langfuse-deployment — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited langfuse-deployment (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
This skill covers operating self-hosted Langfuse: what to run, how big, how to scale it, and how to keep it backed up, upgraded, and secure. It does not make the self-host-vs-Cloud or tier decision (that's langfuse-setup's cloud-vs-self-host.md) and does not embed exact compose/Helm/Terraform config (fetch live /self-hosting/* docs).
exact config — env vars, Helm values, compose files, per-provider SSO — append .md to the live page URL (e.g. https://langfuse.com/self-hosting/configuration/scaling.md). Self-hosting config changes; never reconstruct it from memory.
services give you encryption-at-rest, backups, and HA for free. Self-running all storage is the most operational burden — reserve it for air-gap/compliance needs.
self-run it, you own its (non-trivial) backups.
The self-host-vs-Cloud choice and the tier (Compose / Helm / Terraform / Railway) belong to langfuse-setup. If that's unsettled, start there. This skill assumes "we're self-hosting" and helps run it.
Use references/architecture-and-sizing.md: the components (Web + Worker + Postgres/ClickHouse/ Redis/S3), the minimum-sizing table, HA (≥2 Web), managed-vs-self-run, single-vs-multi deployment strategy, and the UTC requirement.
When ingestion or UI load grows, use references/scaling.md: scale workers by CPU (~50% = saturated), reduce ClickHouse ingestion reads, separate ingestion from UI, raise S3 write concurrency; fix slow UI via ClickHouse resources + time filters.
Use references/operations.md: per-component backups (test restores!), semver/pinned-tag upgrade discipline, and the background-migrations rule (monitor to completion after every upgrade).
Use references/security.md: HTTPS, at-rest encryption, ENCRYPTION_KEY, networking (VPC/air-gap), auth/SSO (NEXTAUTH_URL first), data masking at source, EE license; plus the pre-production security checklist.
single-vs-multi strategy, UTC.
migrations, health/readiness, DR checklist.
checklist.
| Need | Where |
|---|---|
| Run/scale/back-up/secure self-hosted Langfuse | this skill |
| Self-host-vs-Cloud decision + tier choice + onboarding | langfuse-setup skill |
| Instrumenting apps that send to this deployment | vendored langfuse skill |
| Monitoring the deployment's own load (dashboards) | langfuse-monitoring skill + /self-hosting/configuration/observability |
| Exact compose/Helm/Terraform/env/SSO config | live /self-hosting/* docs (.md-append) |
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.