@pbpyrojust/universal-security-audit 0.0.0-stage → 0.3.0

package/package.json

@@ -1,6 +1,62 @@
 {
   "name": "@pbpyrojust/universal-security-audit",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.3.0",
+  "type": "module",
+  "packageManager": "pnpm@10.8.0",
+  "description": "Technical security & attack-surface audit CLI: security header grading, CMS/hosting fingerprinting, exposed-path & admin/API discovery, third-party script + CVE lookups (OSV.dev/WPScan), PII & payment-processor detection, and a risk-graded HTML/PDF report.",
+  "scripts": {
+    "security-audit": "node scripts/run-security-audit.mjs",
+    "report": "node scripts/generate-security-report.mjs",
+    "tickets": "node scripts/generate-security-tickets.mjs",
+    "compare": "node scripts/compare-security-runs.mjs",
+    "sarif": "node scripts/generate-security-sarif.mjs",
+    "baseline": "node scripts/generate-baseline.mjs",
+    "batch-audit": "node scripts/run-batch-audit.mjs",
+    "cli": "node bin/universal-security-audit.mjs"
+  },
+  "bin": {
+    "universal-security-audit": "bin/universal-security-audit.mjs",
+    "usaudit": "bin/universal-security-audit.mjs"
+  },
+  "dependencies": {
+    "chrome-launcher": "^1.2.2",
+    "csv-stringify": "^6.9.0",
+    "playwright": "^1.64.1",
+    "undici": "^8.12.3"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "MIT",
+  "author": "Justin Adams (https://justwhat.net)",
+  "homepage": "https://github.com/pbpyrojust/universal-security-audit#readme",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pbpyrojust/universal-security-audit.git"
+  },
+  "bugs": {
+    "url": "https://github.com/pbpyrojust/universal-security-audit/issues"
+  },
+  "keywords": [
+    "security",
+    "pentest",
+    "attack-surface",
+    "vulnerability-scanner",
+    "security-headers",
+    "wordpress",
+    "cve",
+    "osv",
+    "wpscan",
+    "cli",
+    "audit",
+    "playwright",
+    "graphql",
+    "sarif",
+    "drupal",
+    "tls",
+    "port-scan"
+  ],
+  "publishConfig": {
+    "access": "public"
+  }
+}

