4.8 KiB
Scanner baseline — security review 2026-10-12
Standard (non-AI) tools, installed as user binaries under /mnt/5_hdd/felhom.eu/tools/security/bin/ on DooPlex.
Nothing was installed system-wide or on any box. Raw output (redacted) is in scanners/.
| tool | version | how installed | sha256 of the binary (first..last 4) |
|---|---|---|---|
| govulncheck | v1.1.4 | go install golang.org/x/vuln/cmd/govulncheck@v1.1.4 |
6b04..2f5e |
| gosec | v2.22.4 | go install github.com/securego/gosec/v2/cmd/gosec@v2.22.4 |
3111..607e |
| gitleaks | 8.24.3 | GitHub release tarball, checked against the release checksums file | e183..72d3 |
| trivy | 0.74.0 | GitHub release tarball, checked against the release checksums file | d89b..d7b9 |
Trivy note: releases 0.27–0.69.1 are no longer published upstream; 0.74.0 (2026-08-14) was the newest release older than two weeks.
Reviewed commits
controller dcd89364a4 (v0.307.0) · agent 86adbcaf8a (v0.154.0) · felhom.eu c9b9432986 · catalog 1a642b43e7 ·
homelab-manifests fdd324bb62. Shipped artifacts: controller image 0.307.0, hub image 0.146.0, agent binary
0.154.0 (copied from demo-hp).
1. govulncheck
Commands: govulncheck ./... in each module (source mode), and govulncheck -mode binary <file> on the shipped
binaries. Source mode reports the stdlib of the LOCAL toolchain (go1.26.0), not the one that built the shipped
program, so the binary mode is the one that counts.
| target | built with | vulnerabilities reported as reachable | triage |
|---|---|---|---|
| controller 0.307.0 binary | go1.24.13, x/crypto v0.31.0 | 62 (stdlib + x/crypto/ssh) | real → R-972 (toolchain) |
| hub 0.146.0 binary | go1.24.13, x/crypto v0.31.0 | 62 (stdlib + x/crypto/ssh) | real → R-972 |
| agent 0.154.0 binary | go1.26.0 | 27 (stdlib) | real → R-972 |
| source mode, three modules | local go1.26.0 | 46 / 45 / 27 | superseded by the binary rows |
Mostly denial-of-service fixes; it includes html/template escaping fixes and x/crypto/ssh fixes. Go 1.24 is past the Go support window (the two newest major releases: https://go.dev/doc/devel/release#policy).
2. gitleaks
Command: gitleaks git <repo> --redact=100 --log-opts=--all -f json, full history of all five repositories.
Redacted reports in scanners/ (author name and e-mail dropped). Each hit was triaged by masked context only: the
line was shown with every long token replaced by its length and a hash prefix; no value was printed.
| repo | hits | triage |
|---|---|---|
| felhom-controller | 12 | 4 were one live credential → R-950 (rotated 2026-10-12; withheld from the report file); the rest are test constants, docs and decoy fixtures |
| felhom-agent | 15 | all test fixtures |
| felhom.eu | 43 | 1 → R-950 (withheld); 5 are manifests/felhom.secret.yaml history → R-925; the rest are old evidence logs of throwaway demo apps (values compared by hash with the running demo apps: none match), test constants, public keys, fingerprints |
| app-catalog-felhom.eu | 1 | a health-probe URL, noise |
| homelab-manifests | 17 | private repository; locations kept off-git; not product. gitleaks did NOT flag R-908's key (note on R-908) |
A credential found only in history counted until its rotation was checked: the old Gitea registry token in felhom.eu history is not among the admin account's live tokens (compared by its last eight characters with the token list); the old Resend key in hub.yaml history was rotated in June (hash differs from the live one).
3. trivy image
Command: trivy image --image-src remote --scanners vuln -f json <image> (registry API, no Docker daemon).
| image | OS | fixable CRITICAL / HIGH (OS) | Go binary | triage |
|---|---|---|---|---|
| felhom-controller:0.307.0 | Debian 12.15 | 12 / 23 | felhom-controller go1.24.13 (34 HIGH) | real → R-972 |
| felhom-hub:0.146.0 | Alpine 3.21.8 | 0 / 2 | felhom-hub go1.24.13 (34 HIGH) | real → R-972 |
| felhom-samba:1.1.0 | Alpine 3.21.7 | 0 / 48 | — | real → R-972 |
| traefik:v3.7.13 | Alpine 3.24.2 | 0 / 0 | 4 HIGH (upstream) | upstream; R-979 (pins) |
| cloudflared:2026.9.3 | Debian 13.7 | 0 / 1 | 4 HIGH (upstream) | upstream |
| filebrowser 1.5.6-stable | Alpine 3.24.1 | 1 / 2 | 4 HIGH (upstream) | upstream |
Not scanned: the 53 catalog app images → R-987.
4. gosec (leads only)
Command: gosec -quiet -tests=false -fmt=json ./... per module. Hits: controller 470, agent 117, hub 215.
Triage of the high-signal rules: G202 (SQL string building) — every hit builds ? placeholders, noise. G402 (TLS
verify off) — each sits beside a certificate pin, noise. G407/G404 — the export cipher uses random IVs and scrypt, a
backoff jitter uses math/rand, noise. G101 — comments and constant names, noise. G304/G301/G306/G104 — bulk noise,
not filed.
5. Proposed push gate
Not wired in this session. Shape: R-986.