@pbpyrojust/universal-security-audit 0.0.0-stage → 0.2.0

package/scripts/lib/pentest-recon.mjs

@@ -0,0 +1,215 @@
+// ── Lightweight recon-phase checks: everything here is a single passive DNS lookup or a single
+// unauthenticated GET/OPTIONS request (redirect: 'manual' where relevant so nothing is actually
+// followed/executed). No brute force, no destructive HTTP verbs (PUT/DELETE are never sent — only
+// introspected via OPTIONS), no fuzzing. This is the same class of recon a search engine crawler,
+// browser, or automated security scanner (Mozilla Observatory, Qualys, etc.) performs routinely. ──
+import dns from 'node:dns/promises';
+
+const UA = 'Universal-Security-Audit';
+
+async function safeGet(url, opts = {}) {
+  const controller = new AbortController();
+  const t = setTimeout(() => controller.abort(), opts.timeoutMs || 8000);
+  try {
+    const res = await fetch(url, { redirect: 'manual', headers: { 'user-agent': UA }, ...opts, signal: controller.signal });
+    clearTimeout(t);
+    return res;
+  } catch (e) {
+    clearTimeout(t);
+    return null;
+  }
+}
+
+// ── Subdomain takeover: dangling CNAMEs pointing at unclaimed cloud resources ──
+const TAKEOVER_FINGERPRINTS = [
+  { host: /\.github\.io$/i, service: 'GitHub Pages', probe: /there isn.t a github pages site here/i },
+  { host: /\.herokuapp\.com$/i, service: 'Heroku', probe: /no such app/i },
+  { host: /\.s3[.-][\w-]*\.amazonaws\.com$/i, service: 'AWS S3', probe: /nosuchbucket/i },
+  { host: /\.azurewebsites\.net$/i, service: 'Azure App Service', probe: /404 web site not found/i },
+  { host: /\.surge\.sh$/i, service: 'Surge.sh', probe: /project not found/i },
+  { host: /\.bitbucket\.io$/i, service: 'Bitbucket Pages', probe: /repository not found/i },
+  { host: /\.ghost\.io$/i, service: 'Ghost', probe: /the thing you were looking for is no longer here/i },
+  { host: /\.pantheonsite\.io$/i, service: 'Pantheon', probe: /404 error unknown site/i },
+  { host: /\.wpengine\.com$/i, service: 'WP Engine', probe: /this site does not exist/i },
+  { host: /\.fastly\.net$/i, service: 'Fastly', probe: /fastly error: unknown domain/i },
+  { host: /\.myshopify\.com$/i, service: 'Shopify', probe: /sorry, this shop is currently unavailable/i },
+  { host: /\.zendesk\.com$/i, service: 'Zendesk', probe: /help center closed/i },
+  { host: /\.webflow\.io$/i, service: 'Webflow', probe: /the page you are looking for doesn.t exist/i },
+  { host: /\.netlify\.app$/i, service: 'Netlify', probe: /not found - request id/i },
+];
+
+export async function checkSubdomainTakeover(apexOrHostname) {
+  const findings = [];
+  const candidates = new Set([apexOrHostname]);
+  const apex = apexOrHostname.split('.').slice(-2).join('.');
+  for (const sub of ['www', 'dev', 'staging', 'test', 'api', 'cdn', 'shop', 'blog', 'mail', 'admin', 'app']) {
+    candidates.add(`${sub}.${apex}`);
+  }
+  for (const host of candidates) {
+    let cname;
+    try { cname = (await dns.resolveCname(host))[0]; } catch { continue; }
+    if (!cname) continue;
+    const fp = TAKEOVER_FINGERPRINTS.find((f) => f.host.test(cname));
+    if (!fp) continue;
+    const res = await safeGet(`http://${host}/`, { redirect: 'follow' });
+    if (!res) continue;
+    const body = await res.text().catch(() => '');
+    if (fp.probe.test(body)) {
+      findings.push({ host, cname, service: fp.service, note: `${host} CNAMEs to ${cname} (${fp.service}) which returns an "unclaimed resource" page — possible subdomain takeover.` });
+    }
+  }
+  return findings;
+}
+
