Every check Bulwark runs

Each check has its own page: what the finding means, why it matters, and how to fix it, with the exact commands. In the app, open an issue and choose Details to land on the matching page.

96 of 96 checks

Secrets & credentials 10

Tokens and keys in plain text, unprotected SSH keys, keys leaked into AI sessions.

• HighA secret is exposed in AI assistant contextBLWK-AI-001
• HighA secret-bearing AI file is not covered by .gitignoreBLWK-AI-016
• HighAn MCP server connects to a remote endpoint with a plaintext tokenBLWK-AI-018
• HighA long-lived AWS access key is stored on diskBLWK-CRED-001
• HighGit stores passwords and tokens in plain textBLWK-CRED-002
• HighSSH private key is not passphrase-protectedBLWK-SSH-012
• MediumAn AI credential file is readable by other usersBLWK-AI-015
• MediumDocker registry logins are stored in the config fileBLWK-CRED-003
• MediumA credential file can be read by other usersBLWK-CRED-004
• LowSSH private key passphrase status could not be determinedBLWK-SSH-013

Supply chain 6

Packages, startup hooks and MCP servers that can run code on this machine.

• CriticalAn MCP server runs a privileged or host-mounting containerBLWK-AI-019
• CriticalTraces of the LiteLLM 1.107.0 credential stealer were foundBLWK-ROOTKIT-002
• HighAn MCP server runs an unpinned package from a registryBLWK-AI-003
• HighAn MCP server uses mcp-remote (critical command-injection ≤ 0.1.15)BLWK-AI-004
• HighAn MCP server launches via a shell interpreterBLWK-AI-005
• MediumA Python startup hook runs code in every Python processBLWK-PERSIST-005

Exposed services 4

Dev databases and services other machines can reach, and the firewall.

• HighA VNC/remote-desktop port is listeningBLWK-NET-001
• HighA database or development service is open to the networkBLWK-NET-003
• MediumA port commonly used by ngrok's local API is listeningBLWK-NET-002
• MediumNo host firewall is filtering incoming connectionsBLWK-NET-004

AI coding agents 15

Hooks, permissions and auto-approve settings a prompt injection could abuse.

• CriticalProject-supplied agent hooks run shell commands automaticallyBLWK-AI-002
• CriticalVS Code chat auto-approve ("YOLO mode") is enabledBLWK-AI-009
• HighAn agent permission allowlist permits arbitrary command executionBLWK-AI-006
• HighAn agent is configured to bypass all permission promptsBLWK-AI-007
• HighProject MCP servers are set to auto-enable without promptingBLWK-AI-008
• HighVS Code Workspace Trust is disabledBLWK-AI-010
• HighA VS Code task runs automatically when the folder is openedBLWK-AI-011
• HighAn instruction file contains hidden bidirectional Unicode controlsBLWK-AI-012
• HighAn AI config overrides the API base URL to a non-official hostBLWK-AI-014
• HighCodex is configured with no approval and full filesystem accessBLWK-AI-017
• HighA filesystem MCP server is granted an over-broad rootBLWK-AI-020
• HighAn AI agent's command sandbox is turned offBLWK-AI-021
• HighThe account that runs AI agents can become root without a passwordBLWK-AI-022
• MediumAn instruction file contains prompt-injection style directivesBLWK-AI-013
• MediumAn MCP server's tools run without asking for approvalBLWK-AI-023

SSH 11

How this machine accepts SSH logins.

• CriticalSSH allows empty passwordsBLWK-SSH-003
• HighSSH password authentication is enabledBLWK-SSH-001
• HighSSH root login is permittedBLWK-SSH-002
• MediumSSH TCP forwarding/tunneling is enabledBLWK-SSH-005
• MediumSSH permits user-set environment variablesBLWK-SSH-006
• MediumSSH tun-device (layer 2/3) tunneling is enabledBLWK-SSH-007
• MediumSSH StrictModes is disabledBLWK-SSH-008
• MediumSSH GatewayPorts exposes forwarded ports to the networkBLWK-SSH-009
• LowSSH X11 forwarding is enabledBLWK-SSH-004
• LowSSH agent forwarding is enabledBLWK-SSH-010
• LowSSH allows an excessive number of authentication attempts per connectionBLWK-SSH-011

Compromise indicators 16

Malware, suspicious startup programs, tampering and changed system files.

