5e4 | version tag (mutable) | 234.0d |
| ghostshell-vault | hashicorp/vault:1.16.2 | version tag (mutable) | 934.8d |
| kodam-db-1 | pgvector/pgvector:pg15 | version tag (mutable) | 91.7d |
| kodam-prod-db-1 | postgres:15-alpine | version tag (mutable) | 128.9d |
| kodam-prod-redis-1 | redis:7-alpine | version tag (mutable) | 189.9d |
| kodam-redis-1 | redis:7-alpine | version tag (mutable) | 189.9d |
| lanterne-api | sha256:ed5c0c7cb49e31c8742fa1c1e6a46d5531e6dfe812b183be6387aadc06a6c6bf | version tag (mutable) | unknown |
| lanterne-db | postgres:15-alpine | version tag (mutable) | 128.9d |
| lanterne-db-consultant | postgres:15-alpine | version tag (mutable) | 128.9d |
| lanterne-db-csi-matforce | postgres:15-alpine | version tag (mutable) | 128.9d |
| lanterne-db-gollamsys | postgres:15-alpine | version tag (mutable) | 128.9d |
| lanterne-db-matservices | postgres:15-alpine | version tag (mutable) | 128.9d |
| lanterne-db-sandbox | postgres:15-alpine | version tag (mutable) | 128.9d |
| lanterne-drill-pg | postgres:15-alpine | version tag (mutable) | 128.9d |
| lanterne-pgbouncer | pgbouncer/pgbouncer:1.24.1 | version tag (mutable) | 57.9d |
| lanterne-pgbouncer-consultant | pgbouncer/pgbouncer:1.24.1 | version tag (mutable) | 57.9d |
| lanterne-pgbouncer-csi-matforce | pgbouncer/pgbouncer:1.24.1 | version tag (mutable) | 57.9d |
| lanterne-pgbouncer-gollamsys | pgbouncer/pgbouncer:1.24.1 | version tag (mutable) | 57.9d |
| lanterne-pgbouncer-matservices | pgbouncer/pgbouncer:1.24.1 | version tag (mutable) | 57.9d |
| lanterne-pgbouncer-sandbox | pgbouncer/pgbouncer:1.24.1 | version tag (mutable) | 57.9d |
| lanterne-test_pg | postgres:16-alpine | version tag (mutable) | 128.9d |
| lanterne-web | sha256:69e8b6c472e8e2ac833ba2ec62d7708766495981fff88314246609de5cd70eae | version tag (mutable) | unknown |
| mastersre-postgres | postgres:16-alpine | version tag (mutable) | 128.9d |
| sowknow-frontend | sha256:f7b5f922e50427e9fbb39291f981ee115b5688836615d0b60f08345e95782ebd | version tag (mutable) | unknown |
| sowknow-nats | nats:2.10-alpine | version tag (mutable) | 289.5d |
| sowknow-postgres | pgvector/pgvector:pg16 | version tag (mutable) | 91.7d |
| sowknow-redis | redis:7-alpine | version tag (mutable) | 189.9d |