Three realistic targets so you can see every verdict tier for real. All bind to 127.0.0.1 only. The app is an ordinary Express 5 API (express.json()), so it decompresses Content-Encoding: br request bodies by default — the reachable Brotli path. Only the Node.js version differs between vulnerable and patched.

Node keeps process.versions.brotli == "1.2.0" on both 24.22.0 and 24.22.1 — the patch is a source fix to the bundled decoder, not a version bump. So the verdict keys on the Node version, not the Brotli string. The stealth target proves why a behavioral probe matters.

./run.sh      # build + start all three
./stop.sh     # tear down

or from the repo root: docker compose up vuln patched stealth.

curl -s http://127.0.0.1:8091/health            # {"status":"ok","node":"24.22.0",...}
python3 ../scanner/n2s_scan.py -u http://127.0.0.1:8091/api/orders --probe

For authorized, local testing only.