package/scripts/compare-security-runs.mjs

@@ -0,0 +1,94 @@
+#!/usr/bin/env node
+// Diffs two audit runs' findings-summary.csv + risk grade, mirroring compare-seo-runs.mjs output shape.
+import fs from 'node:fs';
+import path from 'node:path';
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith('--')) continue;
+    const key = a.replace(/^--/, '');
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) args[key] = true;
+    else { args[key] = next; i++; }
+  }
+  return args;
+}
+function parseCsv(csvText) {
+  const rows = [];
+  let row = [], field = '', inQuotes = false;
+  const pushField = () => { row.push(field); field = ''; };
+  const pushRow = () => { if (!(row.length === 1 && row[0] === '')) rows.push(row); row = []; };
+  for (let i = 0; i < csvText.length; i++) {
+    const ch = csvText[i];
+    if (inQuotes) {
+      if (ch === '"') { if (csvText[i + 1] === '"') { field += '"'; i++; } else inQuotes = false; }
+      else field += ch;
+      continue;
+    }
+    if (ch === '"') { inQuotes = true; continue; }
+    if (ch === ',') { pushField(); continue; }
+    if (ch === '\n') { pushField(); pushRow(); continue; }
+    if (ch === '\r') { if (csvText[i + 1] === '\n') i++; pushField(); pushRow(); continue; }
+    field += ch;
+  }
+  pushField(); pushRow();
+  if (!rows.length) return [];
+  const headers = rows[0];
+  return rows.slice(1).map((r) => Object.fromEntries(headers.map((h, idx) => [h, r[idx] ?? ''])));
+}
+function esc(s) { s = String(s ?? ''); return /[",\n]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s; }
+function writeCsv(rows, columns, outPath) {
+  const body = [columns.join(','), ...rows.map((r) => columns.map((c) => esc(r[c])).join(','))].join('\n') + '\n';
+  fs.writeFileSync(outPath, body, 'utf8');
+}
+
+const args = parseArgs(process.argv);
+if (!args.before || !args.after) {
+  console.error('Usage: node scripts/compare-security-runs.mjs --before reports/run-a --after reports/run-b');
+  process.exit(1);
+}
+const beforeDir = path.resolve(process.cwd(), args.before);
+const afterDir = path.resolve(process.cwd(), args.after);
+const outDir = args['out-dir'] ? path.resolve(process.cwd(), args['out-dir']) : afterDir;
+fs.mkdirSync(outDir, { recursive: true });
+
+const beforeFindings = parseCsv(fs.readFileSync(path.join(beforeDir, 'findings-summary.csv'), 'utf8')).filter((f) => f.suppressed !== 'true');
+const afterFindings = parseCsv(fs.readFileSync(path.join(afterDir, 'findings-summary.csv'), 'utf8')).filter((f) => f.suppressed !== 'true');
+const key = (r) => `${r.category}__${r.title}__${r.url}`;
+const beforeMap = new Map(beforeFindings.map((r) => [key(r), r]));
+const afterMap = new Map(afterFindings.map((r) => [key(r), r]));
