Riaan Nolan

• Severity: Medium • Location: Various installation scripts • Description: Scripts lack proper error checking and recovery • Impact: Silent failures and difficult troubleshooting • Complexity: Medium to High

• Severity: Medium • Location: docker-compose.yml • Description: Hardcoded port mappings with no fallback mechanism • Impact: Port conflicts and failed deployments • Complexity: Medium

• Severity: Low • Location: Dockerfile, Vagrantfile • Description: Using Ubuntu noble which may have compatibility issues • Impact: Unexpected behavior with some components • Complexity: Medium

• Severity: Medium • Location: Vagrantfile • Description: Docker provider doesn’t work on Windows or WSL2 • Impact: Limited platform support • Complexity: High

• Severity: Medium • Location: docker-compose.yml files • Description: Cloud credentials passed as environment variables without proper security • Impact: Potential exposure of cloud provider credentials • Complexity: Medium

• Severity: Medium • Location: consul/consul.sh • Description: DNS configuration lacks security measures • Impact: Potential for DNS spoofing attacks • Complexity: Medium

• Severity: High • Location: database/*.sh files • Description: Database credentials hardcoded in setup scripts • Impact: Potential unauthorized database access • Complexity: Medium

• Severity: Critical • Location: vault/vault.sh • Description: Vault configured with TLS explicitly disabled • Impact: All Vault communication transmitted in plaintext • Complexity: Medium

• Severity: High • Location: GitLab runner configuration files • Description: GitLab runner tokens hardcoded in configuration files • Impact: Potential unauthorized access to GitLab instance • Complexity: Medium

• Severity: Medium • Location: Dockerfile • Description: SSH keys generated during build are same for all instances • Impact: Potential unauthorized SSH access if keys are compromised • Complexity:...