gabriel / musehub public
patch docs/security-monitoring-verified #1 / 1
AI Agent gabriel · 3 days ago · Aug 29, 2026 · Diff

docs+infra: re-verify security monitoring (#161), enable Security Hub + Access Analyzer

With full account access now available, re-ran every check the original pass couldn't: CloudTrail, GuardDuty, and ECR scanning were already true (the doc's claim that ECR scanning wasn't enabled was wrong). Enabled Security Hub and IAM Access Analyzer on both accounts (low-cost, no config decisions needed).

Left AWS Config and account-level S3 Block Public Access deliberately unenabled — Config needs its own cost/setup pass, and account-level BPA would break musehub-releases' intentional public access (installer/release tarballs) without an explicit bucket-level exception first.

Also documents real findings from the now-confirmed-working ECR scan: 7 CRITICAL CVEs in the running image, all base-OS packages with no vendor fix available yet, traced to playwright's chromium install (OG cards, #129) pulling in X11/xorg-server rather than sloppy dependency management.

sha256:75d2964a7ec35f461373e3c83b208df829526661ea6a17060f95df5d50d21fb0 sha
sha256:28359a18a69692a11ffcbeec8175f8a426280f4f379b5a2a9b91250ea357f2eb parent
+7 ~8 −4 symbols
2 changed · 1060 in snapshot files
sha256:d8e32cd2c226a126a1b8d019c4158537fea99eb6433be2c7b575f65ec0b54ac0 snapshot
+7
symbols added
~8
symbols modified
−4
symbols removed
2
files changed
1060
files in snapshot
0
dead code introduced
Semantic Changes 19 symbols
+ .vscode/
+ alembic/
+ alembic/versions/
+ deploy/
+ deploy/load-tests/
+ docs/
+ docs/architecture/
+ docs/guides/
+ docs/issues/
+ docs/issues/assets/
+ docs/legal/
+ docs/mists/
+ docs/production-readiness/
+ docs/reference/
+ docs/releases/
+ docs/roadmaps/
+ musehub/
+ musehub/api/
+ musehub/api/routes/
+ musehub/api/routes/api/
+ musehub/api/routes/musehub/
+ musehub/auth/
+ musehub/core/
+ musehub/crypto/
+ musehub/db/
+ musehub/debug/
+ musehub/graph/
+ musehub/maintenance/
+ musehub/mcp/
+ musehub/mcp/tools/
+ musehub/mcp/write_tools/
+ musehub/middleware/
+ musehub/models/
+ musehub/muse_cli/
+ musehub/proposals/
+ musehub/protocol/
+ musehub/security/
+ musehub/services/
+ musehub/storage/
+ musehub/templates/
+ musehub/templates/mcp/
+ musehub/templates/musehub/
+ musehub/templates/musehub/fragments/
+ musehub/templates/musehub/macros/
+ musehub/templates/musehub/opengraph/
+ musehub/templates/musehub/pages/
+ musehub/templates/musehub/partials/
+ musehub/templates/musehub/static/
+ musehub/templates/musehub/static/vendor/
+ musehub/types/
+ scripts/
+ src/
+ src/scss/
+ src/scss/components/
+ src/scss/pages/
+ src/scss/patterns/
+ src/scss/theme/
+ src/ts/
+ src/ts/pages/
+ tests/
+ tests/unit/
+ tools/
+ workflows/
~ docs/infrastructure.md .md 7 symbols modified
~ code[bash]@L448
~ code[bash]@L454
~ code[bash]@L372
~ code[bash]@L390
~ MuseHub Cloud Infrastructure
~ Shared AWS Resources
~ table
~ docs/production-readiness/13-security-monitoring.md .md 7 symbols added, 4 symbols removed, 1 symbol modified
− Blocked — needs Gabriel's broader-access grant (requested earlier this session) section Blocked — needs Gabriel's broader-access grant (requested earlier this session) L21–38
− Partially checkable / recommendations section Partially checkable / recommendations L38–49
− The actual work items here section The actual work items here L49–58
− What I could check without broader access section What I could check without broader access L8–21
+ Real vulnerability findings — worth understanding, not urgent to act on section Real vulnerability findings — worth understanding, not urgent to act on L50–73
+ table section table L55–59
+ Update (2026-08-29) — re-verified with full account access section Update (2026-08-29) — re-verified with full account access L5–43
+ Already true — the original pass just couldn't see it section Already true — the original pass just couldn't see it L10–19
+ Enabled today section Enabled today L19–25
+ Still open — deliberately not done in this pass section Still open — deliberately not done in this pass L25–43
+ musehub-releases bucket — signed off section musehub-releases bucket — signed off L43–50
~ Section 13 — Security Monitoring and Auditability
Files Changed
~2
1060 in snapshot
~ docs/infrastructure.md .md
~ docs/production-readiness/13-security-monitoring.md .md
← Older Oldest on docs/security-monitoring-verified
All commits
Newer → Latest on docs/security-monitoring-verified

0 comments

No comments yet. Be the first to start the discussion.

To add a comment, use the Muse CLI: muse hub commit comment sha256:75d2964a7ec35f461373e3c83b208df829526661ea6a17060f95df5d50d21fb0 --body "your comment"