+const newFindings = afterFindings.filter((r) => !beforeMap.has(key(r)));
+const resolvedFindings = beforeFindings.filter((r) => !afterMap.has(key(r)));
+const unchangedFindings = afterFindings.filter((r) => beforeMap.has(key(r)));
+
+const countsBySeverity = (rows) => rows.reduce((acc, r) => { acc[r.severity] = (acc[r.severity] || 0) + 1; return acc; }, {});
+const beforeSevCounts = countsBySeverity(beforeFindings);
+const afterSevCounts = countsBySeverity(afterFindings);
+const severities = ['critical', 'high', 'medium', 'low', 'info'];
+const severitySummary = severities.map((sev) => ({ severity: sev, before_count: beforeSevCounts[sev] || 0, after_count: afterSevCounts[sev] || 0, delta: (afterSevCounts[sev] || 0) - (beforeSevCounts[sev] || 0) }));
+
+let beforeRisk = null, afterRisk = null;
+try { beforeRisk = JSON.parse(fs.readFileSync(path.join(beforeDir, 'summary.json'), 'utf8')).risk; } catch {}
+try { afterRisk = JSON.parse(fs.readFileSync(path.join(afterDir, 'summary.json'), 'utf8')).risk; } catch {}
+
+writeCsv(severitySummary, ['severity', 'before_count', 'after_count', 'delta'], path.join(outDir, 'security-compare-summary.csv'));
+writeCsv(newFindings, Object.keys(newFindings[0] || { category: '', severity: '', title: '', detail: '', url: '' }), path.join(outDir, 'security-compare-new-findings.csv'));
+writeCsv(resolvedFindings, Object.keys(resolvedFindings[0] || { category: '', severity: '', title: '', detail: '', url: '' }), path.join(outDir, 'security-compare-resolved-findings.csv'));
+
+const md = [
+  '# Security Run Comparison', '',
+  `Before: ${beforeDir}`, `After: ${afterDir}`, '',
+  beforeRisk && afterRisk ? `Risk grade: ${beforeRisk.grade} (${beforeRisk.score}/100) -> ${afterRisk.grade} (${afterRisk.score}/100)` : '', '',
+  `New findings: ${newFindings.length}`, `Resolved findings: ${resolvedFindings.length}`, `Unchanged findings: ${unchangedFindings.length}`, '',
+  '## Severity deltas', ...severitySummary.map((r) => `- ${r.severity}: ${r.before_count} -> ${r.after_count} (${r.delta >= 0 ? '+' : ''}${r.delta})`), '',
+  '## New findings', ...newFindings.slice(0, 30).map((r) => `- [${r.severity}] ${r.category} — ${r.title} — ${r.url}`), '',
+  '## Resolved findings', ...resolvedFindings.slice(0, 30).map((r) => `- [${r.severity}] ${r.category} — ${r.title} — ${r.url}`),
+].filter((l) => l !== undefined);
+fs.writeFileSync(path.join(outDir, 'security-compare-summary.md'), md.join('\n'), 'utf8');
+
+console.log(`Wrote: ${path.join(outDir, 'security-compare-summary.csv')}`);
+console.log(`Wrote: ${path.join(outDir, 'security-compare-new-findings.csv')}`);
+console.log(`Wrote: ${path.join(outDir, 'security-compare-resolved-findings.csv')}`);
+console.log(`Wrote: ${path.join(outDir, 'security-compare-summary.md')}`);

