scan.nextcloud.com reports wrong data

Nextcloud security scanner scan.nextcloud.com doesn't reflect real config.

Scanner relies on public information according to description

Our scan is strictly based on publicly available information

But there are few checks related to information not publicly exposed e.g. have-I-been-pawned, MFA and brute-force protection. In my test instance I disabled some security measures and re-trigger the scan. Surprisingly the scan still reports brute-force protection and MFA enabled - while this are effectively inactive in the instance as shown in the screenshot (e.g. all MFA providers are disabled)

It seems the scanner has some assumptions build-in and doesn't reflect effective system config. If an admin would rely on the scanner chances exist insecure system settings exist while the scanner is "all green".

Please improve the detection or remove broken checks.

The issue names no files, tests, or entry points. Start by reproducing the scan with MFA providers, brute-force protection, and Have I Been Pwned checks disabled, then compare the reported results with the effective configuration. Done means the scanner accurately detects these settings or the broken checks are removed.