Issues

• Alert engine, snooze and digest state is lost on every restart (including every self-update)

  enhancementreliability
  eliau2005/statixagent#50 · Filter by author eliau2005 opened on Sep 4, 2026

• Design the signing-key rotation/revocation story before launch

  enhancementsecurityupdater
  eliau2005/statixagent#49 · Filter by author eliau2005 opened on Sep 4, 2026

• The /firewall command hard-codes port 22 and authorized_keys discovery is a one-time /home glob

  enhancementhelp wantedlinuxsecurity
  eliau2005/statixagent#48 · Filter by author eliau2005 opened on Sep 4, 2026

• Docker N+1 inspect per poll and sequential network checks block the bot loop for tens of seconds

  dockerhelp wantedperformance
  eliau2005/statixagent#46 · Filter by author eliau2005 opened on Sep 4, 2026

• Geo-IP lookups go to ip-api.com over plain HTTP with no opt-out, contradicting the no-third-party promise

  enhancementsecurity
  eliau2005/statixagent#43 · Filter by author eliau2005 opened on Sep 4, 2026

• Watched services, processes, ports and HTTP checks are never evaluated in the background — no down alerts

  enhancementreliability
  eliau2005/statixagent#41 · Filter by author eliau2005 opened on Sep 4, 2026

• Sampler blocks forever on a hung NFS/FUSE mount (statfs without timeout); CIFS mounts are silently ignored

  buglinuxreliability
  eliau2005/statixagent#40 · Filter by author eliau2005 opened on Sep 4, 2026

• CI hardening: race detector, linting, govulncheck, dependabot, pinned actions, build provenance

  cisecuritytesting
  eliau2005/statixagent#39 · Filter by author eliau2005 opened on Sep 4, 2026

• Per-IP maps in BruteDetector, alert.Engine and GeoResolver grow without bound on internet-facing hosts

  bugperformancereliability
  eliau2005/statixagent#37 · Filter by author eliau2005 opened on Sep 4, 2026

• No upgrade/reinstall path: re-running the installer wipes config, leaves the old process running, and leaks /tmp

  buginstallerreliability
  eliau2005/statixagent#36 · Filter by author eliau2005 opened on Sep 4, 2026

• install.sh verifies checksums but not the ed25519 signature; fails open when checksums.txt is absent

  installersecurity
  eliau2005/statixagent#35 · Filter by author eliau2005 opened on Sep 4, 2026

• systemd unit runs as unrestricted root: add capability/syscall/address-family restrictions and narrow writable paths

  enhancementlinuxsecurity
  eliau2005/statixagent#34 · Filter by author eliau2005 opened on Sep 4, 2026

• Alert delivery has no retry/backoff/429 handling; a failed send loses the alert permanently

  bugreliabilitytelegram
  eliau2005/statixagent#33 · Filter by author eliau2005 opened on Sep 4, 2026

• SSH monitoring is blind on OpenSSH 10 (sshd-auth) and misses [preauth] brute-force patterns

  buglinuxreliabilitysecurity
  eliau2005/statixagent#32 · Filter by author eliau2005 opened on Sep 4, 2026

• Bot authorization is chat-ID only: no from.id check on commands or callbacks (group chats expose privileged actions)

  securitytelegram
  eliau2005/statixagent#31 · Filter by author eliau2005 opened on Sep 4, 2026

• Signed checksums.txt is not bound to the release tag: downgrade/replay of old signed releases is possible

  securityupdater
  eliau2005/statixagent#30 · Filter by author eliau2005 opened on Sep 4, 2026

• Config is forward-incompatible: unknown keys are fatal, so a rollback to an older binary kills the agent

  bugreliabilityupdater
  eliau2005/statixagent#29 · Filter by author eliau2005 opened on Sep 4, 2026

• Crash-loop rollback cannot recover exec-time failures, counts restarts as crashes, and never notifies

  bugreliabilitysecurityupdater
  eliau2005/statixagent#28 · Filter by author eliau2005 opened on Sep 4, 2026

• Release amd64 binary is dynamically linked against the runner's glibc (README promises a static binary)

  bugciinstallerlinuxupdater
  eliau2005/statixagent#27 · Filter by author eliau2005 opened on Sep 4, 2026
  2