Security posture — Ghostshell
Security posture (MEASURED — every row links its evidence)
latest intake exam: 2026-09-07T00:00:06.888063+00:00
Privilege audit (C6)
| Severity | Finding | Advice | Evidence |
|---|---|---|---|
| warning | active connection as superuser 'ghostshell' | Point the application at a least-privilege role instead. | {
"is_scanner_role": false,
"target_db": "ghostshell_v3",
"usename": "ghostshell"
} |
| info | 1 superuser role(s) | Each one is an unrestricted account — keep the count minimal. | {
"superusers": [
"ghostshell"
],
"target_db": "ghostshell_v3"
} |
Exposure map (C7)
| Severity | Finding | Advice | Evidence |
|---|---|---|---|
| warning | SSL off while listening on '*' | Enable SSL or bind to localhost / a private interface only. | {
"listen_addresses": "*",
"port": "5432",
"ssl": "off",
"target_db": "ghostshell_v3"
} |
- exposure (ghostshell_v3): pg_hba_file_rules unreadable with this role
Auth-failure posture (C7 feed)
last round: 8 source(s) read, 274 burst failure(s) in window
| Source IP | Measured burst | Incident state | Proposal (ladder) |
|---|---|---|---|
| No open brute-force flags. | |||
Image-tag freshness (C8)
38 floating (latest) image(s) among running containers — the measured claim is pinned-vs-floating plus image age; registry freshness is deliberately not guessed.
| Container | Image | Tag class | Age |
|---|---|---|---|
| ghostshell-calendar-web | ghostshell-calendar-web | floating (latest) | 44.4d |
| ghostshell-dashboard | ghostshell-dashboard | floating (latest) | 10.3d |
| ghostshell-gnucash | ghostshell-ghostshell-gnucash | floating (latest) | 50.3d |
| ghostshell-guardian-watchdog | ghostshell-guardian-watchdog | floating (latest) | 61.9d |
| ghostshell-nats-exporter | natsio/prometheus-nats-exporter:latest | floating (latest) | 106.9d |
| ghostshell-researcher | ghostshell-ghostshell-researcher | floating (latest) | 61.3d |
| ghostshell-v1-api | ghostshell-ghostshell-v3-api | floating (latest) | 27.9d |
| ghostshell-v3-agent-runner | ghostshell-ghostshell-v3-agent-runner | floating (latest) | 31.3d |
| ghostshell-v3-api | ghostshell-ghostshell-v3-api | floating (latest) | 27.9d |
| ghostshell-v3-guardian | ghostshell-ghostshell-v3-guardian | floating (latest) | 31.3d |
| ghostshell-v3-scheduler | ghostshell-ghostshell-v3-scheduler | floating (latest) | 31.3d |
| ghostshell-v3-telegram | ghostshell-ghostshell-v3-telegram | floating (latest) | 31.9d |
| ghostshell-v3-worker | ghostshell-ghostshell-v3-worker | floating (latest) | 31.3d |
| lanterne-api | lanterne-api | floating (latest) | 0.0d |
| lanterne-api-consultant | lanterne-api:latest | floating (latest) | 0.0d |
| lanterne-api-csi-matforce | lanterne-api:latest | floating (latest) | 0.0d |
| lanterne-api-gollamsys | lanterne-api:latest | floating (latest) | 0.0d |
| lanterne-api-matservices | lanterne-api:latest | floating (latest) | 0.0d |
| lanterne-api-sandbox | lanterne-api:latest | floating (latest) | 0.0d |
| lanterne-web | lanterne-web | floating (latest) | 1.3d |
| lanterne-web-consultant | lanterne-web:latest | floating (latest) | 1.3d |
| lanterne-web-csi-matforce | lanterne-web:latest | floating (latest) | 1.3d |
| lanterne-web-gollamsys | lanterne-web:latest | floating (latest) | 1.3d |
| lanterne-web-matservices | lanterne-web:latest | floating (latest) | 1.3d |