• CriticalFile modified since baseline: ‹path›BLWK-FIM-001
• CriticalCredential file modified since baseline: ‹path›BLWK-FIM-004
• CriticalCredential file deleted since baseline: ‹path›BLWK-FIM-005
• HighFile deleted since baseline: ‹path›BLWK-FIM-002
• HighCould not verify credential file: ‹path›BLWK-FIM-008
• Highsystemd unit runs a tunneling toolBLWK-PERSIST-001
• Highsystemd unit posts to a messaging API on startBLWK-PERSIST-002
• HighUnexpected LaunchAgent/LaunchDaemon foundBLWK-PERSIST-003
• HighUnexpected registry Run-key entry foundBLWK-PERSIST-004
• HighA network interface is running in promiscuous modeBLWK-ROOTKIT-001
• MediumClamAV signature database is staleBLWK-AV-002
• MediumShell history recording is suppressedBLWK-EVASION-001
• MediumCould not verify file integrity: ‹path›BLWK-FIM-007
• LowClamAV is not installedBLWK-AV-001
• LowCredential file not covered by the baseline: ‹path›BLWK-FIM-006
• InfoNot covered by the file-integrity baseline: ‹path›BLWK-FIM-003

OS hardening 34

Kernel settings, file permissions, accounts and logging.

• CriticalCron entry runs a downloader piped to a shellBLWK-ACCT-001
• CriticalA sensitive system file is world-writableBLWK-FS-001
• Critical/etc/shadow is world-readableBLWK-FS-002
• HighAddress space layout randomization is disabled or partialBLWK-KERNEL-004
• HighUnprivileged users can load BPF programs into the kernelBLWK-KERNEL-006
• HighA sudoers entry allows passwordless rootBLWK-PRIV-001
• Mediumptrace scope allows tracing sibling processesBLWK-KERNEL-001
• MediumNo mandatory access control framework is enforcingBLWK-KERNEL-003
• MediumMagic SysRq key is fully enabledBLWK-KERNEL-005
• Mediumperf_event_paranoid allows unprivileged kernel profilingBLWK-KERNEL-007
• MediumCore dumps of setuid processes are not restrictedBLWK-KERNEL-009
• MediumHardlink creation protection is disabledBLWK-KERNEL-010
• MediumSymlink following protection is disabledBLWK-KERNEL-011
• MediumICMP redirects are acceptedBLWK-KERNEL-014
• MediumIP source routing is enabledBLWK-KERNEL-015
• MediumReverse-path filtering is disabledBLWK-KERNEL-018
• MediumTCP SYN cookies are disabledBLWK-KERNEL-019
• Mediumauditd is not installedBLWK-LOG-001
• MediumNo GRUB boot loader password is setBLWK-PRIV-002
• LowPassword maximum age is excessively longBLWK-ACCT-002
• LowPassword minimum age is zeroBLWK-ACCT-003
• LowPassword hashing rounds are not explicitly configuredBLWK-ACCT-004
• LowDefault UMASK is not explicitly configuredBLWK-ACCT-005
• LowKernel pointers are exposed to unprivileged usersBLWK-KERNEL-002
• Lowkexec can load an unsigned, arbitrary kernel imageBLWK-KERNEL-008
• LowFIFO creation protection in sticky directories is disabledBLWK-KERNEL-012
• LowRegular-file creation protection in sticky directories is disabledBLWK-KERNEL-013
• LowThis host sends ICMP redirectsBLWK-KERNEL-016
• LowMartian packet logging is disabledBLWK-KERNEL-017
• LowKernel module not blacklisted: ‹module›BLWK-KERNEL-020
• LowKernel module not blacklisted: usb-storageBLWK-KERNEL-021
• LowSystem logs are not forwarded off-boxBLWK-LOG-002
• LowKernel-level process accounting is not installedBLWK-LOG-003
• InfoNo custom legal warning banner is set (/etc/‹file›)BLWK-BANN-001