Security Notice

This document has been auto-published from the internal knowledge base. All passwords, API keys, tokens, and IP addresses have been redacted for security.

Security & Auditing Specialist

CHAROS Auditor — Security CLI (ACTIVE)

Basics

Location: ~/charos-auditor/
Run: python auditor.py (full) | --quick (local only) | --project HandyManny | --module deps,secrets
Schedule: Daily 7 AM via Windows Task Scheduler (run-audit.bat)
Current Score: 83/B (full) | 92/A (quick)
Reports: ~/charos-auditor/reports/latest.json + history.json
MC Integration: generate.py reads latest.json + history.json for dashboard section

9 Audit Modules

Module	Weight	What It Checks
`deps`	20%	npm audit, outdated packages, lockfile integrity
`secrets`	20%	Leaked keys, tokens, passwords in source (ignores node_modules, .next, *.lock)
`routes`	15%	Unprotected API routes vs `known_public_routes` whitelist
`headers`	10%	Security headers (HSTS, CSP, X-Frame, etc.)
`docker`	10%	Dockerfile best practices, resource limits, exposed ports
`infra`	10%	VPS SSH checks (port scan, Docker security, auth logs, resources)
`code`	5%	Code quality (ESLint, TypeScript strict, test coverage)
`n8n`	5%	Webhook auth audit (write-capable webhooks without API keys)
`ssl`	5%	SSL cert expiry for all domains (green >30d, amber >15d, red <15d)

Scoring

Weighted average across all modules
Grades: A (≥90), B (≥75), C (≥60), D (≥40), F (<40)
Alert threshold: Score <70 triggers n8n webhook → Telegram

Config (`config.json`)

Projects audited: HandyManny, Expediente
VPS audited: srv1139900, srv1379713
9 domains checked for SSL
11 n8n webhooks audited (5 with accepted_risk: true)
Alert webhook: /charos-audit-report
Telegram chat: 5523342814

Module Source Files

~/charos-auditor/
├── auditor.py            # Main CLI (argparse)
├── config.json           # Projects, VPS, domains, webhooks, scoring
├── requirements.txt
├── run-audit.bat         # Task Scheduler launcher
├── modules/
│   ├── deps.py           # npm audit + outdated
│   ├── secrets.py        # Regex scan for leaked credentials
│   ├── docker.py         # Dockerfile analysis
│   ├── routes.py         # API route protection check
│   ├── headers.py        # HTTP security headers
│   ├── code.py           # ESLint, TypeScript, tests
│   ├── infra.py          # SSH → VPS system checks
│   ├── n8n_audit.py      # Webhook auth analysis
│   └── ssl_check.py      # SSL cert expiry
└── reports/
    ├── latest.json       # Most recent audit results
    └── history.json      # Historical scores for trend charts

n8n Alert Workflow

ID: iCi0oHtOg0k43IFI (ACTIVE)
Trigger: Webhook /charos-audit-report
Logic: If score < 70 → format Telegram message → send to chat 5523342814

Audit Run Modes

Mode	Command	What Runs
Full	`python auditor.py`	All 9 modules, all projects, SSH into VPS
Quick	`python auditor.py --quick`	Local only (deps, secrets, docker, routes, headers, code) — no SSH/SSL/n8n
Single project	`python auditor.py --project HandyManny`	All modules for one project
Specific modules	`python auditor.py --module deps,secrets`	Only named modules
Diff	`python auditor.py --diff`	Compare with last run
JSON output	`python auditor.py --json`	Machine-readable output
No alert	`python auditor.py --no-alert`	Skip Telegram alert even if score <70

Daily Scheduled Flow

run-audit.bat → python auditor.py --no-alert → regenerates Mission Control (generate.py) so audit section updates

Secrets Module — 18 Detection Patterns

AWS keys (AKIA...), OpenAI/Anthropic keys (sk-*), private keys (-----BEGIN), connection strings (postgres://, mysql://), Bearer tokens, GitHub/Slack/Telegram tokens, generic high-entropy assignments (KEY="..."). Smart filtering: skips comments, console.log, error messages, >1000-char lines, .example/.template files. Never logs actual secret values.

15/15 Security To-Dos COMPLETED

All security hardening items done: webhook auth, HSTS headers, PG backups, vitest, ESLint, Docker resource limits, alert workflow, trend charts in MC.

SSL Health Check (mc-health.py)

Basics

Location: ~/mission-control/mc-health.py
Schedule: Every 2 hours via Task Scheduler (run-health.bat)
Webhook: POST /mc-status (pushes SSL data for MC enrichment)

Domains Monitored

Domain	Port
handymanny.cloud	443
n8n.[VPS_HOSTNAME]	443
expediente.[VPS_HOSTNAME]	443

Severity Thresholds

Days Left	Severity
>30	GREEN
15–30	AMBER
<15	RED

How It Works

Opens SSL socket to each domain
Parses notAfter from cert
Computes days remaining
POSTs JSON array to /mc-status webhook
MC Status workflow (FJBz5E7sDbct4OSN) aggregates with other health data

Session Monitor (session-monitor.py)

Basics

Location: ~/mission-control/session-monitor.py
Schedule: Every 15 min via Task Scheduler (run-session-monitor.bat)
Output: SCP to VPS /docker/mission-control/data/sessions.json

