We spent a day attacking ourselves
An adversarial review of Wegweiser, from the source and from the outside. Everything it found was fixed and shipped the same day. Agent 0.3.87 carries the endpoint half.
Wegweiser sits in a privileged position inside every network it monitors. That is the whole point of it, and it is also the reason a vulnerability here is not an ordinary SaaS problem: it is a path into every client an MSP manages. Tools in this position have been the attack vector before, and the industry has the scar tissue to prove it.
So this week we ran a deliberate adversarial review of the platform. Two passes at once: one reading the source with the question "where is a control missing", and one attacking a live deployment from the outside with no knowledge of the code at all, from the position of an attacker with no account, and then from the position of the lowest-privilege user we could create.
Everything it found was fixed, tested and deployed the same day. This note is what changed for you.
The endpoint agent
Agent 0.3.87 carries five pieces of hardening, all of them on the parts of the agent that read from a machine.
File reads are canonicalised before they are checked. The agent has always refused to read sensitive files. That refusal is now applied to the resolved path rather than the requested spelling, so a path that names a protected file by a different route is refused too, and symlink targets are re-checked rather than trusted. Network paths are refused outright: a monitoring agent that reads local files has no business authenticating to a file server somewhere else.
Queries are validated as queries. The agent's read-only query interface now refuses anything that could be interpreted as an option to the underlying tool rather than a question for it, and enforces its own list of tables that do things rather than report things. That list previously lived only on the platform side; the agent now holds its own copy, which is the pattern we use everywhere else.
Terminal sessions always expire. A remote terminal session now carries a deadline it cannot be created without, with a thirty minute ceiling. There is no longer any way to open one that outlives the operator who opened it.
Temporary files are private. The Linux security audit now writes to a private directory with an unpredictable name instead of a fixed path in shared temporary space.
Agent credentials are locked down on Windows. The agent's configuration file holds the credentials it uses to talk to us. On Windows those files are now explicitly restricted to the system and administrator accounts, rather than relying on a permission model that does not mean there what it means elsewhere.
Two of those close paths that a standard user already sitting on a managed machine could have taken. That matters more than it sounds: an agent that can be turned against the machine it runs on is worse than no agent.
The platform
On the web application, the work was authorization: making sure that every route which changes something knows who is asking and which tenant they belong to, and that the privileged half of the agent's vocabulary is reachable only by the roles meant to have it.
We also retired a legacy message channel that predated our current authenticated one. It had no users left. Everything in the fleet has been on the authenticated channel for a long time, so retiring the old one changed nothing operationally, and removed a surface that no longer earned its place. Around seven thousand lines of superseded code went with it, which is its own kind of security work: code that nothing calls is code nobody is checking.
What we changed about how we work
The most useful outcome was not any individual fix. Two of the issues came from the same mechanism: authorization in the web application is applied per route, and the failure mode when someone forgets is silent, because a route with no rule attached is simply open.
So there is now a test that walks every route in the application and fails the build unless each one is either protected or explicitly listed as public, with a written reason. Adding something to that list is a deliberate act that shows up in review. The list itself is now the definitive description of what Wegweiser exposes before you log in.
That is the part we would encourage anyone building in this space to copy. Individual bugs are inevitable. A category of bug that cannot announce itself is the thing worth engineering against.
Availability
The platform changes are live for all tenants and need nothing from you.
Agent 0.3.87 rolls out automatically through the update channel. Devices take it on their next check, typically within the hour, and the rollout is supervised: if a meaningful share of endpoints failed to take it, or went quiet after taking it, the channel halts itself and waits for a human rather than continuing. No maintenance window, nothing to install.
If your tenant has not enabled automatic agent updates, this is a good release to turn them on for. The setting is under Settings, Agent Updates, and it is per tenant and off until you choose otherwise, because pushing software onto your machines without you asking is not a thing we are willing to do by default.