Skip to content

threatcrush-nightly: nightly ThreatCrush report - #35

Merged
ralyodio merged 1 commit into
mainfrom
threatcrush-nightly
Oct 27, 2026
Merged

threatcrush-nightly: nightly ThreatCrush report#35
ralyodio merged 1 commit into
mainfrom
threatcrush-nightly

Conversation

@ralyodio

@ralyodio ralyodio commented Oct 27, 2026

Copy link
Copy Markdown
Contributor

Anthony via bot@ (2026-10-27): "Send me a nightly threatcrush.com report too".

New bin/threatcrush-nightly, modelled on w3bs-nightly / smshub-nightly. UTC day vs the day before, our boxes/CI/crawlers/test accounts excluded:

  • Money: settled rows across credit_deposits (minus code grants), scan_orders, module/reputation subscriptions (minus comp), license_purchases, funding_payments, crawl_sales; checkouts opened; paid plans running; first-payment banner.
  • Installs/CLI: install.sh/ps1 outside IPs (nginx), npm daily + per-version downloads, CLI users (Node UA on /api/), CLI logins.
  • Accounts/teams: auth.users signups/confirmed, audit-log logins, orgs/teams/fleets/invites/agent keys.
  • Servers/daemons: online now, versions, heartbeats per server from nginx.
  • Scans: GitHub App installs + repo scans, property runs, web scans. ai-scan/local scans send nothing home (stated in the report).
  • Attacks/bans: detections by severity/rule/server, blocks + IPs banned.
  • Traffic: CrawlProof project for threatcrush.com.

DB reads are in a read-only transaction. --dry-run, --day, --to / THREATCRUSH_REPORT_TO. Failures mail "ThreatCrush nightly FAILED" and run alert --key threatcrush-nightly.

Tested: scripts-check green, test/alert.sh green, --dry-run --day 2026-10-26 on dev2 with every source answering, HTML checked in headless Chrome.

🤖 Generated with Claude Code

@ralyodio @claude
threatcrush-nightly: nightly ThreatCrush report (money, installs, CLI…
56c3a84 
…, accounts, fleet, scans, attacks)

Same shape as w3bs-nightly. Revenue across every payment table, install.sh
fetches + npm downloads, CLI users and daemon heartbeats by Node UA in nginx,
accounts/teams/fleets/servers/GitHub App/property runs and fleet-wide
detections + bans from the threatcrush.com DB (read-only), CrawlProof traffic.
Cron 06:00 UTC; failures mail + alert --key threatcrush-nightly.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@ralyodio
ralyodio merged commit 048fdda into main Oct 27, 2026
3 checks passed
This was referenced Oct 28, 2026
Merged
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@ralyodio