Get up and running in under two minutes.
Step 1 — Install
pip install stacksentry
Step 2 — Run your first scan
Point StackSentry at any web application:
stacksentry -t https://your-app.example.com
This runs a quick HTTP-only scan — no credentials needed. You will see a grade, a list of checks, and a summary of what failed.
Step 3 — Full stack scan
For the complete four-layer assessment, add SSH credentials:
stacksentry -t https://your-app.example.com --mode full \
--ssh-host YOUR_SERVER_IP \
--ssh-user deploy \
--ssh-password YOUR_PASSWORD \
-o report.pdf
This scans the application, webserver, and host layers, and saves a PDF report.
Step 4 — Preview fixes before applying
Always dry-run before applying any changes:
stacksentry -t https://your-app.example.com --mode full --fix --dry-run \
--ssh-host YOUR_SERVER_IP \
--ssh-user deploy \
--ssh-password YOUR_PASSWORD
The dry-run shows every SSH command that would run, every file that would change, and any safety warnings — without touching your server.
Step 5 — Apply fixes
Once you have reviewed the dry-run output:
stacksentry -t https://your-app.example.com --mode full --fix \
--ssh-host YOUR_SERVER_IP \
--ssh-user deploy \
--ssh-password YOUR_PASSWORD
StackSentry applies each fix, validates it (using nginx -t or sshd -t), and confirms the result.
What to expect
A typical full-stack scan on a VPS takes 30–45 seconds. An HTTP-only scan on a fast connection completes in under 5 seconds.
After the scan you will see:
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
StackSentry Security Report
Target: https://your-app.example.com
Grade: F (16.7%)
Checks: 2 passed / 12 failed / 0 warned
Attack paths: 1 active
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
APP PASS APP-DEBUG-001 Debug mode disabled
APP FAIL APP-COOKIE-001 Secure cookie flags missing
WS FAIL WS-HSTS-001 HSTS header absent
...
Day 1 fixes (apply today):
1. WS-HSTS-001 — Add HSTS header [effort: LOW, impact: HIGH]
2. WS-SEC-001 — Add security headers [effort: LOW, impact: HIGH]
...