Open-source security POC
Attack-surface monitoring for self-hosted & AI infrastructure
A pull-only agent enrolls once, discovers listening services on-host, and runs CVE detections locally — only normalized findings ever leave the host. Signed detection catalog, posture scoring, alerting, and AI triage.
pull-only agent · signed catalog · only findings leave the host
The trust angle
Your data stays on your hosts
Pull-only agent
The Go agent enrolls once and pulls work from the control plane. No inbound ports, no listener to expose on your host.
Local detection
CVE detections run on-host against discovered services. Raw evidence is read and evaluated locally and never leaves the machine.
Only normalized findings leave
The agent ships normalized findings upstream — nothing else. If evidence is ever stored, it is AES-256-GCM encrypted per org.
The loop
From enroll to posture
The agent heartbeats, discovers listening services, and reports assets. Before scanning it verifies the signed catalog, then emits findings that the control plane scores into posture with 30-day trends and alerts on new or regressed issues.
Capabilities
Built for engineers who run their own infra
Trust
Signed detection catalog
Detection bundles are Ed25519-signed over a canonical manifest. The agent verifies against a pinned public key before running any detection and fails closed.
Accuracy
Version-aware matching
Findings are matched against the actual installed version of a discovered service, not just its presence, cutting false positives.
Access
Multi-tenant + RBAC
Users, orgs, and session auth with owner/admin/member/viewer roles. Postgres row-level isolation keeps each org's data separate.
Transport
Agent mTLS
Enrollment issues a client certificate from an internal CA. Every agent call to the control plane is mutually authenticated.
At rest
Encrypted evidence
Per-org AES-256-GCM encryption protects any evidence stored on the control plane. Raw evidence stays on the host by default.
Workflow
AI triage
A background job drafts new detections from CVE advisories and triages incoming findings, keeping the catalog and your queue current.
See the full architecture
Go agent, FastAPI control plane, signed catalog, mTLS enrollment, and the data path that keeps evidence on-host.
Run it yourself
Clone it, enroll an agent, and watch the posture
Palisade is a proof-of-concept built on Kenneth Lacroix's brand infrastructure.