FixGrid Platform — Security & Readiness Report

Scan 1 — OWASP ZAP (authenticated dynamic scan, DAST)

ZAP actively attacks a running application — injection payloads, header and cookie checks, redirect and disclosure probes — against every URL and parameter it can reach. This round was run behind login, as a Company Admin, so the scan exercised the tenant-scoped surfaces a signed-in customer actually uses, not just the public login page. The founder was at the keyboard for login and the crawl; the active scan itself was driven over ZAP's local API against a local instance of the production build, throttled to 2 threads with a 50 ms delay for the single-threaded development server.

Coverage: the spider found 228 URLs in 20 seconds; 160 distinct application paths were scanned across the main run plus a four-path supplemental pass. That included 40 paths under the company-admin console; the Construction Handover surfaces (engagement, first-occupancy, photos, imports and the Procore connection page); Unit Acceptance (list and launch); Integrations and the Developers API-key page; technician tickets; inspections, including a specific inspection's execution page; and reports. Reaching specific numbered tenant records — a ticket, a handover engagement, an inspection — is the evidence that the session was real: an unauthenticated run sees only login, signup, forgot-password, robots and sitemap.

Excluded by design: logout, the MFA verification path (an active scan would either lock the session out or exercise a code brute-force path that is neither useful nor safe to fuzz), account settings, and the public form endpoints (Cloudflare Turnstile was switched off locally so the intercepting proxy could work, so those routes were kept out of scope to avoid sending real demo-request email). Third-party hosts that appear in browser traffic (Cloudflare, Google) were excluded as noise. Not exercised, honestly: the Procore import-review page, which needs a completed import run that the local database did not hold. It is recorded as a gap for the next round.

The login rate limiter answered the scanner with 429 Too Many Requests mid-run — the limiter working as designed under a fast scripted client, not an outage.

Fifteen alert types, 239 instances, from the JSON export's own per-alert count fields, cross-checked against the instance lists. ZAP's live summary API reads higher raw totals during a run because it counts every repeat of the same finding across query variants; the type counts are identical either way and are the numbers this report stands on.

High — SQL Injection (1 type, 3 instances) · confirmed false positive

Medium — 4 alert types, 19 instances

Low — 4 alert types, 15 instances

Informational — 6 alert types, 202 instances

Production header parity

Because the scan ran against a plain-HTTP local instance, the security-header set was confirmed against production the same morning (2026-09-10, https://app.fixgrid.app/auth/login): Strict-Transport-Security, Cross-Origin-Opener-Policy: same-origin, Cross-Origin-Resource-Policy: same-origin, X-Content-Type-Options: nosniff, X-Frame-Options: DENY, Referrer-Policy: strict-origin-when-cross-origin, and the same Content-Security-Policy directive set ZAP captured locally. Every header is emitted by a single after-request hook that runs on every response in both environments; the application adds HSTS only on secure requests, which is why the local capture lacked it and production carries it. The only other difference is the Server value (Cloudflare edge versus the development server). Both "local dev server" findings above are therefore genuinely local-only, not gaps in what production serves.

June → September delta

• June 21, 2026: 9 alert types — 0 High / 3 Medium / 3 Low / 3 Informational — with the crawl limited to the auth pages and the company console; the Construction Handover, Unit Acceptance and Integrations surfaces did not exist yet.
• September 10, 2026: 15 alert types — 1 High (false positive) / 4 Medium / 4 Low / 6 Informational — reaching the handover, unit-acceptance, integrations, technician, inspection and report surfaces this round was scheduled to cover. The six additional types are new surfaces, ZAP 2.17.0 rule additions, or the local-TLS fact expressed twice ("HTTP Only Site" and the version-leaking Server header).
• The three raw Highs are one false-positive class against two routes with pre-existing integer-coercion input handling — not a regression, and not raw SQL anywhere in either file. The CSP Mediums are the same accepted trade-off as June. The informational total (202 versus 3 instances) tracks roughly 8× the crawled surface, not new risk.

What the next round improves

• An HTTPS local target (a TLS-terminating proxy in front of the development server) so "HTTP Only Site" and the Server version leak stop appearing as local-only artifacts and the record shows only findings that could theoretically reach production.
• A seeded local Procore import run, so the import-review page is exercised for the first time.
• The session cookie declared explicitly as a session-management token in the ZAP context, so ZAP's authentication rules run with full confidence rather than relying on request replay carrying the cookie implicitly.

Scan 2 — Nuclei (known-CVE, exposure and misconfiguration templates)

Nuclei is ProjectDiscovery's template-driven scanner: known CVEs, exposed files and backups, misconfigurations, exposed admin panels, default credentials and technology fingerprints. It fills the "is anything exposed, or running a known-vulnerable component" lane that broad DAST and static analysis don't focus on. Against a custom Flask application most templates will not match by design — the value is the absence of exposure findings across roughly ten thousand checks. Denial-of-service, intrusive and fuzzing template classes were excluded.

Run of record: concurrency 2, rate limit 5 requests/second, 20-second timeout, one retry. 16,743 of 16,853 planned requests completed (99%); the 232 errors are request timeouts against the throttle, not findings — no template that errored produced a partial or ambiguous match. A health probe against the application read 200 every 45 seconds throughout the 65-minute run.

Result: 12 matches, all Informational. Zero Low, Medium, High or Critical.

The June finding did not recur. The 2026-06-21 Nuclei baseline flagged a missing Cross-Origin-Opener-Policy; the header was added the same day and is set unconditionally on every response. None of this round's 12 matches involve COOP, confirming the fix is still in effect. Consistent with June overall: 10–12 informational matches and zero real findings across both runs.

Scan 3 — Bandit (static application security testing)

Bandit performs static analysis on Python source, flagging hardcoded credentials, injection risks, weak cryptography and unsafe calls.

Command: bandit -r routes services models utils app.py config.py -q -ll

Scope: 207,175 lines across routes/, services/, models/, utils/, app.py and config.py. (The May 1, 2026 archive scanned 25,252 lines across four packages; the application and its scan scope have both grown since.)

Scan 4 — pip-audit (dependency CVE scan)

pip-audit resolves every dependency declared in requirements.txt against the PyPA advisory database and OSV.dev.

Command: pip-audit -r requirements.txt  |  Result, verbatim: No known vulnerabilities found.

Scan 5 — Semgrep (SAST, CI's exact configuration)

Semgrep ran with the continuous-integration job's exact configuration — --config=auto --error, one SQLAlchemy performance-hint rule excluded, no timeout — over routes/, models/, services/ and utils/.

Result, verbatim: Ran 289 rules on 458 files: 0 findings, exit code 0.

The same Semgrep job runs in GitHub Actions on every push to the main branch and on every pull request, with --error so that any finding fails the job. This is the CI security gate referenced on the Security overview; it is live, not planned.

Scan methodology & cadence

Every round produces a dated evidence record per tool, with raw exports retained. Findings are dispositioned as fixed, false positive, accepted trade-off (with the reasoning written down), or local-only artifact. Accepted trade-offs are re-stated in each round rather than filtered out, so the count a reader sees is the count the tool produced.

Security controls summary