Murmurent · Security dashboard

Personal audit

Purpose: runs locally on your own machine (your repos, vault, and certificates) — no SSH, read-only, nothing is changed. It checks your GitHub & Slack project access, local repo & vault permissions, certificate validity, and clinical-data containment.

Repo & vault access heatmap

Who, besides you, can open each folder on this machine: owner = just you (always fine) · group = other accounts in the folder's group · world = everyone on the machine.
Square colour = is that a concern? green = no access (good) · amber = group can get in · red = world can get in (or group, on clinical data). A private repo is ideally owner-only (chmod 700 <folder>); 755 lets group and world read it.

Membership diffs (GitHub & Slack)

Certificate timeline

Agent integrity

Each Claude Code agent installed on this machine: pristine = the commons symlink, unchanged · fork = your personal copy (diffed against the commons for weakened tool guardrails, frozen/model/category tampering, or removed safety language) · orphan = a file with no commons origin. Guardian agents (security_guard, adversary, conscience) escalate one level when modified.

Output locations (where code writes)

Literal file targets in your code that land outside the governed data root: warn = an analysis/data write to $HOME, /tmp, Desktop, or another un-governed spot · block = the same on a clinical repo. Heuristic + conservative: only literal, absolute paths are flagged; dynamic paths are left alone. Fix: write under $MURMURENT_DATA_ROOT/append_only/<project>/.

Network safety (how code reaches out)

Insecure transports and leaked credentials: warn = http:// (non-localhost), ftp://, telnet, or plaintext SMTP · block = a password embedded in a URL (://user:pass@host). https, sftp, ssh/scp over keys are fine and not shown here.

Egress map (who this code ships to)

Outbound / API destinations reached from each repo — informational, not an error: AI = expected Anthropic/OpenAI calls · other = generic HTTP clients, cloud SDKs, uploads, email. On a clinical repo, data-shipping/upload/cloud/email egress escalates (warn/block) — clinical data must not leave.

Secrets (content, history & GitHub alerts)

Hardcoded credentials in your repos — all values redacted, never shown raw: block = a high-confidence secret in a tracked file or in git history (committed then deleted still counts) · warn = a secret-looking literal, or an open GitHub secret-scanning alert · can't verify = gh missing / scanning not enabled / history budget hit. Fix: rotate the credential, load it from env/secret store, and purge it from history.

Other findings

Scan

Scan: checks a lab machine's files and permissions for exposed secrets, world-readable data, and risky settings. Pick a host and press Re-scan; read-only, nothing is changed.

host:

POSIX bits not authoritative on this host's data tree — it's served over NFSv3 from an ACL-backed NAS, so the real ACLs live in a root-only NFSv4 view. The Tier 1 scanner skipped the data-folder permission walks (immutable/, append_only/, modifiable/) to avoid noise.

First-time setup, once per server: on the server, from a murmurent folder, run sudo bash scripts/install_security_snapshot.sh. It also replaces an older install made under the name wigamig.

murmurent SECURITY DASHBOARD