+// ── HTTP methods introspection (no PUT/DELETE/TRACE actually sent — OPTIONS only) ──
+const RISKY_METHODS = ['PUT', 'DELETE', 'TRACE', 'CONNECT'];
+export async function checkHttpMethods(url) {
+  const res = await safeGet(url, { method: 'OPTIONS' });
+  if (!res) return { checked: false };
+  const allow = res.headers.get('allow') || '';
+  const methods = allow.split(',').map((m) => m.trim().toUpperCase()).filter(Boolean);
+  const risky = methods.filter((m) => RISKY_METHODS.includes(m));
+  return { checked: true, methods, risky };
+}
+
+// ── Open redirect: canary param probing (Location header inspected, never followed) ──
+const REDIRECT_PARAMS = ['redirect', 'redirect_uri', 'redirect_url', 'url', 'next', 'return', 'returnTo', 'return_to', 'dest', 'destination', 'continue', 'r'];
+const CANARY = 'https://open-redirect-canary.invalid/';
+export async function checkOpenRedirect(origin) {
+  const findings = [];
+  for (const param of REDIRECT_PARAMS) {
+    const testUrl = `${origin}/?${param}=${encodeURIComponent(CANARY)}`;
+    const res = await safeGet(testUrl);
+    if (!res) continue;
+    if (res.status >= 300 && res.status < 400) {
+      const loc = res.headers.get('location') || '';
+      if (loc.startsWith(CANARY) || loc.includes('open-redirect-canary.invalid')) {
+        findings.push({ param, testUrl, location: loc });
+      }
+    }
+  }
+  return findings;
+}
+
+// ── Missing Subresource Integrity on cross-origin scripts/styles ──
+export function checkMissingSri(html = '', pageOrigin) {
+  const missing = [];
+  const scriptTags = [...html.matchAll(/<script\b([^>]*)>/gi)];
+  const linkTags = [...html.matchAll(/<link\b([^>]*rel=["']stylesheet["'][^>]*)>/gi)];
+  const check = (attrs, urlAttr) => {
+    const srcMatch = new RegExp(`${urlAttr}=["']([^"']+)["']`, 'i').exec(attrs);
+    if (!srcMatch) return;
+    const url = srcMatch[1];
+    let isCrossOrigin = false;
+    try { isCrossOrigin = new URL(url, pageOrigin).origin !== pageOrigin; } catch { return; }
+    if (!isCrossOrigin) return;
+    if (!/integrity=/i.test(attrs)) missing.push(url);
+  };
+  for (const [, attrs] of scriptTags) check(attrs, 'src');
+  for (const [, attrs] of linkTags) check(attrs, 'href');
+  return [...new Set(missing)];
+}
+
+// ── Exposed .js.map source maps (source-code disclosure) ──
+export async function checkExposedSourceMaps(scriptUrls = [], { limit = 8 } = {}) {
+  const found = [];
+  const jsUrls = [...new Set(scriptUrls.filter((u) => /\.js(\?|$)/i.test(u)))].slice(0, limit);
+  for (const url of jsUrls) {
+    const mapUrl = url.replace(/(\?.*)?$/, '').replace(/\.js$/i, '.js.map');
+    const res = await safeGet(mapUrl, { method: 'GET' });
+    if (res && res.status >= 200 && res.status < 300) {
+      const text = await res.text().catch(() => '');
+      if (text.trim().startsWith('{') && /"sources"/.test(text)) found.push(mapUrl);
+    }
+  }
+  return found;
+}
+
+// ── Email-spoofing defense: SPF (from already-fetched TXT records) + DMARC (separate DNS query) ──
+export async function checkEmailAuthRecords(hostname, txtRecords = []) {
+  const hasSpf = txtRecords.some((t) => /^v=spf1/i.test(t));
+  let hasDmarc = false, dmarcPolicy = null;
+  try {
+    const dmarcTxt = (await dns.resolveTxt(`_dmarc.${hostname}`)).map((t) => t.join(''));
+    const rec = dmarcTxt.find((t) => /^v=DMARC1/i.test(t));
+    if (rec) {
+      hasDmarc = true;
+      dmarcPolicy = /p=(\w+)/i.exec(rec)?.[1] || null;
+    }
+  } catch {}
+  return { hasSpf, hasDmarc, dmarcPolicy };
+}
+
+// ── WordPress user enumeration via ?author=N (classic recon technique, in addition to wp-json) ──
