I shipped an unauthenticated RCE in my own port scanner — here's the whole chain, and how I killed it

I built a web front end for an Nmap-based port scanner: a FastAPI backend, a React dashboard, background scan jobs, a plugin system, the works. It ran fine. Then I sat down and actually audited it lik...