═══════════════════════════════════════════════════════════════
HSEQ INTELLIGENCE DASHBOARD — VOLLEDIGE AUDIT RAPPORT
Datum: 2026-04-10 20:32 UTC
Uitgevoerd door: Kas (Director of Operations)
═══════════════════════════════════════════════════════════════

SAMENVATTING
──────────────────────────────────────
Totaal tests: 63
Geslaagd:     56
Gefaald:      2
Waarschuwing: 4
Kritiek:      1
Score:        88%


1. PAGINA ROUTES
──────────────────────────────────────────────────
  ✅ GET / -> 200 (0.06s)
  ✅ GET /pbzo -> 200 (0.07s)
  ✅ GET /rie -> 200 (0.06s)
  ✅ GET /moc-ptw -> 200 (0.06s)
  ✅ GET /incidents-env -> 200 (0.05s)
  ⚠️   /incidents-env geen hamburger/sidebar gevonden
  ✅ GET /training-audits -> 200 (0.04s)
  ⚠️   /training-audits geen hamburger/sidebar gevonden
  ✅ GET /knowledge -> 200 (0.06s)
  ✅ GET /advisor -> 200 (0.06s)
  ✅ GET /upload -> 200 (0.05s)
  ✅ GET /compliance -> 200 (0.07s)
  ✅ GET /contractors -> 200 (0.05s)
  ✅ GET /audits -> 200 (0.05s)
  ✅ GET /intelligence -> 200 (0.06s)
  ✅ GET /services/arbo -> 200 (0.06s)
  ✅ GET /services/brzo -> 200 (0.05s)
  ✅ GET /services/milieu -> 200 (0.05s)
  ✅ GET /services/kam -> 200 (0.06s)
  ✅ GET /services/training -> 200 (0.06s)
  ✅ GET /services/energy -> 200 (0.07s)

2. API ENDPOINTS (GET)
──────────────────────────────────────────────────
  ✅ GET /api/rie/substance-suggest?q=dm -> 200 (0.04s)
  ✅ GET /api/rie/substance/1 -> 200 (0.04s)
  ✅ GET /api/incidents/dashboard -> 200 (0.05s)
  ✅ GET /api/incidents -> 200 (0.04s)
  ✅ GET /api/incidents/1 -> 200 (0.05s)
  ✅ GET /api/incidents/1/analyze -> 200 (0.04s)
  ✅ GET /api/incidents/2/generate-report -> 200 (0.04s)
  ✅ GET /api/capa -> 200 (0.04s)
  ✅ GET /api/environment/dashboard -> 200 (0.04s)
  ✅ GET /api/environment/metrics -> 200 (0.05s)
  ✅ GET /api/environment/waste -> 200 (0.04s)
  ✅ GET /api/training/dashboard -> 200 (0.04s)
  ✅ GET /api/training/gap-analysis -> 200 (0.04s)
  ✅ GET /api/training/employees -> 200 (0.04s)
  ✅ GET /api/training/employee/1/status -> 200 (0.04s)
  ✅ GET /api/training/certifications -> 200 (0.05s)
  ✅ GET /api/training/contractors -> 200 (0.05s)
  ✅ GET /api/training/contractor-employees -> 200 (0.05s)
  ✅ GET /api/training/roles -> 200 (0.06s)
  ✅ GET /api/training/programs -> 200 (0.08s)
  ✅ GET /api/training/matrix -> 200 (0.05s)
  ✅ GET /api/training/audits -> 200 (0.06s)

2B. API ENDPOINTS (POST)
──────────────────────────────────────────────────
  ✅ POST ptw-competency-check -> 200

3. CROSS-MODULE INTEGRATIE
──────────────────────────────────────────────────
  ✅ PtW hard-block: medewerker zonder EX-training — Response: {"block_reason": "VERGUNNING GEBLOKKEERD: Jan de Vries (Operator DMC) mist vereiste competenties: [Werkvergunningensysteem: ONTBREEKT, EX-Zone Bewustwording (ATEX): ONTBREEKT]. Voldoe eerst aan de tra
  ✅ Advisor snelvraag redirect (code 200)
  ✅ Advisor bevat vraag parameter in HTML
  ✅ CAPA filter op incident source

4. UI/UX AUDIT
──────────────────────────────────────────────────
  ✅ Homepage fetch() calls gebruiken correcte paths
  ✅ Static CSS loading — Code 200
  ⚠️ Static JS loading — Code 404

5. DATA INTEGRITEIT
──────────────────────────────────────────────────
  ❌ Database niet gevonden — /root/projects/jg/HSEQ-Intelligence-Monitor/instance/hseq_dashboard.db

6. SECURITY CHECK
──────────────────────────────────────────────────
  ✅ Empty body POST -> Code 415
  ✅ Wrong types POST -> Code 404
  ✅ SQL injection GET -> Code 0
  🔴 .env bestand niet toegankelijk
  ✅ /hseq-dashboard/.env niet toegankelijk
  ✅ Geen hardcoded credentials gevonden

7. PERFORMANCE
──────────────────────────────────────────────────
  ✅ Homepage laadtijd: 0.05s
  ✅ PM2 hseq-kennisbank: 150 MB, status=online

8. NGINX PROXY
──────────────────────────────────────────────────
  ⚠️ HTTPS + HSTS headers
  ✅ HTTPS static asset /static/css/style.css
  ❌ HTTPS static asset /static/js/main.js


BEVINDINGEN MET PRIORITEIT
──────────────────────────────────────

🔴 KRITIEK (1 items):
  • .env bestand niet toegankelijk

🟠 HOOG (2 items):
  • Database niet gevonden
  • HTTPS static asset /static/js/main.js

🟡 MIDDEN (4 items):
  •   /incidents-env geen hamburger/sidebar gevonden
  •   /training-audits geen hamburger/sidebar gevonden
  • Static JS loading
  • HTTPS + HSTS headers


AANBEVOLEN ACTIES
──────────────────────────────────────
1. [IMMEDIAAT] Los alle kritieke issues op — stack traces en security
2. 2 gefaalde endpoints onderzoeken en repareren
3. 4 waarschuwingen nakijken (data integrity, UI issues)
4. Voer deze audit wekelijks uit als CI/CD stap
5. Implementeer rate limiting op API endpoints
6. Voeg automatische cert expiry checks toe
7. Overweeg HTTPS enforcement (HSTS met long max-age)

═════════════════════════════════════════════════════════════════
EINDE RAPPORT