+export async function enumerateWpAuthors(origin, { maxId = 5 } = {}) {
+  const found = [];
+  for (let id = 1; id <= maxId; id++) {
+    const res = await safeGet(`${origin}/?author=${id}`);
+    if (!res) continue;
+    const loc = res.headers.get('location') || '';
+    const m = /\/author\/([^/]+)\/?$/i.exec(loc);
+    if (m) found.push({ id, username: decodeURIComponent(m[1]) });
+  }
+  return found;
+}
+
+// ── Login forms that submit over plaintext HTTP (credentials sent in cleartext) ──
+export function checkInsecureLoginForms(html = '', pageUrl = '') {
+  const findings = [];
+  const pageIsHttp = /^http:\/\//i.test(pageUrl);
+  const forms = [...html.matchAll(/<form\b([^>]*)>([\s\S]*?)<\/form>/gi)];
+  for (const [, attrs, body] of forms) {
+    if (!/type=["']password["']/i.test(body)) continue;
+    const actionMatch = /action=["']([^"']*)["']/i.exec(attrs);
+    const action = actionMatch?.[1] || '';
+    const actionIsHttp = /^http:\/\//i.test(action);
+    if (pageIsHttp || actionIsHttp) {
+      findings.push({ pageUrl, action: action || '(same page)', reason: pageIsHttp ? 'page served over plain HTTP' : 'form action is an http:// URL' });
+    }
+  }
+  return findings;
+}
+
+// ── Verbose error / stack-trace disclosure ──
+const STACK_TRACE_PATTERNS = [
+  /Fatal error:.*on line \d+/i,
+  /Warning:.*in <b>.*<\/b> on line/i,
+  /Stack trace:/i,
+  /at System\.\w+/,
+  /Microsoft \.NET Framework/i,
+  /ORA-\d{5}/,
+  /SQLSTATE\[/i,
+  /Unhandled Exception/i,
+  /Traceback \(most recent call last\)/i,
+  /org\.apache\.catalina/i,
+  /Whoops,? looks like something went wrong/i,
+];
+export async function checkVerboseErrors(origin) {
+  const probePath = `/__usa-nonexistent-${Date.now()}__`;
+  const res = await safeGet(`${origin}${probePath}`, { redirect: 'follow' });
+  if (!res) return { checked: false };
+  const body = await res.text().catch(() => '');
+  const matched = STACK_TRACE_PATTERNS.filter((re) => re.test(body));
+  return { checked: true, status: res.status, leaksStackTrace: matched.length > 0, sample: matched.length ? body.slice(0, 300) : '' };
+}
+
+// ── JWT cookies with weak/no signature enforcement or no expiry ──
+function base64UrlDecode(str) {
+  const s = str.replace(/-/g, '+').replace(/_/g, '/').padEnd(str.length + (4 - (str.length % 4 || 4)) % 4, '=');
+  return Buffer.from(s, 'base64').toString('utf8');
+}
+export function scanCookiesForJwt(cookies = []) {
+  const findings = [];
+  for (const ck of cookies) {
+    const val = ck.value || '';
+    if (!/^[\w-]+\.[\w-]+\.[\w-]*$/.test(val)) continue;
+    const [headerB64, payloadB64] = val.split('.');
+    let header, payload;
+    try { header = JSON.parse(base64UrlDecode(headerB64)); payload = JSON.parse(base64UrlDecode(payloadB64)); } catch { continue; }
+    const issues = [];
+    if (String(header.alg || '').toLowerCase() === 'none') issues.push('alg is "none" — signature not enforced');
+    if (!payload.exp) issues.push('no "exp" claim — token never expires');
+    if (issues.length) findings.push({ cookieName: ck.name, alg: header.alg, issues });
+  }
+  return findings;
+}

package/scripts/lib/pii-payment.mjs

@@ -0,0 +1,79 @@
+// ── PII exposure scanning + payment/donation processor detection ──
+
+const EMAIL_RE = /[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}/gi;
+const PHONE_RE = /(?:\+?1[-.\s]?)?\(?\d{3}\)?[-.\s]\d{3}[-.\s]\d{4}\b/g;
+const SSN_RE = /\b\d{3}-\d{2}-\d{4}\b/g;
+// Loose 13-19 digit sequences with optional separators, then Luhn-validated to cut false positives.
