Phase 4 — Auto-Fix Hardening, PHP Support, and PyPI

Status: ✅ Complete
Delivered: April 2026
PyPI: pip install stacksentry

What Was Built

Phase 4 hardened the auto-fix engine against real-world failure modes, added PHP/Apache/shared hosting support, shipped the tool to PyPI, and validated everything against three live applications.

PHP and Shared Hosting Support

The initial framework assumed Flask/nginx/Docker/Linux. Testing against sacoeteccscdept.com.ng revealed that many small applications — particularly in education — run on PHP/Apache shared hosting with none of the VPS-level access that earlier checks assumed.

Several changes were made:

Stack detection extended:

• .php URL patterns detected before any HTTP connection
• PHPSESSID cookie detection
• X-Powered-By: PHP header detection
• PHP + Apache + no VPS signals → shared_hosting=True Scoring adjustments:
• Infrastructure WARNs (no SSH, no Docker) excluded from scoring for shared hosting
• A PHP app on cPanel should not receive an F because it cannot provide SSH access Admin path expansion:
• /phpmyadmin, /pma, /cpanel, /wp-admin, /wp-login.php, /administrator added for PHP detection PHP patch templates:
• APP-CSRF-001 now outputs Laravel @csrf, vanilla PHP, and CodeIgniter patterns
• APP-ADMIN-001 outputs PHP route protection patterns

Browser User-Agent

Shared hosting environments and some WAF configurations reject requests with the default python-requests/2.x.x user agent. The HTTP scanner was updated to set a realistic Chrome 124 user agent on the requests session:

session.headers.update({
    "User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) "
                  "AppleWebKit/537.36 (KHTML, like Gecko) "
                  "Chrome/124.0.0.0 Safari/537.36"
})

Auto-Fix Engine Hardening

Several real-world issues were discovered and fixed during live server testing:

TLS snippet conflict with Let’s Encrypt:
The initial TLS fix included ssl_prefer_server_ciphers on; which conflicts with Certbot-managed configurations. This directive was removed from the snippet. The fix now always overwrites the snippet file to ensure consistency.

nginx cascade protection:
The _nginx_config_broken flag was added after a failed TLS fix caused subsequent HSTS and security header fixes to silently fail. The flag now aborts dependent fixes with a clear explanation.

datetime import conflict:
An early version imported datetime twice — once from the standard library and once as a class. The auto-fix engine raised TypeError: 'module' object is not callable when generating key filenames. Fixed by using from datetime import datetime, timezone explicitly.

Verbose mode consistency:
--verbose was not propagated to several internal methods including _ensure_ssh_key, _open_ssh_client, _fix_dockerfile, and _fix_compose_file. All verbose flags were wired through to their respective methods.

WS-DIR-001 Early Abort

Testing against sacoeteccscdept.com.ng revealed a scan duration of 65.6 seconds — significantly above the typical 30–35 seconds for a VPS. The majority of this time was consumed by WS-DIR-001 probing directory paths that the shared hosting infrastructure blocked with connection timeouts.

An early-abort mechanism was added: the check stops probing after two consecutive ReadTimeout or ConnectTimeout exceptions. This reduced the worst-case contribution of WS-DIR-001 from ~18 seconds to ~6 seconds on shared hosting targets.

PyPI Publication

StackSentry was published to the Python Package Index at the conclusion of Phase 4.

Key pyproject.toml decisions:

• Hard pins (paramiko==3.4.0) were relaxed to floor constraints (paramiko>=2.11.0) to prevent install conflicts with existing environments
• anthropic was moved from a hard dependency to an optional [llm] extra — users who only want scanning do not need the Anthropic SDK
• Paramiko was placed in a [ssh] optional extra for the same reason

pip install stacksentry           # core only
pip install stacksentry[ssh]      # + Paramiko for auto-fix
pip install stacksentry[llm]      # + Anthropic for AI patches
pip install stacksentry[ssh,llm]  # everything

Live Evaluation Results

Three live applications were scanned during Phase 4:

Target 1 — a production admin panel

All six FAIL results manually verified as genuine misconfigurations. Zero false positives detected.

Target 2 — bblearn.londonmet.ac.uk (Blackboard Ultra)

Grade: D (66.7%). CSRF correctly detected via xsrf cookie (Strategy 3). SPA-aware admin detection returned WARN (not FAIL) for all probed paths. Server header empty — no version disclosure.

Target 3 — sacoeteccscdept.com.ng (PHP/Apache)

Grade: F (27.3%). Stack auto-detected from URL pattern alone before any HTTP response. Admin paths probed at directory level (not filename level — a bug fix from Phase 3 where /students/static/index.php/admin was being probed instead of /students/static/admin).

Phase 4 Test Suite

Total: 321 tests, 0 failures, 1.55 seconds

New tests added in Phase 4:

• PHP stack detection from URL, header, and cookie signals
• Shared hosting scoring exclusion
• Early-abort behaviour in WS-DIR-001
• LLM verbose mode propagation
• datetime import fix regression test
• nginx cascade abort behaviour

What Phase 4 Proved

The most important result from Phase 4 is not the PyPI publication or the grade improvement — it is the false positive rate. On the controlled VPS where every configuration detail was known, every FAIL result was confirmed as genuine. A security tool that cries wolf is worse than no tool at all. Zero false positives on the controlled target is the result that validates the framework’s approach.