package/scripts/generate-baseline.mjs

@@ -0,0 +1,66 @@
+#!/usr/bin/env node
+// Snapshots every finding in a run into a baseline/exceptions file (accept-all-current), so future
+// runs stop failing on already-known-and-accepted findings. Edit the output afterward to add real
+// `reason` text and/or `expires` dates — this just gives you the starting fingerprints.
+import fs from 'node:fs';
+import path from 'node:path';
+import { fingerprintFinding } from './lib/baseline.mjs';
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith('--')) continue;
+    const key = a.replace(/^--/, '');
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) args[key] = true;
+    else { args[key] = next; i++; }
+  }
+  return args;
+}
+function parseCsv(csvText) {
+  const rows = [];
+  let row = [], field = '', inQuotes = false;
+  const pushField = () => { row.push(field); field = ''; };
+  const pushRow = () => { if (!(row.length === 1 && row[0] === '')) rows.push(row); row = []; };
+  for (let i = 0; i < csvText.length; i++) {
+    const ch = csvText[i];
+    if (inQuotes) {
+      if (ch === '"') { if (csvText[i + 1] === '"') { field += '"'; i++; } else inQuotes = false; }
+      else field += ch;
+      continue;
+    }
+    if (ch === '"') { inQuotes = true; continue; }
+    if (ch === ',') { pushField(); continue; }
+    if (ch === '\n') { pushField(); pushRow(); continue; }
+    if (ch === '\r') { if (csvText[i + 1] === '\n') i++; pushField(); pushRow(); continue; }
+    field += ch;
+  }
+  pushField(); pushRow();
+  if (!rows.length) return [];
+  const headers = rows[0];
+  return rows.slice(1).map((r) => Object.fromEntries(headers.map((h, idx) => [h, r[idx] ?? ''])));
+}
+
+const args = parseArgs(process.argv);
+if (!args['run-dir']) { console.error('Missing --run-dir'); process.exit(1); }
+const runDir = path.resolve(process.cwd(), args['run-dir']);
+const findings = parseCsv(fs.readFileSync(path.join(runDir, 'findings-summary.csv'), 'utf8'));
+
+let existing = { accepted: [] };
+const outPath = args.out ? path.resolve(process.cwd(), args.out) : path.resolve(process.cwd(), 'security-baseline.json');
+if (fs.existsSync(outPath) && !args.overwrite) {
+  try { existing = JSON.parse(fs.readFileSync(outPath, 'utf8')); } catch {}
+}
+const existingFingerprints = new Set((existing.accepted || []).map((e) => e.fingerprint));
+
+const newEntries = [];
+for (const f of findings) {
+  const fingerprint = fingerprintFinding(f);
+  if (existingFingerprints.has(fingerprint)) continue;
+  newEntries.push({ fingerprint, category: f.category, title: f.title, url: f.url, reason: args.reason || 'Accepted at baseline snapshot time', expires: args.expires || null });
+}
+
+const merged = { accepted: [...(args.overwrite ? [] : existing.accepted || []), ...newEntries] };
+fs.writeFileSync(outPath, JSON.stringify(merged, null, 2), 'utf8');
+console.log(`Wrote: ${outPath} (${newEntries.length} new exception(s), ${merged.accepted.length} total)`);

