EAMES

Head of Security · Early Alert MEasurement System
page built 2026-11-12 07:52 PT
security check 2026-11-12T03:03:17Z UTC
6/7
lanes green
3
high findings
5
medium findings
1
changed since last
0
EAMeS events
—
doomsday level

Security lanes

laneranfindings
Domain authenticity (DMARC/SPF)yes4
TLS certificate expiryyes0
Network exposureyes2
Unraid array, disks, containersyes1
Identity / breach watchyes0
Credential rotation backlogyes1
Financial / fraud watchFAILED—

Findings

HIGHdomain_authcobalt.onl DMARC: [HIGH] no DMARC record — anyone can spoof this domain
HIGHnetwork_exposureRedis on 10.69.0.2:6379 answers unauthenticated PING — anyone on the LAN can read/write it
HIGHrotation_backlog12 credentials still owed a rotation: MONARCH_PASSWORD, MONARCH_MFA_SECRET, HOUSECALL_PRO_API_KEY, QUO_API_KEY, VAPI_API_KEY, META_ACCESS_TOKEN
MEDIUMdomain_authdeschuteswindows.com DMARC: [MEDIUM] p=none — monitor-only; spoofed mail still delivers
MEDIUMdomain_authdeschuteswindows.com SPF: [MEDIUM] ~all (softfail — spoofing is marked, not blocked)
MEDIUMdomain_authcobalt.onl SPF: [MEDIUM] ~all (softfail — spoofing is marked, not blocked)
MEDIUMnetwork_exposureFrigate's internal :5000 serves /api/stats with no auth (LAN-only by policy — verify it stays LAN-only)
MEDIUMunraid_healthdisk1 is 92.0% full (0.7 GiB free)

Changed since baseline

(network_exposure) 6379: False -> True

Domain authenticity — DMARC / SPF

domainDMARCSPF
cobalt.onlHIGH no DMARC record — anyone can spoof this domainMEDIUM ~all (softfail — spoofing is marked, not blocked)
deschuteswindows.comMEDIUM p=none — monitor-only; spoofed mail still deliversMEDIUM ~all (softfail — spoofing is marked, not blocked)
dolphn.hostOK p=rejectOK -all (hard fail)

EAMeS pipeline

0
events
0
alerts
0
channels
pipeline live, queue empty — no events ingested yet. The text lane (NWS CAP + local RSS) is wired; audio lanes await Broadcastify credentials.

Upstream watch — Doomsday

upstream watch not wired — set DM_AGENT_TOKEN to read the Doomsday agent API.

Lanes not wired

financial: not wired: Monarch is an MCP server, not reachable from a cron script. Wire via the Hermes API or a Monarch client.