This page walks through a real scan step by step so you know what every part of the output means.
Running the scan
stacksentry -t https://your-app.example.com --mode full \
--ssh-host YOUR_SERVER_IP --ssh-user deploy --ssh-password YOUR_PASSWORD \
-o report.pdf -v
Breaking down the flags:
| Flag | Meaning |
|---|---|
-t | Target URL to scan |
--mode full | Run all four layers (HTTP + SSH + Docker + nginx) |
--ssh-host | IP address of the server to SSH into |
--ssh-user | SSH username |
--ssh-password | SSH password (a key will be generated if --fix is used) |
-o report.pdf | Save a PDF report |
-v | Verbose output — shows what each check is doing |
Reading the output
Header block
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Target: https://your-app.example.com
Stack: nginx / Ubuntu VPS
Scan mode: full (HTTP + SSH)
Grade: F (45.5%)
Passed: 10 / 22
Attack paths: 1 active [MEDIUM]
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
The grade (A–F) is computed from the percentage of checks that pass. Infrastructure WARN results — checks that return WARN because SSH or Docker credentials were not provided — are excluded from scoring so PHP shared hosting apps are not penalised for not having a VPS.
Check results
Layer Status Check ID Name
────────────────────────────────────────────────────
APP PASS APP-DEBUG-001 Debug mode disabled
APP FAIL APP-COOKIE-001 Secure cookie flags missing
APP PASS APP-CSRF-001 CSRF protection detected
APP WARN APP-ADMIN-001 Admin endpoint ambiguous (SPA)
WS FAIL WS-HSTS-001 HSTS header absent
WS FAIL WS-SEC-001 0/4 security headers present
WS PASS WS-TLS-001 HTTPS active
WS FAIL WS-SRV-001 Server: nginx/1.24.0 (Ubuntu)
WS PASS WS-DIR-001 Directory listing disabled
WS FAIL WS-LIMIT-001 No request size limits
HOST FAIL HOST-SSH-001 PermitRootLogin yes
HOST FAIL HOST-FW-001 Firewall not enabled
...
Each row shows:
- Layer — which layer the check belongs to
- Status — PASS, FAIL, WARN, or ERROR
- Check ID — unique identifier (use this with
--simulate) - Name — human-readable description
Attack path warning
ACTIVE ATTACK PATH DETECTED [MEDIUM]
APP-DEBUG-001 (debug exposure)
+ APP-COOKIE-001 (no HttpOnly flag)
+ APP-RATE-001 (no rate limiting)
= Credible path to session hijack / account takeover
An attack path is a chain of related misconfigurations across layers that together represent a more serious risk than any individual finding. See Attack Path Detection for the full list of chains.
Prioritised roadmap
━━ Day 1 — Fix Today ━━━━━━━━━━━━━━━━━━━━━━━━━━━
1. HOST-SSH-001 SSH hardening [score: 9.0]
2. WS-HSTS-001 HSTS header [score: 6.0]
3. WS-SEC-001 Security headers [score: 6.0]
━━ Day 7 — Fix This Week ━━━━━━━━━━━━━━━━━━━━━━━
4. WS-SRV-001 Server token [score: 4.5]
5. HOST-FW-001 Firewall [score: 4.0]
6. WS-LIMIT-001 Request limits [score: 3.0]
━━ Day 30 — Backlog ━━━━━━━━━━━━━━━━━━━━━━━━━━━━
7. APP-COOKIE-001 Cookie flags [score: 2.0]
...
The PDF report
The -o report.pdf flag writes a 14-section professional report including:
- Executive summary with grade and attack path count
- OWASP Top 10:2025 heatmap
- Layer-by-layer findings
- 30-day hardening roadmap
- What-if simulation (projected grade after each phase)
- Posture history timeline See PDF Report for the full section breakdown.
Running a simulation
Before applying any fixes, see what your grade would be after fixing specific checks:
stacksentry -t https://your-app.example.com \
--simulate HOST-SSH-001,WS-HSTS-001,WS-SEC-001
Output:
Current grade: F (45.5%)
Simulated grade: C (72.7%) ← after fixing those 3 checks
Attack paths: 0 ← down from 1
This lets you confirm which fixes are worth prioritising before you touch anything.