[grafana] build_info panel codifies git_sha exposure — amplifies open issue #214 before auth is resolved

[obchain]

Refs #54

Location

deploy/grafana/charon.json — Panel 9 (build info table)

Query

charon_build_info{instance=~"$instance"}

Problem

The build_info panel displays a table with version and git_sha label values. Issue #214 (no auth on /metrics endpoint) is open from PR #50. The combination means:

1. /metrics is unauthenticated and bound to 0.0.0.0 (issue [metrics] Default bind 0.0.0.0:9091 exposes metrics endpoint to public internet #213 also open)
2. This dashboard is the official operator tooling that surfaces git_sha as a named column

Anyone with Grafana read access sees the git SHA of the running binary. Combined with an open-source repository and a public git history, this allows an attacker to identify the exact binary version running and audit it for known unpatched issues before targeting the bot.

Impact

Intelligence leak: exact binary version visible to anyone with Grafana access, which until #213 and #214 are resolved is effectively anyone on the network.

Suggested Fix

Either:

1. Block merging this panel until issues [metrics] Default bind 0.0.0.0:9091 exposes metrics endpoint to public internet #213 and [metrics] /metrics endpoint has no authentication — competitive intel leak #214 are resolved, OR
2. Remove git_sha from the table column list (display version only), with a comment referencing [metrics] /metrics endpoint has no authentication — competitive intel leak #214 as the reason.

[obchain]

Fixed in 83d74c5 — git_sha now excluded from the build-info table transform, panel description references #213/#214 as the gating prerequisite for restoring full metadata.