+const CC_CANDIDATE_RE = /\b(?:\d[ -]?){13,19}\b/g;
+
+const SECRET_PATTERNS = [
+  { name: 'AWS Access Key ID', re: /\bAKIA[0-9A-Z]{16}\b/g },
+  { name: 'Stripe live secret key', re: /\bsk_live_[0-9a-zA-Z]{16,}\b/g },
+  { name: 'Stripe live publishable key', re: /\bpk_live_[0-9a-zA-Z]{16,}\b/g },
+  { name: 'Google API key', re: /\bAIza[0-9A-Za-z\-_]{35}\b/g },
+  { name: 'Slack token', re: /\bxox[baprs]-[0-9A-Za-z-]{10,}\b/g },
+  { name: 'Generic private key block', re: /-----BEGIN (?:RSA |EC )?PRIVATE KEY-----/g },
+  { name: 'GitHub token', re: /\bgh[pousr]_[0-9A-Za-z]{36,}\b/g },
+];
+
+function luhnValid(digits) {
+  let sum = 0;
+  let alt = false;
+  for (let i = digits.length - 1; i >= 0; i--) {
+    let n = parseInt(digits[i], 10);
+    if (alt) { n *= 2; if (n > 9) n -= 9; }
+    sum += n;
+    alt = !alt;
+  }
+  return sum % 10 === 0;
+}
+
+export function scanForPii(text = '') {
+  const findings = { emails: new Set(), phones: new Set(), ssnLike: new Set(), cardLike: new Set(), secrets: [] };
+  for (const m of text.matchAll(EMAIL_RE)) findings.emails.add(m[0].toLowerCase());
+  for (const m of text.matchAll(PHONE_RE)) findings.phones.add(m[0]);
+  for (const m of text.matchAll(SSN_RE)) findings.ssnLike.add(m[0]);
+  for (const m of text.matchAll(CC_CANDIDATE_RE)) {
+    const digits = m[0].replace(/[ -]/g, '');
+    if (digits.length >= 13 && digits.length <= 19 && luhnValid(digits)) {
+      findings.cardLike.add(digits.replace(/\d(?=\d{4})/g, '*'));
+    }
+  }
+  for (const pattern of SECRET_PATTERNS) {
+    const matches = [...text.matchAll(pattern.re)];
+    if (matches.length) findings.secrets.push({ type: pattern.name, count: matches.length, sample: matches[0][0].slice(0, 12) + '…' });
+  }
+  return {
+    emails: [...findings.emails],
+    phones: [...findings.phones],
+    ssnLike: [...findings.ssnLike],
+    cardLike: [...findings.cardLike],
+    secrets: findings.secrets,
+  };
+}
+
+const PAYMENT_SIGNATURES = [
+  { name: 'Stripe', re: /js\.stripe\.com|api\.stripe\.com|checkout\.stripe\.com/i },
+  { name: 'PayPal', re: /paypal(?:objects)?\.com\/sdk|paypalobjects\.com/i },
+  { name: 'Square', re: /squareup\.com|square\.site|js\.squarecdn\.com/i },
+  { name: 'Donorbox', re: /donorbox\.org/i },
+  { name: 'Classy', re: /classy\.org|classydonation/i },
+  { name: 'Network for Good', re: /networkforgood\.com/i },
+  { name: 'GiveWP', re: /give-\w+\.js|givewp/i },
+  { name: 'WooCommerce', re: /woocommerce/i },
+  { name: 'Shopify Checkout', re: /checkout\.shopify\.com|cdn\.shopify\.com\/s\/checkout/i },
+  { name: 'Venmo', re: /venmo\.com/i },
+  { name: 'Braintree', re: /braintreegateway\.com|js\.braintreegateway\.com/i },
+  { name: 'Authorize.Net', re: /authorize\.net/i },
+  { name: 'Kindful', re: /kindful\.com/i },
+  { name: 'Bloomerang', re: /bloomerang\.co/i },
+  { name: 'Salesforce/Luminate', re: /convio\.net|luminateonline\.com/i },
+];
+
+export function detectPaymentProcessors(html = '', scriptSrcs = []) {
+  const haystack = html + ' ' + scriptSrcs.join(' ');
+  const found = PAYMENT_SIGNATURES.filter((sig) => sig.re.test(haystack)).map((sig) => sig.name);
+  const hasCardInputForm = /<input[^>]+(?:name|id|autocomplete)=["'][^"']*(?:card[-_]?number|cardnumber|cc-number)/i.test(html);
+  const hasDonationLanguage = /\b(donate|donation|give now|make a gift)\b/i.test(html);
+  return { processors: [...new Set(found)], hasCardInputForm, hasDonationLanguage };
+}

package/scripts/lib/port-scan.mjs

@@ -0,0 +1,72 @@
+// ── Lightweight TCP connect-scan (node:net only, no nmap dependency). A "connect scan" just
+// completes the standard TCP handshake and closes — the same thing any browser/client does when it
+// connects to a service. No SYN-stealth tricks, no payloads sent beyond an optional passive banner read. ──
+import net from 'node:net';
+
+export const COMMON_SERVICE_PORTS = [