package/scripts/generate-security-report.mjs

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+// Standalone report regenerator — rebuilds security-dashboard.html/.pdf from an existing run's
+// summary.json + CSVs without re-scanning the site. Useful for re-branding a past run or fixing
+// a report after a dashboard template change. Mirrors universal-seo-audit's
+// generate-visual-report.mjs --run-dir convention.
+import fs from 'node:fs';
+import path from 'node:path';
+import { chromium } from 'playwright';
+import { loadBranding, buildSecurityDashboardHtml } from './lib/report-builder.mjs';
+import { sortFindingsBySeverity, computeRiskGrade } from './lib/scoring.mjs';
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith('--')) continue;
+    const key = a.replace(/^--/, '');
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) args[key] = true;
+    else { args[key] = next; i++; }
+  }
+  return args;
+}
+function parseCsv(csvText) {
+  const rows = [];
+  let row = [], field = '', inQuotes = false;
+  const pushField = () => { row.push(field); field = ''; };
+  const pushRow = () => { if (!(row.length === 1 && row[0] === '')) rows.push(row); row = []; };
+  for (let i = 0; i < csvText.length; i++) {
+    const ch = csvText[i];
+    if (inQuotes) {
+      if (ch === '"') { if (csvText[i + 1] === '"') { field += '"'; i++; } else inQuotes = false; }
+      else field += ch;
+      continue;
+    }
+    if (ch === '"') { inQuotes = true; continue; }
+    if (ch === ',') { pushField(); continue; }
+    if (ch === '\n') { pushField(); pushRow(); continue; }
+    if (ch === '\r') { if (csvText[i + 1] === '\n') i++; pushField(); pushRow(); continue; }
+    field += ch;
+  }
+  pushField(); pushRow();
+  if (!rows.length) return [];
+  const headers = rows[0];
+  return rows.slice(1).map((r) => Object.fromEntries(headers.map((h, idx) => [h, r[idx] ?? ''])));
+}
+function readCsvIfExists(filePath) {
+  try { return parseCsv(fs.readFileSync(filePath, 'utf8')); } catch { return []; }
+}
+
+const args = parseArgs(process.argv);
+if (!args['run-dir']) { console.error('Missing --run-dir'); process.exit(1); }
+const runDir = path.resolve(process.cwd(), args['run-dir']);
+
+const summary = JSON.parse(fs.readFileSync(path.join(runDir, 'summary.json'), 'utf8'));
+const findingsRows = readCsvIfExists(path.join(runDir, 'findings-summary.csv'));
+const libraries = readCsvIfExists(path.join(runDir, 'script-inventory.csv'));
+const vulnRows = readCsvIfExists(path.join(runDir, 'vulnerabilities.csv'));
+
+const vulnByComponent = new Map();
+for (const v of vulnRows) {
+  const key = `${v.component}__${v.source}`;
+  if (!vulnByComponent.has(key)) vulnByComponent.set(key, { component: v.component, source: v.source, vulns: [] });
+  vulnByComponent.get(key).vulns.push({ id: v.id, title: v.title });
+}
+
+const sorted = sortFindingsBySeverity(findingsRows.map((f) => ({ ...f, suppressed: f.suppressed === 'true' })));
+const risk = summary.risk || computeRiskGrade(findingsRows.filter((f) => f.suppressed !== 'true'));
+
+const branding = loadBranding(fs, path, args['brand-config']);
+const site = args.site || summary.site;
+
+const html = buildSecurityDashboardHtml({
+  site,
+  risk,
+  sorted,
+  primaryPlatform: summary.primaryPlatform,
+  platformSignals: summary.platformSignals || [{ platform: summary.primaryPlatform, confidence: 'n/a' }],
+  hostingSignals: summary.hostingSignals || [],
+  tlsInfo: summary.tls || { ok: false },
+  dnsRecords: summary.dnsRecords || {},
+  libraries,
+  vulnResults: [...vulnByComponent.values()],
+  crawlerExposure: summary.crawlerExposure || {},
+  paymentProcessors: summary.paymentProcessors || [],
+  generatedAt: summary.generatedAt,
+}, branding);
+
+const htmlPath = path.join(runDir, 'security-dashboard.html');
+fs.writeFileSync(htmlPath, html, 'utf8');
+console.log(`Wrote: ${htmlPath}`);
+
+const browser = await chromium.launch({ headless: true });
+const page = await browser.newPage();
+await page.goto('file://' + htmlPath);
+const pdfPath = path.join(runDir, 'security-dashboard.pdf');
+await page.pdf({ path: pdfPath, format: 'A4', printBackground: true, margin: { top: '20px', bottom: '20px', left: '20px', right: '20px' } });
+await browser.close();
+console.log(`Wrote: ${pdfPath}`);

