Critical-risk tools in Munin
18 of the 242 tools in Munin are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
analytics_revoke_trackerDestructiveRevoke the API key bound to a tracker. After this, the key is rejected by the ingest endpoints — any pages still embedding it will silently fail to record views. The tracker row...
-
analytics_rotate_tracker_keyDestructiveRevoke any active
-
bookings_cancel_bookingDestructiveCancel an existing booking by
-
bookings_cancel_my_bookingDestructiveCancel one of the calling end-user’s own bookings by
-
cms_delete_assetDestructiveDelete an asset and remove the underlying file from storage. Fails with a conflict if the asset is still referenced by any entry, as a typed asset field or inline in a body.
-
cms_delete_collectionDestructiveDelete a collection. Cascades to all entries, versions, and references.
-
cms_delete_entryDestructiveDelete an entry. Cascades to its versions and references.
-
connectors_delete_connectionDestructiveDelete a connection and its stored credentials. Lookups through this connection stop working immediately.
-
conv_delete_attachmentDestructivePermanently delete an image attached to a conversation message. The stored file is erased. An attachment on a message that has already been sent or received keeps its filename, ...
-
conv_rotate_widget_keyDestructiveRevoke any active widget keys bound to this channel and mint a fresh
-
crm_delete_segmentDestructiveDelete a segment. Outreach campaigns referencing it will fail until reassigned.
-
kb_delete_documentDestructiveDelete a knowledge-base document. Pass
-
kb_dismiss_curation_candidateDestructiveReject a curation candidate: deletes the draft from the
-
outreach_cancel_scheduled_sendDestructiveCall off a scheduled outreach send before the worker delivers it, returning the proposal to
-
slack_unlink_userDestructiveRemove a Slack-user ↔ Munin-member link. Their next thread reply or button click is rejected until re-linked (manually or by email auto-match).
-
webhooks_deleteDestructiveDelete a webhook. Pending deliveries are cascade-deleted; in-flight HTTP attempts finish their current run.
-
cancel_subscriptionFinancialCancels one of the calling customer’s subscriptions at the end of the period.
-
outreach_withdraw_proposalFinancialRetract one pending outreach proposal that should no longer be reviewed — a duplicate draft, a prospect who turned out not to qualify, a bounced address. Nothing is sent. This i...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.