Setup & deployment.

ArgusSecure is a three-tier app: React frontend (port 3000), FastAPI backend (port 8001) under /api ingress, and MongoDB for persistence. Long-running scans run as FastAPIBackgroundTasks; OWASP ZAP is reached via the officialzaproxy client when a project is configured to use it.

• Stateless API — every JWT contains jti; logout writes to revoked_tokens.
• Auth — argon2id hashes via passlib. JWT secret rotated by setting JWT_SECRET.
• Rate limits — MongoDB-backed sliding window, applied per route via rate_limit().
• Secrets — every credential read with os.environ.get(). Never hardcoded.

Every scan mode has a built-in implementation. ArgusSecure ships its own scanners for SAST, DAST, SCA, and Cloud, and bundles additional OSS engines (Semgrep, Trivy, Gitleaks, Checkov, Nuclei, Grype) so secrets, IaC, and container modes work out of the box too. Commercial connectors are optional — never required for any mode.

Bundled OSS binaries (Semgrep, Trivy, Gitleaks, Checkov, Nuclei, Grype) are stashed under /app/backend/_bin/ and re-linked into /usr/local/bin/ on every backend boot. View live status under Admin → Engines.

Clone, install, run. The frontend hot-reloads; the backend hot-reloads via supervisor.

# 1. Backend
cd backend
pip install -r requirements.txt
cp .env.example .env   # fill in MONGO_URL, DB_NAME at minimum

# 2. Frontend
cd ../frontend
yarn install
cp .env.example .env   # set REACT_APP_BACKEND_URL

# 3. Run (supervisor manages both)
sudo supervisorctl restart backend frontend
curl -s $REACT_APP_BACKEND_URL/api/health   # → {"status":"ok",...}

The seed runs on backend startup and provisions a demo organization with three pre-scanned projects (SAST/SCA/DAST). Default credentials are listed below — change them before any production deploy.

The two .env files map cleanly onto frontend and backend processes.

backend/.env

frontend/.env

Two endpoints, two audiences.

• GET /api/health — fast, no-DB liveness probe. Returns 200 if the Python process is up. Suitable for load-balancer health checks.
• GET /api/v1/health — DB ping + integration audit. Reports which env vars are configured (presence only, never values) and the active CORS allow-list. Useful when debugging a production deploy.

curl -s $REACT_APP_BACKEND_URL/api/v1/health | jq
# {
#   "status": "ok",
#   "service": "argussecure-api",
#   "checks": {
#     "mongodb": { "ok": true, "detail": "argussecure" },
#     "integrations": { "EMERGENT_LLM_KEY": true, "STRIPE_API_KEY": true, ... },
#     "cors_allow_origins": ["https://argus-secure.com", ...]
#   }
# }

• Emergent LLM Key — powers Goddy + Fix-It Agent (Claude Sonnet 4.5, GPT-4o, Gemini text + Nano Banana, etc). Issued from your Emergent profile under Universal Key.
• Stripe — test keys fromStripe dashboard . On Emergent, the platform proxy key works out of the box.
• Resend — get an API key atresend.com/api-keys . Without it, mail still queues to email_outbox so you can audit what would have been sent.
• hCaptcha — site + secret keys fromhCaptcha dashboard .
• OWASP ZAP — install the daemon locally, then add a ZAP integration inSettings → Integrations. Per-project DAST engine selector chooses between the built-in scanner and ZAP.

Run through this before pointing a real domain at ArgusSecure.

• Set OWNER_PASSWORD and JWT_SECRET to strong, unique values (32+ bytes).
• Rotate the seeded demo@argus.security and owner@argus.security passwords.
• Set CORS_ORIGINS to your exact domain(s) — drop the wildcard.
• Enable hCaptcha by setting both HCAPTCHA_SECRET and HCAPTCHA_SITE_KEY.
• Issue real Stripe + Resend keys (or accept the dev-mode degraded states).
• Confirm /api/v1/health returns status:ok with no missing integrations.
• Confirm /api/health is whitelisted in your load balancer / CDN.
• Verify the demo org appears at /demo (proves seeding ran cleanly).

Goddy says "AI is disabled"

EMERGENT_LLM_KEY is unset or has zero balance. Add credit at Profile → Universal Key → Add Balance.

Login returns CORS error from a custom domain

Add the domain to CORS_ORIGINS (or set APP_PUBLIC_URL). The defaults already cover argus-secure.com and the Emergent preview host.

Scans hang in "running"

Check /var/log/supervisor/backend.err.log for the scanner traceback. For ZAP-engine projects, verify the ZAP daemon is reachable from the backend container.

Verification emails never arrive

Without RESEND_API_KEY, mail is logged in the email_outbox collection. Owners can replay them by issuing the API key and re-running the relevant action.