+  { port: 21, name: 'FTP' }, { port: 22, name: 'SSH' }, { port: 23, name: 'Telnet' },
+  { port: 25, name: 'SMTP' }, { port: 53, name: 'DNS' }, { port: 110, name: 'POP3' },
+  { port: 111, name: 'RPCbind' }, { port: 135, name: 'MSRPC' }, { port: 139, name: 'NetBIOS' },
+  { port: 143, name: 'IMAP' }, { port: 389, name: 'LDAP' }, { port: 443, name: 'HTTPS' },
+  { port: 445, name: 'SMB' }, { port: 465, name: 'SMTPS' }, { port: 587, name: 'SMTP-Submission' },
+  { port: 993, name: 'IMAPS' }, { port: 995, name: 'POP3S' }, { port: 1433, name: 'MSSQL' },
+  { port: 1521, name: 'Oracle DB' }, { port: 2049, name: 'NFS' }, { port: 2181, name: 'ZooKeeper' },
+  { port: 27017, name: 'MongoDB' }, { port: 3000, name: 'Dev server (Node/Grafana)' },
+  { port: 3306, name: 'MySQL' }, { port: 3389, name: 'RDP' }, { port: 5000, name: 'Dev server (Flask/UPnP)' },
+  { port: 5432, name: 'PostgreSQL' }, { port: 5601, name: 'Kibana' }, { port: 5672, name: 'RabbitMQ' },
+  { port: 5900, name: 'VNC' }, { port: 5984, name: 'CouchDB' }, { port: 6379, name: 'Redis' },
+  { port: 7001, name: 'WebLogic' }, { port: 8000, name: 'Dev server (generic)' },
+  { port: 8080, name: 'HTTP-alt' }, { port: 8443, name: 'HTTPS-alt' }, { port: 8500, name: 'Consul' },
+  { port: 8888, name: 'Dev server (Jupyter/generic)' }, { port: 9000, name: 'PHP-FPM / SonarQube' },
+  { port: 9042, name: 'Cassandra' }, { port: 9200, name: 'Elasticsearch' }, { port: 9300, name: 'Elasticsearch-transport' },
+  { port: 11211, name: 'Memcached' }, { port: 15672, name: 'RabbitMQ-mgmt' }, { port: 27018, name: 'MongoDB-shard' },
+];
+
+export const INTENSITY_PORT_PROFILES = {
+  light: { ports: COMMON_SERVICE_PORTS.slice(0, 15), concurrency: 10, timeoutMs: 1200 },
+  normal: { ports: COMMON_SERVICE_PORTS.slice(0, 35), concurrency: 20, timeoutMs: 1800 },
+  aggressive: { ports: COMMON_SERVICE_PORTS, concurrency: 40, timeoutMs: 2500 },
+};
+
+// Sensitive services that should almost never be reachable from the public internet.
+export const SENSITIVE_PORTS = new Set([21, 22, 23, 111, 135, 139, 445, 1433, 1521, 27017, 3306, 3389, 5432, 5900, 5984, 6379, 9200, 11211]);
+
+function connectScan(host, port, timeoutMs) {
+  return new Promise((resolve) => {
+    const socket = new net.Socket();
+    let settled = false;
+    let banner = '';
+    const finish = (state) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      socket.destroy();
+      resolve({ port, state, banner: banner.trim() });
+    };
+    const timer = setTimeout(() => finish('filtered'), timeoutMs);
+    socket.once('connect', () => {
+      // Passive read only — give the service up to 400ms to volunteer a banner (SSH/FTP/SMTP do this
+      // unprompted). Never send bytes first.
+      socket.once('data', (chunk) => { banner = chunk.toString('utf8', 0, 120).replace(/[^\x20-\x7e]/g, ''); });
+      setTimeout(() => finish('open'), 400);
+    });
+    socket.once('error', () => finish('closed'));
+    socket.connect(port, host);
+  });
+}
+
+export async function scanPorts(host, { ports = COMMON_SERVICE_PORTS, concurrency = 20, timeoutMs = 1800, onProgress = null } = {}) {
+  const results = [];
+  const queue = [...ports];
+  const total = queue.length;
+  async function worker() {
+    while (queue.length) {
+      const entry = queue.shift();
+      const r = await connectScan(host, entry.port, timeoutMs);
+      results.push({ ...entry, ...r });
+      if (onProgress) onProgress(results.length, total, { ...entry, ...r });
+    }
+  }
+  await Promise.all(Array.from({ length: Math.min(concurrency, queue.length || 1) }, worker));
+  return results.sort((a, b) => a.port - b.port);
+}

package/scripts/lib/proxy-support.mjs

@@ -0,0 +1,14 @@
+// ── Route all fetch() traffic through an upstream proxy (e.g. Burp Suite / OWASP ZAP) so a human
+// can inspect/replay requests for manual follow-up testing. Node's global fetch is powered by
