Security Agent pentest crashes single-threaded servers — gunicorn or equivalent required

Ran a Security Agent pentest against Flask's development server (python3 app.py, single-threaded). The test FAILED mid-way through the PENTEST phase:

Output

{
  "code": "CLIENT_ERROR",
  "message": "Endpoints not accessible after 5 consecutive validation attempts: ['http://...: HTTP 503 for user-agent:securityagent. Check WAF/Cloudflare settings']"
}

Security Agent runs 13 attack categories (XSS, SQLi, IDOR, SSRF, SSTI, etc.) in parallel. Flask's single-threaded dev server couldn't handle the concurrent load and crashed.

Switching to gunicorn with 4 workers fixed it:

Terminal

sudo systemd-run --unit=vuln-app \
  --working-directory=/opt/vulnerable-app \
  gunicorn --bind 0.0.0.0:80 --workers 4 --timeout 120 app:app

Not an issue in production environments, but easy to forget when spinning up a quick test server for verification.