package/scripts/generate-security-sarif.mjs

@@ -0,0 +1,93 @@
+#!/usr/bin/env node
+// Converts a run's findings-summary.csv into SARIF 2.1.0 for GitHub code scanning (Security tab).
+// Locations use the finding's URL as the artifact URI — the same convention tools like OWASP ZAP's
+// SARIF exporter use for web-security findings that aren't tied to a file in the repo.
+import fs from 'node:fs';
+import path from 'node:path';
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith('--')) continue;
+    const key = a.replace(/^--/, '');
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) args[key] = true;
+    else { args[key] = next; i++; }
+  }
+  return args;
+}
+function parseCsv(csvText) {
+  const rows = [];
+  let row = [], field = '', inQuotes = false;
+  const pushField = () => { row.push(field); field = ''; };
+  const pushRow = () => { if (!(row.length === 1 && row[0] === '')) rows.push(row); row = []; };
+  for (let i = 0; i < csvText.length; i++) {
+    const ch = csvText[i];
+    if (inQuotes) {
+      if (ch === '"') { if (csvText[i + 1] === '"') { field += '"'; i++; } else inQuotes = false; }
+      else field += ch;
+      continue;
+    }
+    if (ch === '"') { inQuotes = true; continue; }
+    if (ch === ',') { pushField(); continue; }
+    if (ch === '\n') { pushField(); pushRow(); continue; }
+    if (ch === '\r') { if (csvText[i + 1] === '\n') i++; pushField(); pushRow(); continue; }
+    field += ch;
+  }
+  pushField(); pushRow();
+  if (!rows.length) return [];
+  const headers = rows[0];
+  return rows.slice(1).map((r) => Object.fromEntries(headers.map((h, idx) => [h, r[idx] ?? ''])));
+}
+function slugify(s) { return String(s || '').toLowerCase().replace(/[^a-z0-9]+/g, '-').replace(/^-+|-+$/g, '').slice(0, 80); }
+
+const SARIF_LEVEL = { critical: 'error', high: 'error', medium: 'warning', low: 'note', info: 'note' };
+const SECURITY_SEVERITY = { critical: '9.0', high: '7.0', medium: '5.0', low: '3.0', info: '1.0' };
+
+const args = parseArgs(process.argv);
+if (!args['run-dir']) { console.error('Missing --run-dir'); process.exit(1); }
+const runDir = path.resolve(process.cwd(), args['run-dir']);
+const findings = parseCsv(fs.readFileSync(path.join(runDir, 'findings-summary.csv'), 'utf8')).filter((f) => f.suppressed !== 'true');
+
+const rulesById = new Map();
+const results = [];
+for (const f of findings) {
+  const ruleId = `${slugify(f.category)}--${slugify(f.title)}`;
+  if (!rulesById.has(ruleId)) {
+    rulesById.set(ruleId, {
+      id: ruleId,
+      name: f.title,
+      shortDescription: { text: f.title },
+      fullDescription: { text: f.detail || f.title },
+      properties: { 'security-severity': SECURITY_SEVERITY[f.severity] || '1.0', tags: ['security', f.category] },
+    });
+  }
+  const uri = f.url || 'about:blank';
+  results.push({
+    ruleId,
+    level: SARIF_LEVEL[f.severity] || 'note',
+    message: { text: f.detail || f.title },
+    locations: [{ physicalLocation: { artifactLocation: { uri } } }],
+  });
+}
+
+const sarif = {
+  $schema: 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/master/Schemata/sarif-schema-2.1.0.json',
+  version: '2.1.0',
+  runs: [{
+    tool: {
+      driver: {
+        name: 'universal-security-audit',
+        informationUri: 'https://github.com/pbpyrojust/universal-security-audit',
+        version: '0.1.0',
+        rules: [...rulesById.values()],
+      },
+    },
+    results,
+  }],
+};
+
+const outPath = args.out ? path.resolve(process.cwd(), args.out) : path.join(runDir, 'security-findings.sarif');
+fs.writeFileSync(outPath, JSON.stringify(sarif, null, 2), 'utf8');
+console.log(`Wrote: ${outPath} (${results.length} result(s), ${rulesById.size} rule(s))`);