| lanterne-web-sandbox | lanterne-web:latest | floating (latest) | 1.3d |
| sowknow-backend | sowknow4-backend | floating (latest) | 0.4d |
| sowknow-celery-articles | sowknow4-celery-articles | floating (latest) | 0.4d |
| sowknow-celery-beat | sowknow4-celery-beat | floating (latest) | 0.4d |
| sowknow-celery-collections | sowknow4-celery-collections | floating (latest) | 0.4d |
| sowknow-celery-entities | sowknow4-celery-entities | floating (latest) | 0.4d |
| sowknow-celery-heavy | sowknow4-celery-heavy | floating (latest) | 0.4d |
| sowknow-celery-light | sowknow4-celery-light | floating (latest) | 0.4d |
| sowknow-embed-server | sowknow4-embed-server | floating (latest) | 0.4d |
| sowknow-embed-server-2 | sowknow4-embed-server-2 | floating (latest) | 0.4d |
| sowknow-frontend | sowknow4-frontend | floating (latest) | 0.4d |
| sowknow-guardian-hc | sowknow4-guardian-hc | floating (latest) | 0.4d |
| sowknow-rerank-server | sowknow4-rerank-server | floating (latest) | 0.4d |
| sowknow-telegram-bot | sowknow-telegram-bot:latest | floating (latest) | 0.4d |
| ghostshell-alertmanager | prom/alertmanager:v0.27.0 | version tag (mutable) | 930.3d |
| ghostshell-caddy | caddy:2.7-alpine | version tag (mutable) | 867.2d |
| ghostshell-cadvisor | gcr.io/cadvisor/cadvisor:v0.49.1 | version tag (mutable) | 926.9d |
| ghostshell-chromadb | chromadb/chroma:0.4.22 | version tag (mutable) | 986.0d |
| ghostshell-docker-proxy | tecnativa/docker-socket-proxy:0.3.0 | version tag (mutable) | 736.2d |
| ghostshell-luks-exporter | python:3.11-alpine | version tag (mutable) | 14.7d |
| ghostshell-nats | nats:2.10-alpine | version tag (mutable) | 230.7d |
| ghostshell-node-exporter | prom/node-exporter:v1.7.0 | version tag (mutable) | 1037.7d |
| ghostshell-postgres | postgres:16-alpine | version tag (mutable) | 70.0d |
| ghostshell-postgres-exporter | prometheuscommunity/postgres-exporter:v0.15.0 | version tag (mutable) | 1054.1d |
| ghostshell-prometheus | prom/prometheus:v2.50.0 | version tag (mutable) | 936.3d |
| ghostshell-redis | redis:7-alpine | version tag (mutable) | 131.0d |
| ghostshell-redis-exporter | oliver006/redis_exporter:v1.55.0 | version tag (mutable) | 1070.1d |
| ghostshell-searxng | searxng/searxng:2026.3.24-f8056b5e4 | version tag (mutable) | 175.1d |
| ghostshell-vault | hashicorp/vault:1.16.2 | version tag (mutable) | 875.9d |
| lanterne-db | postgres:15-alpine | version tag (mutable) | 70.0d |
| lanterne-db-consultant | postgres:15-alpine | version tag (mutable) | 70.0d |
| lanterne-db-csi-matforce | postgres:15-alpine | version tag (mutable) | 70.0d |
| lanterne-db-gollamsys | postgres:15-alpine | version tag (mutable) | 70.0d |
| lanterne-db-matservices | postgres:15-alpine | version tag (mutable) | 70.0d |
| lanterne-db-sandbox | postgres:15-alpine | version tag (mutable) | 70.0d |
| lanterne-drill-pg | postgres:15-alpine | version tag (mutable) | 70.0d |
| lanterne-suite-pg | postgres:15-alpine | version tag (mutable) | 70.0d |
| mastersre-postgres | postgres:16-alpine | version tag (mutable) | 70.0d |
| sowknow-nats | nats:2.10-alpine | version tag (mutable) | 230.7d |
| sowknow-postgres | pgvector/pgvector:pg16 | version tag (mutable) | 32.9d |
| sowknow-redis | redis:7-alpine | version tag (mutable) | 131.0d |