The exposure check

spandock exposure checks an installation as an attacker would see it: on a SpanDock machine itself, from another computer inside your organisation, and across a private network range. Each finding comes with its fix. The check never sends a credential and never changes anything.

The exposure check is in every plan. It is part of the SpanDock program, so it is on every server and computer, and it works while the dashboard is down. An administrator runs it by hand.

Run it

spandock exposure check                      # on a server or computer, as the user SpanDock runs as
spandock exposure probe hub.corp.example     # from another computer: SpanDock's ports on that host
spandock exposure probe 10.0.4.12:443 -try-lockout
spandock exposure discover 10.0.4.0/24       # find SpanDock installations in a private range, then probe them
spandock exposure check -json -out report.json

The report

The report is Markdown, or JSON with -json. Findings are listed by severity (critical, high, medium, low, info), each with what was seen and the fix, followed by what passed. -out FILE also writes it to a file that only your user can read.

The exit status is 0 when nothing is above low, 2 for a medium, high or critical finding, and 1 when the check couldn't run, so you can run it from a scheduler.

check

check runs on a SpanDock machine. It looks at:

• The configuration folder: whether other users can open it, write to it or read its files, and whether secrets had to be kept in a file because the credential store refused them.
• The program: whether other users can replace it.
• Listening addresses: whether the dashboard or the OpenTelemetry receiver was started on a network address.
• Its own network addresses, probed the same way as probe below.
• The running SpanDock's settings, for example: dashboard sign-in off on a server, password-only sign-in without two-factor, management tokens or service keys unused for 90 days, service keys without address ranges or an end date, new computers admitted without approval, pairing codes that still work, the public listener without an enforced IP allowlist, a certificate that expires within 14 days, debug mode on, and SpanDock being behind on updates.

probe

probe runs from any computer, against each host you name (or HOST:PORT). It tries SpanDock's ports, or the ones you give with -ports. Only the public listener (443, and 80 for its certificate challenge, or a port you name) belongs on the network; every other port must be closed.

It reports, among others:

• a dashboard that answers another computer, with or without sign-in;
• a dashboard that answers another host name;
• an OpenTelemetry export without a token being accepted;
• a management, client, cluster, phone, MCP or model-proxy route that answers without credentials;
• forged headers that get in;
• a port that should answer only on the machine itself answering on the network;
• plain HTTP from the network, an untrusted or expiring certificate, or old TLS versions;
• headers that let other sites read answers;
• a refusal that leaks a token, a crash trace, a file path or an internal address;
• with -try-lockout: 25 wrong client tokens never refused. This may refuse the probing computer for a few minutes.

A probe of the computer itself (localhost) checks only the host-name rule, since the ports are meant to answer there. check probes the computer's network addresses instead.

discover

discover tries SpanDock's ports on every address of the ranges you give, recognises SpanDock installations, and probes each one found on the ports that answered.

What it never does

• Sends a credential. Every probe is a request without a token, with a wrong token, or with a forged header that SpanDock must ignore.
• Changes anything. The only writes are an empty OpenTelemetry export, which stores nothing, and requests SpanDock must refuse.
• Reports a token, a hash, a key or a response body. Findings hold names, ports, status codes and counts.
• Scans the internet. discover accepts only the private ranges 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 100.64.0.0/10, at most 4,096 addresses by default, and asks before it starts (-yes skips the question).

discover is still a port scan: tell your IT or security team before you run it, because their tools may flag it.