What It Does

Scans for claude.exe processes (count + total memory)
Reads JSONL session files from ~/.claude/projects/C--Users-chave/
Maps working directories to known projects (17 project mappings)
Detects idle (>5 min no activity) vs stale (>30 min old JSONL)
Reads last N bytes of JSONL to extract recent activity
SCPs session data to VPS for MC dashboard display

Configuration

Parameter	Value
STALE_MINUTES	30
IDLE_MINUTES	5
TAIL_BYTES	20,000
HEAD_BYTES	5,000

Project Map (17 entries)

Maps C:\Users\chave\projects\* paths to friendly names: HandyManny, Expediente, Consultin Gruas, Sales MC, VIA Dashboard, Mission Control, WSI MC, CHAROS Auditor, OpenClaw Sync, General, etc.

AI Process Scanner (ai-processes.py)

Basics

Location: ~/mission-control/ai-processes.py
Schedule: Every 5 min via Task Scheduler
Webhook: POST /mc-ai-processes

What It Scans

Claude CLI processes — PID, memory, CPU, start time, command line, working directory
Ollama — model list, running models, generation stats (127.0.0.1:11434)
Clawbot/OpenClaw — health check ([VPS_IP]:63034)

Project Detection

Maps command line / working directory patterns to projects:

handymanny → CHAROS HandyManny
charos-expediente → CHAROS Expediente
via-plan → VIA Dashboard
docker-stack → Docker & n8n
openclaw → OpenClaw
mission-control → Personal MC
1414 → 1414 Sansores

CrowBot Security Patrol

Basics

n8n Workflow: 2OZeifB6TsZXrpzM (ACTIVE)
Webhook: /crowbot-security
Schedule: Daily 3 AM CST
Output: GREEN/YELLOW/RED JSON → Telegram alert

7 Security Scans

Port scan — checks for unexpected open ports
Docker security — container configs, privileged mode, exposed ports
Auth logs — failed SSH attempts, brute force detection
SSL cert expiry — 4 domains checked
DB security — PostgreSQL access controls
File integrity — SHA-256 hash comparison against baseline (file-hashes.txt)
System resources — disk, memory, CPU utilization

Config Files (VPS)

/docker/crowbot/security-baseline.json
/docker/crowbot/file-hashes.txt

All Monitoring Schedules (Unified View)

Monitor	Script	Frequency	Destination
CHAROS Auditor	`auditor.py`	Daily 7 AM	`reports/latest.json` → MC
SSL Health Check	`mc-health.py`	Every 2 hr	`/mc-status` webhook
Session Monitor	`session-monitor.py`	Every 15 min	VPS `sessions.json`
AI Process Scanner	`ai-processes.py`	Every 5 min	`/mc-ai-processes` webhook
CrowBot Security	n8n `2OZeifB6TsZXrpzM`	Daily 3 AM	Telegram
CrowBot Version Mgr	n8n `7R3kt0bM9TLhUPzq`	Daily 2 AM	Telegram
MCP Process Cleanup	`cleanup-mcp.ps1`	Every 30 min	Local cleanup
MC Dashboard Regen	`generate.py`	Every 2 hr	VPS `index.html`

TODO

[ ] Build --fix flag for auditor (auto-generated fix snippets)
[ ] Add pre-deploy hook integration
[ ] Add more domains to mc-health.py (currently only 3 of 9)
[ ] Create n8n workflow for trend charts from history.json

Security & Auditing Specialist ​

CHAROS Auditor — Security CLI (ACTIVE) ​

Basics ​

9 Audit Modules ​

Scoring ​

Config (config.json) ​

Module Source Files ​

n8n Alert Workflow ​

Audit Run Modes ​

Daily Scheduled Flow ​

Secrets Module — 18 Detection Patterns ​

15/15 Security To-Dos COMPLETED ​

SSL Health Check (mc-health.py) ​

Basics ​

Domains Monitored ​

Severity Thresholds ​

How It Works ​

Session Monitor (session-monitor.py) ​

Basics ​

What It Does ​

Configuration ​

Project Map (17 entries) ​

AI Process Scanner (ai-processes.py) ​

Basics ​

What It Scans ​

Project Detection ​

CrowBot Security Patrol ​

Basics ​

7 Security Scans ​

Config Files (VPS) ​

All Monitoring Schedules (Unified View) ​

TODO ​

Security & Auditing Specialist

CHAROS Auditor — Security CLI (ACTIVE)

Basics

9 Audit Modules

Scoring

Config (`config.json`)

Module Source Files

n8n Alert Workflow

Audit Run Modes

Daily Scheduled Flow

Secrets Module — 18 Detection Patterns

15/15 Security To-Dos COMPLETED

SSL Health Check (mc-health.py)

Basics

Domains Monitored

Severity Thresholds

How It Works

Session Monitor (session-monitor.py)

Basics

What It Does

Configuration

Project Map (17 entries)

AI Process Scanner (ai-processes.py)

Basics

What It Scans

Project Detection

CrowBot Security Patrol

Basics

7 Security Scans

Config Files (VPS)

All Monitoring Schedules (Unified View)

TODO