package/scripts/generate-security-tickets.mjs

@@ -0,0 +1,126 @@
+#!/usr/bin/env node
+// Turns findings-summary.csv into a ticket-ready backlog CSV, mirroring universal-seo-audit's
+// generate-seo-tickets.mjs conventions (global vs. per-URL grouping, ticket_title/description/labels).
+import fs from 'node:fs';
+import path from 'node:path';
+
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 2; i < argv.length; i++) {
+    const a = argv[i];
+    if (!a.startsWith('--')) continue;
+    const key = a.replace(/^--/, '');
+    const next = argv[i + 1];
+    if (!next || next.startsWith('--')) args[key] = true;
+    else { args[key] = next; i++; }
+  }
+  return args;
+}
+function parseCsv(csvText) {
+  const rows = [];
+  let row = [], field = '', inQuotes = false;
+  const pushField = () => { row.push(field); field = ''; };
+  const pushRow = () => { if (!(row.length === 1 && row[0] === '')) rows.push(row); row = []; };
+  for (let i = 0; i < csvText.length; i++) {
+    const ch = csvText[i];
+    if (inQuotes) {
+      if (ch === '"') { if (csvText[i + 1] === '"') { field += '"'; i++; } else inQuotes = false; }
+      else field += ch;
+      continue;
+    }
+    if (ch === '"') { inQuotes = true; continue; }
+    if (ch === ',') { pushField(); continue; }
+    if (ch === '\n') { pushField(); pushRow(); continue; }
+    if (ch === '\r') { if (csvText[i + 1] === '\n') i++; pushField(); pushRow(); continue; }
+    field += ch;
+  }
+  pushField(); pushRow();
+  if (!rows.length) return [];
+  const headers = rows[0];
+  return rows.slice(1).map((r) => Object.fromEntries(headers.map((h, idx) => [h, r[idx] ?? ''])));
+}
+function esc(s) { s = String(s ?? ''); return /[",\n\r]/.test(s) ? '"' + s.replace(/"/g, '""') + '"' : s; }
+function writeCsv(rows, columns, outPath) {
+  const body = [columns.join(','), ...rows.map((r) => columns.map((c) => esc(r[c])).join(','))].join('\n') + '\n';
+  fs.writeFileSync(outPath, body, 'utf8');
+}
+
+// Categories whose findings apply to the whole site (one root cause, dedupe across pages) vs.
+// categories that are inherently per-page/per-URL and should stay as separate tickets.
+const GLOBAL_CATEGORIES = new Set([
+  'headers', 'cookies', 'tls', 'cors', 'crawler-exposure', 'subdomain-takeover',
+  'http-methods', 'open-redirect', 'source-map', 'email-auth', 'user-enum',
+  'verbose-errors', 'cve', 'admin-login', 'exposed-path', 'exposed-api', 'payment',
+]);
+const SEVERITY_PRIORITY = { critical: 'P0', high: 'P1', medium: 'P2', low: 'P3', info: 'P4' };
+
+const args = parseArgs(process.argv);
+const runDir = args['run-dir'];
+if (!runDir) { console.error('ERROR: Missing --run-dir'); process.exit(1); }
+const findings = parseCsv(fs.readFileSync(path.join(runDir, 'findings-summary.csv'), 'utf8')).filter((f) => f.suppressed !== 'true');
+
+const globals = new Map();
+const perUrl = [];
+for (const f of findings) {
+  if (GLOBAL_CATEGORIES.has(f.category)) {
+    const key = `${f.category}__${f.title}__${f.severity}`;
+    const item = globals.get(key) || { ...f, urls: new Set(), occurrences: 0 };
+    item.urls.add(f.url);
+    item.occurrences += 1;
+    globals.set(key, item);
+  } else {
+    perUrl.push(f);
+  }
+}
+
+const rows = [];
+for (const item of globals.values()) {
+  const exampleUrls = [...item.urls].slice(0, 5).join(' | ');
+  const priority = SEVERITY_PRIORITY[item.severity] || 'P4';
+  rows.push({
+    ticket_type: 'Global',
+    category: item.category,
+    severity: item.severity,
+    priority,
+    pages_affected: item.urls.size,
+    occurrences: item.occurrences,
+    example_urls: exampleUrls,
+    ticket_title: `[SEC][${priority}] ${item.title}`,
+    ticket_description: [
+      `Category: ${item.category}`,
+      `Severity: ${item.severity}`,
+      `Detail: ${item.detail}`,
+      `URLs affected: ${item.urls.size}`,
+      `Occurrences: ${item.occurrences}`,
+      `Example URL(s): ${exampleUrls}`,
+      '',
+      'Recommended action: fix at the shared/infra level (server config, template, or plugin) rather than per-page, then re-run the audit to confirm resolution.',
+    ].join('\n'),
+    ticket_labels: `security, ${item.category}, priority:${priority.toLowerCase()}, global`,
+  });
+}
+for (const f of perUrl) {
+  const priority = SEVERITY_PRIORITY[f.severity] || 'P4';
+  rows.push({
+    ticket_type: 'Page',
+    category: f.category,
+    severity: f.severity,
+    priority,
+    pages_affected: 1,
+    occurrences: 1,
+    example_urls: f.url,
+    ticket_title: `[SEC][${priority}] ${f.title} — ${f.url}`,
+    ticket_description: [
+      `Category: ${f.category}`,
+      `Severity: ${f.severity}`,
+      `Detail: ${f.detail}`,
+      `URL: ${f.url}`,
+    ].join('\n'),
+    ticket_labels: `security, ${f.category}, priority:${priority.toLowerCase()}, page`,
+  });
+}
+
+rows.sort((a, b) => a.priority.localeCompare(b.priority));
+const outPath = path.join(runDir, 'security-ticket-backlog.csv');
+writeCsv(rows, ['ticket_type', 'category', 'severity', 'priority', 'pages_affected', 'occurrences', 'example_urls', 'ticket_title', 'ticket_description', 'ticket_labels'], outPath);
+console.log(`Wrote: ${outPath} (${rows.length} ticket${rows.length === 1 ? '' : 's'})`);

