The collector is open source. The platform is not.

Where the line is

Why the line is there

For a root-level Linux agent, trust is product-market fit. If the agent is closed, serious operators hesitate — correctly. If the platform is closed, that is ordinary SaaS and nobody blinks. The line follows that asymmetry and nothing else.

The collector is also not the hard part, and pretending otherwise would be the more flattering lie. It is a log parser and a package lister with no third-party dependencies. What is genuinely expensive is the advisory corpus and keeping it current, the matcher, the correlation rules, and deciding what actually deserves a human's attention. None of that is in the agent.

There is a self-interested half too, and it is real: the bugs we cannot find alone are distribution bugs. Ubuntu 24.04 changed a syslog timestamp format and our parser read zero of one host's 42,000 failed logins while reporting success. OpenSSH 9.8 renamed a process and a pattern matched none of another host's 11,664 failures. There are hundreds of distribution and version combinations, and their owners spot these instantly.

What the agent sends

It reads security-relevant logs, the package database, SSH configuration, and — where you configure web roots — WordPress core, plugin and theme versions. It classifies on your machine and transmits counts and versions. A username becomes a boolean. A file path becomes one of six words. A set of source addresses becomes an integer.

Raw log lines never leave the host — not above a threshold, not behind an opt-in, not for debugging. There is no field in the protocol to put one in, and a test plants real-looking usernames, addresses, paths and signature names in fixture logs, runs a full cycle, and fails if any of them reaches a serialized report.

Never transmitted, under any configuration: log lines, usernames, source IP addresses, file paths and names, file contents, malware signature names, Fail2Ban jail names, WordPress site paths and the account names in them, process lists, environment variables, SSH keys, or the contents of any configuration file.

Three things do identify you, and it is better to say so here than let you find them later. Your hostname and your machine id are sent once at enrollment — a fleet dashboard has to be able to name a server, and the machine id is what keeps a renamed box the same box. And if you enable the WordPress module, plugin and theme slugs travel as themselves, because the vulnerability feed is keyed on them; almost every slug names a public artifact, but a bespoke component named after the client it was built for does not.

Once a report reaches us, hourly event counts are kept for 90 days and then collapsed into daily totals kept for 365. Inventory is current state.

None of this has to be taken on trust. The agent has a print command that collects a real cycle and prints the exact JSON it would transmit, transmitting nothing — no credential, no enrollment, no network. Its data manifest, published with the source, is per-module and names every file read.

Two things it structurally cannot do

It never listens. There is no server in the binary. Your firewall needs no rule for it.

It accepts no commands. The only thing that flows down from us is a declarative module configuration that cannot carry a path, a command, an argument, a regex or a URL. There is no code path that executes anything the server sends. Local commands run through a single wrapper with a fixed argument list, absolute paths from a compiled-in allowlist, no shell, and a refusal to execute any binary writable by non-root.

There is also no auto-update, deliberately. Silent updates on a security agent are a supply-chain attack waiting for an author. We would rather you patched us on your schedule than gave us a channel to push code to your fleet.

Signed releases

Releases are signed with minisign over a checksum file. The public key is one line, and it is published here, out of band from anything you would download:

https://stackhound.ai/agent-signing-key

Fetching a key from the same place as the binary proves nothing, which is why it has its own URL and why that URL went up before there was anything to verify with it. Verification is two commands: check the files against the checksum file, then check the checksum file's signature against the key you pasted from this site. A successful verification prints a signed comment naming the release, so it tells you which release verified rather than merely that one did.

A signature proves an artifact came from us unmodified. It does not prove the binary was built from the published source. That is a separate claim with a separate check: the builds are reproducible, so you can build the tag yourself and compare hashes. Anyone telling you a signature establishes both has conflated them.

Reporting a vulnerability

Email security@stackhound.ai. Please do not open it publicly first.

• Acknowledgment within 2 business days. If you do not hear back, assume the mail went astray and follow up.
• An assessment and an intended fix date within 10 business days.
• We will credit you by name unless you would rather we did not.

If you believe a released binary has been tampered with, say so in the subject line and we will treat it as urgent.

What is not published yet

This posture is published. These are not, and this section exists so nothing above reads as finished when it is not:

• The source repository is not public yet. There is no URL to give you, so this page does not link one. A link to a repository that does not exist would be worse than an honest gap.
• There are no downloads yet. No release, no package repository, no installer. The verification steps above are the ones you will use when there are; the key you will check against is already published, which is the part that had to come first.
• The report protocol is documented but not specified. Enough to read, not yet enough to write your own collector against with confidence.

When those land, this section shrinks. Until then it is the accurate half of the picture. If you want to be told when the agent is downloadable, request early access and say so.