PASS MySQL concurrent quota race: 20 processes, exactly 5 accepted and 15 limited
PASS real Redis worker safely records provider failure without fabricated detections
PASS real HTTP request without CSRF token returns 419
PASS fresh browser session cannot view another guest report
PASS upload → Redis worker → scanner-unavailable errors → private report, with no fabricated verdicts; live socket mode still needs acceptance
PASS project .env and scanner source are outside the public document root
PASS security response headers on real HTTP upload response
