Network sweep
Sweep crawls every host in the app-inventory sheet on a schedule and writes one dated JSON report per run. This page renders the latest one.
The current report
No run has been published as of 2026-09-21.
The crawler exists and its logic is tested. It has not been run against the live
hosts, because the environment it was built in denies outbound access to
bryancalabro.com. Here is that denial, reproduced:
curl -sS -o /dev/null -w '%{http_code}\n' https://bryancalabro.com/
# curl: (56) CONNECT tunnel failed, response 403
A 403 from an egress proxy is not a finding about the host. Publishing it as one would have been the easiest way to fill this page and the fastest way to make it worthless.
The first real run will come from CI, where the crawl has network access, and it will arrive as a pull request carrying the report file.
What each run checks, per host
| Check | Severity | Passes when |
|---|---|---|
http-status |
high | the apex returns 200 after following redirects |
og-image |
high | the share image declared in the served HTML returns 200 |
www-redirect |
medium | the www host returns 301 to the apex |
favicon |
medium | the declared icon returns 200 |
hsts |
medium | Strict-Transport-Security is present |
x-content-type-options |
medium | the header is exactly nosniff |
manifest |
low | a declared web manifest returns 200 |
referrer-policy |
low | the header is present |
content-security-policy |
low | the header is present |
x-frame-options |
low | the header is present, or the CSP sets frame-ancestors |
response-time |
low | the apex responds within 1500 ms |
Severity is a property of the check, not of the run. Two reports never disagree about how bad the same failure is.
The one big number
Each report leads with the failure rate across the whole network: failing checks divided by all checks, with the host count beside it. Not a grade, not a score out of a hundred. A rate you can recompute from the same report file.
Every finding carries the command that shows it
A finding on og-image ships with the request that produced it:
curl -sS -o /dev/null -w '%{http_code}\n' 'https://qr.bryancalabro.com/favicons/og-image.jpg'
That is the whole finding. No adjective is added, because an adjective cannot be checked. See on repro lines for why I hold that rule even when it is inconvenient.
The flake budget is published with the report
A check has to fail twice in a row before it counts. Each report says how many findings that rule held back. See the flake budget.
The report is a file, not an alert
Runs land in reports/ in the sweep repo as timestamped JSON, and the schema is
versioned so this desk can embed the latest one without breaking when the crawler
grows a field. Nothing pages anyone. A report is something you read, not something
that wakes you up.