+// undici, so setting a global ProxyAgent dispatcher covers every fetch() call in the process —
+// Playwright's browser traffic is proxied separately via its own native `proxy` launch option. ──
+import { ProxyAgent, setGlobalDispatcher } from 'undici';
+
+export function configureFetchProxy(proxyUrl) {
+  if (!proxyUrl) return;
+  setGlobalDispatcher(new ProxyAgent(proxyUrl));
+}
+
+export function playwrightProxyOption(proxyUrl) {
+  return proxyUrl ? { server: proxyUrl } : undefined;
+}

package/scripts/lib/report-builder.mjs

@@ -0,0 +1,113 @@
+// ── Shared HTML dashboard builder, used both inline during a live audit run and by the
+// standalone scripts/generate-security-report.mjs (--run-dir) regenerator. Branding-aware so
+// reports can be white-labeled the same way universal-seo-audit's generate-visual-report.mjs is. ──
+
+export const DEFAULT_BRANDING = {
+  companyName: 'Universal Security Audit',
+  logo: '',
+  primaryColor: '#ef4444',
+  secondaryColor: '#0f172a',
+  accentColor: '#22c55e',
+  reportTitle: 'Security & Attack Surface Audit',
+  author: '',
+  footerText: '',
+};
+
+export function loadBranding(fs, path, brandConfigPath) {
+  let branding = { ...DEFAULT_BRANDING };
+  if (brandConfigPath) {
+    try {
+      const custom = JSON.parse(fs.readFileSync(path.resolve(process.cwd(), brandConfigPath), 'utf8'));
+      branding = { ...branding, ...custom };
+    } catch (e) {
+      console.error(`Warning: could not read --brand-config (${String(e?.message || e)}); using defaults.`);
+    }
+  }
+  return branding;
+}
+
+function esc(s) { return String(s ?? '').replace(/[&<>"']/g, (ch) => ({ '&': '&amp;', '<': '&lt;', '>': '&gt;', '"': '&quot;', "'": '&#39;' }[ch])); }
+
+export function buildSecurityDashboardHtml({
+  site, risk, sorted, primaryPlatform, platformSignals, hostingSignals, tlsInfo, dnsRecords,
+  libraries, vulnResults, crawlerExposure, paymentProcessors, generatedAt = new Date(),
+}, branding = DEFAULT_BRANDING) {
+  const gradeColor = { 'A+': '#16a34a', A: '#22c55e', B: '#84cc16', C: '#eab308', D: '#f97316', F: '#ef4444' }[risk.grade] || '#94a3b8';
+  const sevColorMap = { critical: '#ef4444', high: '#f97316', medium: '#eab308', low: '#3b82f6', info: '#94a3b8' };
+  const rows = sorted.map((f) => `
+    <tr${f.suppressed ? ' style="opacity:.5"' : ''}>
+      <td><span class="badge" style="background:${sevColorMap[f.severity]}22;color:${sevColorMap[f.severity]}">${esc(f.severity)}</span>${f.suppressed ? ' <span class="badge" style="background:#64748b22;color:#64748b" title="' + esc(f.suppressedReason || '') + '">suppressed</span>' : ''}</td>
+      <td>${esc(f.category)}</td>
+      <td>${esc(f.title)}</td>
+      <td class="detail">${esc(f.detail)}</td>
+      <td class="url">${f.url ? `<a href="${esc(f.url)}" target="_blank" rel="noopener">${esc(f.url)}</a>` : ''}</td>
+    </tr>`).join('');
+  const vulnRows = vulnResults.flatMap((r) => r.vulns.map((v) => `
+    <tr><td>${esc(r.component)}</td><td>${esc(r.source)}</td><td>${esc(v.id || '')}</td><td>${esc(v.title || v.summary || '')}</td></tr>`)).join('');
+  const logoHtml = branding.logo ? `<img src="${esc(branding.logo)}" alt="${esc(branding.companyName)} logo" class="logo">` : '';
+
+  return `<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1"><title>${esc(branding.reportTitle)} — ${esc(site)}</title>
+<style>
+  :root { color-scheme: light dark; --primary: ${branding.primaryColor}; --accent: ${branding.accentColor}; }
+  body { font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif; margin: 0; padding: 2rem; background: #0b0f16; color: #e2e8f0; }
+  .logo { max-height: 44px; max-width: 200px; object-fit: contain; display: block; margin-bottom: .75rem; }
+  .masthead { background: linear-gradient(135deg, var(--primary), #1e293b); padding: 1.5rem 1.75rem; border-radius: 16px; margin-bottom: 1.5rem; box-shadow: 0 10px 30px rgba(0,0,0,.35); }
+  h1 { font-size: 1.5rem; margin: 0 0 .25rem; color: #fff; }
