Security

What's reachable that shouldn't be — from dummy data.

Critical

Open findings

Resolved

Published ports

These checks run on the server they inspect, so they see Docker's port bindings but not the host firewall directly. A port "bound to all interfaces" is a real finding regardless — but on this host, the firewall table below is the source of truth for what's actually reachable from outside.

2 new findings since the previous scan (6h ago): Postgres reachable from the internet, Adminer exposed on a high port.1 no longer present: MySQL port closed.

Findings

Worst first · resolved items stay listed as evidence

This database publishes its port on every interface, not just the Docker overlay network. Anyone who finds the address can attempt a connection.
Fix: Close the published port. Panel and other containers keep reaching it over the internal Docker network either way.

Published ports

What Docker binds on the host

Port	Proto	Bound to	Container	Verdict
443	tcp	0.0.0.0	traefik	expected
80	tcp	0.0.0.0	traefik	expected
22	tcp	0.0.0.0	sshd	expected
5433	tcp	0.0.0.0	client-b-postgres	all interfaces
32770	tcp	0.0.0.0	client-d-adminer	all interfaces
6379	tcp	127.0.0.1	client-c-redis	expected
5432	tcp	127.0.0.1	xyte-postgres	expected

Host firewall

Hostinger VPS firewall · default deny

Rule	Ports	Source	Action	Status
HTTPS	443 / tcp	any	allow	active
HTTP	80 / tcp	any	allow	active
SSH	22 / tcp	any	allow	active
Docker Swarm mesh	7946, 4789 / tcp/udp	overlay only	allow	active
Default policy	* / all	any	deny	active
Legacy monitoring agent	9100 / tcp	any	allow	disabled