Privacy

Security Audit Report — 15 June 2026

Weekly SpeyBooks Security Test Harness report. Grade: C (92%). 21/22 modules passing. Automated infrastructure security audit.

William Murray · 15 June 2026 · 3 min read
Security audit grade C, 21 of 22 modules passing, score 92%

SpeyBooks measures its production infrastructure daily with an automated Security Test Harness and publishes this report weekly. This report covers the run executed on 15 June 2026.

Summary

MetricResult
GradeC
Score92%
Modules passed21 / 22
Failures1
Warnings0

1 failure(s) found across 22 modules.

Module Results

ModuleStatusDetail
fw-nginx✓ PASSnginx config valid, security headers present
fw-ports✓ PASSonly ports 22/80/443 listening
fw-headers✓ PASSall security headers present on all four domains
sc-ssh✓ PASSSSH hardened (root=without-password, passwordauth=no, x11=no)
sc-postgres✓ PASSpostgres bound to localhost only
sc-env✓ PASS.env files not world-readable
sc-tls✓ PASSTLS 1.0 and 1.1 rejected
pm-os✓ PASSunattended-upgrades active, security origin bound to ‘bookworm’, no pending security updates
pm-node✓ PASSNode.js v22.22.3 (LTS, patch-current)
pm-postgres✓ PASSPostgreSQL 17.10 (supported)
pm-npm✓ PASSno high/critical production vulnerabilities (api+web)
ac-rls✗ FAILschema_coverage_manifest: no organisation_id schema_coverage_manifest: RLS not enabled schema_coverage_manifest: RLS not FORCEd (owner bypasses)
ac-bypassrls✓ PASSBYPASSRLS held only by allow-list (postgres speybooks_admin speybooks_anchor speybooks_webhook); tenant role clean; anchor read-only; webhook grants confined
ac-fail2ban✓ PASSall 5 fail2ban jails active
ac-ratelimits✓ PASSnginx rate limiting configured (1 directives)
ac-authaudit✓ PASSauth_audit_log active (122 entries)
ml-rootkit✓ PASSno new SUID/SGID binaries (18 known)
ml-services✓ PASSonly expected services running
op-ssl✓ PASSall SpeyBooks SSL certs valid >30 days
op-backups✓ PASSlatest backup 1h old, verified
op-disk✓ PASSdisk usage 50%
op-s3sync✓ PASSlast S3 upload 1h ago, verified

What We Test

The Security Test Harness covers 22 modules across six areas:

Firewall and network: nginx configuration validity, open port exposure, and live security header verification across all SpeyBooks domains.

Secrets and configuration: SSH hardening (root login, password auth, X11), PostgreSQL binding, environment file permissions, and TLS version enforcement.

Patch management: operating system update status, Node.js LTS verification, PostgreSQL version, and production npm vulnerability scanning.

Access control: Row-Level Security coverage across every tenant table (organisation_id presence, RLS enabled, FORCE enforced), fail2ban jail status, nginx rate limiting, and auth audit log activity.

Malware and services: SUID/SGID binary baseline comparison and unexpected service detection.

Operations: SSL certificate expiry across all domains, local backup recency, disk usage, and S3 sync verification.

Infrastructure

SpeyBooks runs on Hetzner (Germany, EU) with encrypted database backups replicated to AWS London (eu-west-2, UK). Data never leaves UK or EU jurisdiction.


This report is generated automatically by the SpeyBooks Security Test Harness, which runs on the production server, and is published through a fixed pipeline without human editing. Operational details that would aid reconnaissance are mechanically redacted at the publication boundary; the full-fidelity report stays with the operator.

Early access for developers.

SpeyBooks is in soft launch. We're inviting a small group of developers to help shape API-first accounting for the UK.

90-day free trial. Proper double-entry. No tracking.