+  .sub { color: #e2e8f0cc; font-size: .85rem; }
+  .grade-card { display: inline-flex; align-items: center; gap: 1rem; background: #131a24; border: 1px solid #1f2937; border-radius: 12px; padding: 1rem 1.5rem; margin-bottom: 1.5rem; }
+  .grade { font-size: 2.5rem; font-weight: 800; color: ${gradeColor}; }
+  .stats { display: flex; gap: 1rem; flex-wrap: wrap; margin-bottom: 1.5rem; }
+  .stat { background: #131a24; border: 1px solid #1f2937; border-radius: 10px; padding: .75rem 1rem; min-width: 110px; }
+  .stat .n { font-size: 1.4rem; font-weight: 700; }
+  .stat .l { font-size: .75rem; color: #94a3b8; text-transform: uppercase; letter-spacing: .05em; }
+  section { margin-bottom: 2rem; }
+  table { width: 100%; border-collapse: collapse; background: #131a24; border: 1px solid #1f2937; border-radius: 10px; overflow: hidden; }
+  th, td { text-align: left; padding: .6rem .8rem; border-bottom: 1px solid #1f2937; font-size: .85rem; vertical-align: top; }
+  th { background: #1a2230; color: #94a3b8; text-transform: uppercase; font-size: .7rem; letter-spacing: .05em; }
+  .badge { padding: .15rem .5rem; border-radius: 999px; font-size: .7rem; font-weight: 700; text-transform: uppercase; }
+  .detail { color: #cbd5e1; max-width: 420px; }
+  .url a { color: var(--accent); word-break: break-all; }
+  .meta-grid { display: grid; grid-template-columns: repeat(auto-fit, minmax(220px,1fr)); gap: 1rem; }
+  .meta-card { background: #131a24; border: 1px solid #1f2937; border-radius: 10px; padding: 1rem; }
+  .meta-card h3 { margin: 0 0 .5rem; font-size: .8rem; color: #94a3b8; text-transform: uppercase; letter-spacing: .05em; }
+  .footer { margin-top: 2rem; color: #64748b; font-size: .75rem; text-align: center; }
+  @media (prefers-color-scheme: light) {
+    body { background: #f8fafc; color: #0f172a; }
+    .grade-card, .stat, table, .meta-card { background: #fff; border-color: #e2e8f0; }
+    th { background: #f1f5f9; }
+    .detail { color: #334155; }
+  }
+  @media print { body { background: #fff; color: #0f172a; } .grade-card, .stat, table, .meta-card { background: #fff; border: 1px solid #cbd5e1; } th { background: #f1f5f9; } .detail { color: #334155; } section { break-inside: avoid-page; } }
+</style></head><body>
+  <div class="masthead">
+    ${logoHtml}
+    <h1>🛡️ ${esc(branding.reportTitle)}</h1>
+    <div class="sub">${esc(site)} · ${esc(branding.companyName)}${branding.author ? ` · Prepared by ${esc(branding.author)}` : ''} · generated ${esc(new Date(generatedAt).toLocaleString())}</div>
+  </div>
+  <div class="grade-card"><div class="grade">${risk.grade}</div><div><div style="font-weight:600">${risk.score}/100 risk score</div><div style="color:#94a3b8;font-size:.85rem">${risk.total} finding(s) across all checks</div></div></div>
+  <div class="stats">
+    <div class="stat"><div class="n" style="color:${sevColorMap.critical}">${risk.counts.critical}</div><div class="l">Critical</div></div>
+    <div class="stat"><div class="n" style="color:${sevColorMap.high}">${risk.counts.high}</div><div class="l">High</div></div>
+    <div class="stat"><div class="n" style="color:${sevColorMap.medium}">${risk.counts.medium}</div><div class="l">Medium</div></div>
+    <div class="stat"><div class="n" style="color:${sevColorMap.low}">${risk.counts.low}</div><div class="l">Low</div></div>
+    <div class="stat"><div class="n" style="color:${sevColorMap.info}">${risk.counts.info}</div><div class="l">Info</div></div>
+  </div>
+  <section>
+    <div class="meta-grid">
+      <div class="meta-card"><h3>Platform</h3>${platformSignals.map((s) => `<div>${esc(s.platform)} <span style="color:#94a3b8">(${esc(s.confidence)})</span></div>`).join('')}</div>
+      <div class="meta-card"><h3>Hosting / CDN</h3>${hostingSignals.length ? hostingSignals.map((h) => `<div>${esc(h.provider)}</div>`).join('') : '<div style="color:#94a3b8">No signals detected</div>'}</div>
