Skip to content

Scout — limitations

An honest, consolidated list of what Scout does not do and the known residual risks, so the capability descriptions elsewhere in these docs aren't read as more than they are. Grouped by area.

Functional gaps

Gap Detail
At-most-once command delivery Commands travel over core NATS with no redelivery: a command published while a Scout is offline is not delivered and is not re-sent, and the Hub's commands row for it expires after 1 hour. The offline Scout is still operator-visible — last_seen and /readyz reflect real NATS reachability, and when agent staleness checking is enabled (AGENT_STALENESS_HOURS) the Hub raises a distinct "scout went dark" alert in the activity feed. See Commands.
No Kubernetes / cert-manager collector Nothing in Scout collects K8s cert-manager evidence.
Linux x86-64 only Scout is built and supported for Linux x86-64: build.sh (run by the Hub's Download Installer button, or by hand) embeds the one prebuilt scout-linux-amd64 binary and installs a systemd service. No other operating system is supported.

Security residuals

Residual Detail
The policy signing key resides with the Hub Acceptance-policy verification defends against a compromised Hub control plane (API / DB / NATS) only while the policy signing key is isolated from it. Today the signing key is co-located with the Hub, so a full Hub compromise would also capture it; policy verification therefore does not defend against a full Hub compromise.
Scout runs as root The service runs as root inside a conservative systemd sandbox (PrivateTmp, ProtectKernel*, RestrictRealtime, LockPersonality). It does not run under a dedicated non-root user with scoped capabilities.

Measurement / evidence caveats

  • Scout doesn't score — it derives 10 findings + raw facts; all weak-cipher/key/signature/self-signed judgments and the score/tier math are Hub-side.
  • TLS 1.3 ciphers aren't fully enumerated — only the one negotiated suite is recorded (Go stdlib limit).
  • OCSP staple is validated (parses, verifies to the issuer, status good, fresh); an out-of-date or unverifiable staple trips the -5 stapling-missing finding, and a staple that reports the served cert revoked raises a fatal cert_revoked finding that forces the score to 0 (like a name mismatch).
  • Trust-store membership is a presence scan, not chain verification; PKCS12/JCEKS stores are unparseable. The OS-store defaults are augmented by --trust-store-path (repeatable, absolute) for a non-standard CA-bundle location, but an OS-store path that is never probed still yields no attestation.
  • Key-custody metadata never reads keys or validates pairing — it's filename-convention discovery + stat().
  • Cert discovery captures only DNS SANs (no IP/email/URI) and skips wildcard SANs for auto-scan (raw certs are de-duped by fingerprint).
  • Config discovery is glob-based, not real parsing — nginx includes and non-standard layouts are invisible.