Warden Sign in

Every door of Decipher, checked before someone else does

Servers, sites, code and GitHub across the whole ecosystem — scanned read-only, kept with their history, and diffed against the state you last accepted.

Read-only checks No secrets read New, escalated and fixed at a glance

What it checks

Servers

Open ports from outside, then over SSH: sshd, firewall, fail2ban, updates, accounts, sudo, keys, services, nginx, Docker, Redis and Postgres.

Sites

Certificates and TLS versions, HSTS and CSP, cookies, CORS, Django DEBUG, exposed .env and .git, and auth gates that must answer 401.

Code

Secrets in git history, redacted; semgrep with Decipher’s own rules; vulnerable dependencies; files that should never be committed.

GitHub

Visibility, branch protection, Dependabot and secret-scanning alerts, access, deploy keys, webhooks and risky workflows.

Domains & DNS

SPF, DMARC and CAA on every domain, and CNAMEs left pointing at nothing.

History

Every finding keeps its first and last sighting; the baseline says what is new, what got worse and what got fixed.

From a scan to a fix

1 A scan startsEverything, a project, a server, a site or a repo — from the Scans page or manage.py scan.
2 Checks look, read-onlySingle requests from outside, and each server’s agent from inside; nothing is written and no secret is opened.
3 Findings are keptEach by its own key, so a second scan updates it instead of adding another.
4 Compared to the baselineNew, escalated, known and fixed come from each finding’s own history.
5 You actFix it with the hint beside it, mark it known, or ignore it with a reason — then accept.

What Warden never does

Load or brute force — every check is one request, nothing is guessed.
Change a server — its agent only reads, and runs a script installed by hand, never one sent by Warden.
Read a secret — leaks are found and reported redacted; lines and commands are masked.
Show anything to a stranger — every page past this one needs a sign-in.

The one limit: a server is audited from the inside only where its agent runs — the agent is installed from a laptop, and Warden can never push code to it.