+      <div class="meta-card"><h3>TLS</h3>${tlsInfo.ok ? `<div>${esc(tlsInfo.protocol)}</div><div>Expires in ${tlsInfo.daysRemaining}d</div><div>Issuer: ${esc(tlsInfo.issuer)}</div>` : '<div style="color:#94a3b8">Not checked / unavailable</div>'}</div>
+      <div class="meta-card"><h3>DNS</h3><div>A: ${esc((dnsRecords.a || []).join(', ') || '—')}</div><div>NS: ${esc((dnsRecords.ns || []).join(', ') || '—')}</div><div>MX: ${esc((dnsRecords.mx || []).join(', ') || '—')}</div></div>
+      <div class="meta-card"><h3>Crawler exposure</h3><div>robots.txt: ${crawlerExposure.hasRobots ? 'yes' : 'no'}</div><div>llms.txt: ${crawlerExposure.hasLlmsTxt ? 'yes' : 'no'}</div><div>sitemap: ${crawlerExposure.hasSitemap ? 'yes' : 'no'}</div></div>
+      <div class="meta-card"><h3>Payment/donation</h3>${paymentProcessors.length ? paymentProcessors.map((p) => `<div>${esc(p)}</div>`).join('') : '<div style="color:#94a3b8">None detected</div>'}</div>
+    </div>
+  </section>
+  <section>
+    <h2>Findings</h2>
+    <table><thead><tr><th>Severity</th><th>Category</th><th>Title</th><th>Detail</th><th>URL</th></tr></thead><tbody>${rows || '<tr><td colspan="5" style="text-align:center;color:#94a3b8">No findings 🎉</td></tr>'}</tbody></table>
+  </section>
+  ${vulnRows ? `<section><h2>Known Vulnerabilities (OSV.dev / WPScan)</h2><table><thead><tr><th>Component</th><th>Source</th><th>ID</th><th>Title</th></tr></thead><tbody>${vulnRows}</tbody></table></section>` : ''}
+  <section><h3>Detected libraries</h3><table><thead><tr><th>Name</th><th>Version</th><th>Source</th></tr></thead><tbody>${libraries.map((l) => `<tr><td>${esc(l.name)}</td><td>${esc(l.version || 'unknown')}</td><td class="url">${esc(l.sourceUrl)}</td></tr>`).join('') || '<tr><td colspan="3" style="text-align:center;color:#94a3b8">None detected</td></tr>'}</tbody></table></section>
+  <div class="footer">${esc(branding.footerText || '')}</div>
+</body></html>`;
+}

package/scripts/lib/scoring.mjs

@@ -0,0 +1,44 @@
+// ── Aggregate findings into severity buckets + an overall A-F risk grade ──
+
+export const SEVERITY_WEIGHTS = { critical: 25, high: 12, medium: 5, low: 2, info: 0 };
+export const SEVERITY_ORDER = ['critical', 'high', 'medium', 'low', 'info'];
+
+export function tallyBySeverity(findings = []) {
+  const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
+  for (const f of findings) {
+    const sev = SEVERITY_WEIGHTS[f.severity] != null ? f.severity : 'info';
+    counts[sev]++;
+  }
+  return counts;
+}
+
+export function computeRiskGrade(findings = []) {
+  const counts = tallyBySeverity(findings);
+  let score = 100;
+  for (const sev of SEVERITY_ORDER) score -= counts[sev] * SEVERITY_WEIGHTS[sev];
+  score = Math.max(0, Math.min(100, score));
+  const grade = score >= 95 ? 'A+' : score >= 85 ? 'A' : score >= 70 ? 'B' : score >= 55 ? 'C' : score >= 35 ? 'D' : 'F';
+  return { score, grade, counts, total: findings.length };
+}
+
+export function sortFindingsBySeverity(findings = []) {
+  return [...findings].sort((a, b) => SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity));
+}
+
+// ── CI/CD gating helpers ──
+export const GRADE_ORDER = ['F', 'D', 'C', 'B', 'A', 'A+'];
+
+// True if `grade` is strictly worse than `threshold` (e.g. isGradeBelow('C', 'B') === true).
+export function isGradeBelow(grade, threshold) {
+  const g = GRADE_ORDER.indexOf(String(grade || '').toUpperCase());
+  const t = GRADE_ORDER.indexOf(String(threshold || '').toUpperCase());
+  if (g === -1 || t === -1) return false;
+  return g < t;
+}
+
+// True if any finding is at or above `minSeverity` on the critical>high>medium>low>info scale.
+export function hasFindingAtOrAbove(findings = [], minSeverity) {
+  const idx = SEVERITY_ORDER.indexOf(String(minSeverity || '').toLowerCase());
+  if (idx === -1) return false;
+  return findings.some((f) => SEVERITY_ORDER.indexOf(f.severity) <= idx);
+}