Developer audits own Nmap web UI, finds unauthenticated RCE chain

A developer built an Nmap-based port scanner with a FastAPI backend and React frontend, then audited it for security flaws. They discovered no authentication, an upload endpoint that allowlisted its own files, and a potential RCE via Nmap's --script flag. The RCE was blocked by argparse, but the developer hardened the app anyway.