Scout — limitations
An honest, consolidated list of what Scout does not do and the known
residual risks, so the capability descriptions elsewhere in these docs aren't
read as more than they are. Grouped by area.
Functional gaps
| Gap |
Detail |
| At-most-once command delivery |
Commands travel over core NATS with no redelivery: a command published while a Scout is offline is not delivered and is not re-sent, and the Hub's commands row for it expires after 1 hour. The offline Scout is still operator-visible — last_seen and /readyz reflect real NATS reachability, and when agent staleness checking is enabled (AGENT_STALENESS_HOURS) the Hub raises a distinct "scout went dark" alert in the activity feed. See Commands. |
| No Kubernetes / cert-manager collector |
Nothing in Scout collects K8s cert-manager evidence. |
| Linux x86-64 only |
Scout is built and supported for Linux x86-64: build.sh (run by the Hub's Download Installer button, or by hand) embeds the one prebuilt scout-linux-amd64 binary and installs a systemd service. No other operating system is supported. |
Security residuals
| Residual |
Detail |
| The policy signing key resides with the Hub |
Acceptance-policy verification defends against a compromised Hub control plane (API / DB / NATS) only while the policy signing key is isolated from it. Today the signing key is co-located with the Hub, so a full Hub compromise would also capture it; policy verification therefore does not defend against a full Hub compromise. |
| Scout runs as root |
The service runs as root inside a conservative systemd sandbox (PrivateTmp, ProtectKernel*, RestrictRealtime, LockPersonality). It does not run under a dedicated non-root user with scoped capabilities. |
Measurement / evidence caveats
- Scout doesn't score — it derives 10 findings + raw facts; all
weak-cipher/key/signature/self-signed judgments and the score/tier math are
Hub-side.
- TLS 1.3 ciphers aren't fully enumerated — only the one negotiated suite is
recorded (Go stdlib limit).
- OCSP staple is validated (parses, verifies to the issuer, status good,
fresh); an out-of-date or unverifiable staple trips the
-5 stapling-missing
finding, and a staple that reports the served cert revoked raises a fatal
cert_revoked finding that forces the score to 0 (like a name mismatch).
- Trust-store membership is a presence scan, not chain verification;
PKCS12/JCEKS stores are unparseable. The OS-store defaults are augmented by
--trust-store-path (repeatable, absolute) for a non-standard CA-bundle
location, but an OS-store path that is never probed still yields no
attestation.
- Key-custody metadata never reads keys or validates pairing — it's
filename-convention discovery +
stat().
- Cert discovery captures only DNS SANs (no IP/email/URI) and skips wildcard
SANs for auto-scan (raw certs are de-duped by fingerprint).
- Config discovery is glob-based, not real parsing —
nginx includes and
non-standard layouts are invisible.