Gateway Master Dashboard

Latency	Contracts	Price/TB $SC	Score	Region	Host Key
No probe data

Host Key	Storage	Usability
No contracts

Agent	Tier	Balance
—

Agent	Type	Amount	When
—

Cumulative security posture across all audits. Most recent on top. Click any card to expand details.

2026-07-06 — Pre-Launch Billing Audit Hermes · code review

1 CRITICAL 2 MEDIUM 2 LOW 1 INFO

Billing pipeline audit: deposit → credit → storage → charge. Found 30x overcharge due to missing daily pro-ration.

#	Severity	Finding	Impact
1	CRITICAL	Billing 30x overcharge — no daily pro-ration	Agents charged $60/TB instead of $2/TB
2	MEDIUM	Credit endpoint not idempotent (tx_hash ignored)	Double-credit risk on watcher state loss
3	LOW	No transaction wrapping in adjust_balance	Balance drift on concurrent writes
4	MEDIUM	Agent registration unauthenticated (public)	Registration spam / abuse vector
5	LOW	Share endpoint leaks renterd internals	Info disclosure if share token leaks
6	INFO	No deposit minimum enforced	Dust deposits create unbillable balances

Full report: /root/sia-project/gateway/.hermes/plans/2026-07-06_015500-billing-audit.md

2026-07-05 — Gateway Attack Surface Baseline Hermes · perimeter scan

2 CRITICAL 4 HIGH 5 MEDIUM 2 LOW

External attack surface: nmap, nikto, slowhttptest, nuclei, semgrep. Top priority: nginx reverse proxy for DoS protection.

#	Severity	Finding	Fix
C1	CRITICAL	Slow Read DoS — 200 concurrent connections make gateway unresponsive in ~2s	nginx reverse proxy with timeouts
C2	CRITICAL	S3 bucket enumeration — :8080 lists all buckets without auth	Firewall :8080 to localhost only
H1	HIGH	10 missing security headers (HSTS, CSP, X-Frame-Options, etc.)	nginx add_header directives
H2	HIGH	Server version disclosure (uvicorn, SimpleHTTP/0.6)	Override Server header in nginx
H3	HIGH	40 urllib dynamic URL injection (file:// scheme risk)	Switch to requests library
H4	HIGH	15 insecure transport (HTTP instead of HTTPS)	Enforce HTTPS, validate certs
M1	MEDIUM	CORS wildcard on S3 gateway	Restrict origins
M2	MEDIUM	API docs exposed (/docs, /openapi.json, /redoc) without auth	Gate behind admin token
M3	MEDIUM	Unauthenticated /health & /metrics	Rate-limit or auth
M4	MEDIUM	7 SQL injection risks (raw execute + formatted SQL)	Parameterized queries
M5	MEDIUM	Dashboard on SimpleHTTP — not production-grade, trivial DoS	nginx static file serving

Full report: /root/sia-project/dashboard/audits/2026-07-05-baseline.md

2026-07-05 — Code & Dependency Security Audit Ken · SAST + deps + secrets + infra

PASS 3 NOTES

Bandit SAST (0 HIGH, 29 MEDIUM reviewed — all false positives). pip-audit clean. gitleaks: 0 real secrets. Verdict: PASS WITH NOTES.

Scope	Tool	Result
SAST	Bandit 1.9.4	0 HIGH, 29 MEDIUM (all false positives — hardcoded localhost URLs), 17 LOW
Dependencies	pip-audit 2.10.1	✓ No known vulnerabilities
Secrets	gitleaks 8.16.0	0 real secrets (193 hits in .venv/ fake tokens)
Infra	Manual port scan	Gateway :8000 + Dashboard :8001 on 0.0.0.0 — behind Caddy ✓. renterd :9980 localhost ✓

Notes: (1) No per-agent rate limiting — MEDIUM DoS concern. (2) Audit subprocess calls for shell injection. (3) Bind admin dashboard to 127.0.0.1.

Full report: /root/sia-project/gateway/shared/security-audit-latest.md