package/scripts/lib/authorization.mjs

@@ -0,0 +1,54 @@
+// ── Permission for the active (pentest-style) checks ──
+// Passive checks only read what any visitor gets: the pages, response headers, TLS, DNS/WHOIS,
+// the files and libraries the pages load, and public vulnerability databases. The active checks
+// request what a visitor wouldn't (exposed config/backup paths, admin and login pages, GraphQL
+// introspection, open-redirect and HTTP-method probes, WordPress user enumeration, error
+// disclosure, subdomain liveness, a TCP port scan) or log in with credentials you supply. Those
+// need the site owner's written permission, so they only run once it's confirmed, and the
+// confirmation is written into the run's report.
+import os from 'node:os';
+import readline from 'node:readline/promises';
+
+/** Bump the version whenever the wording changes; each report keeps the exact text confirmed. */
+export const AUTHORIZATION_STATEMENT_VERSION = '2026-10-31';
+export const AUTHORIZATION_STATEMENT =
+  'I own this site, or I have the site owner\'s written permission to security-test it, including requests a normal visitor wouldn\'t make (admin, login and configuration paths, port and subdomain checks, redirect and method probes). I am responsible for having that permission. The tool and its authors accept no liability for how it is used.';
+
+export const ACTIVE_CHECKS = [
+  'exposed paths, admin/login pages and GraphQL introspection',
+  'subdomain liveness',
+  'TCP port scan',
+  'recon probes (open redirect, HTTP methods, WordPress user enumeration, error disclosure)',
+  'authenticated WordPress/Drupal admin audit',
+];
+
+/**
+ * Resolves whether the active checks may run. `--authorized` (or `--i-have-permission`) confirms
+ * up front, for scripts and CI. Otherwise an interactive terminal is asked to type "yes"; anything
+ * else, or no terminal (CI, --json, batch-audit children), means passive checks only.
+ */
+export async function resolveAuthorization(args, site, { interactive = process.stdin.isTTY && process.stdout.isTTY } = {}) {
+  const record = (how) => ({
+    confirmed: true,
+    how,
+    site,
+    statement: AUTHORIZATION_STATEMENT,
+    statementVersion: AUTHORIZATION_STATEMENT_VERSION,
+    at: new Date().toISOString(),
+    user: safeUser(),
+  });
+  if (args['authorized'] || args['i-have-permission']) return record('flag');
+  if (!interactive || args['json']) return null;
+  const rl = readline.createInterface({ input: process.stdin, output: process.stderr });
+  try {
+    process.stderr.write(`\n  Active checks on ${site} need the site owner's written permission:\n  "${AUTHORIZATION_STATEMENT}"\n`);
+    const answer = (await rl.question('  Type "yes" to confirm and run them, or press Enter for passive checks only: ')).trim().toLowerCase();
+    return answer === 'yes' ? record('prompt') : null;
+  } finally {
+    rl.close();
+  }
+}
+
+function safeUser() {
+  try { return os.userInfo().username; } catch { return null; }
+}

package/scripts/lib/baseline.mjs

@@ -0,0 +1,37 @@
+// ── Baseline/exceptions: known-accepted findings (by a stable fingerprint of category+title+url)
+// are suppressed from risk scoring and CI gating on future runs, but stay visible in the report
+// marked as "suppressed" rather than silently vanishing. Same idea as .trivyignore / gitleaks
+// baselines — accept a risk once with a reason, stop it from re-failing every run. ──
+import crypto from 'node:crypto';
+
+export function fingerprintFinding(f) {
+  const key = `${f.category}|${f.title}|${f.url}`;
+  return crypto.createHash('sha256').update(key).digest('hex').slice(0, 16);
+}
+
+export function loadBaseline(fs, path, baselinePath) {
+  if (!baselinePath) return { entries: [], accepted: new Map() };
+  let data;
+  try {
+    data = JSON.parse(fs.readFileSync(path.resolve(process.cwd(), baselinePath), 'utf8'));
+  } catch (e) {
+    throw new Error(`Could not read --baseline file: ${String(e?.message || e)}`);
+  }
+  const now = Date.now();
+  const accepted = new Map();
+  for (const entry of data.accepted || []) {
+    if (entry.expires && new Date(entry.expires).getTime() < now) continue; // expired exceptions stop applying
+    accepted.set(entry.fingerprint, entry);
+  }
+  return { entries: data.accepted || [], accepted };
+}
+
+// Returns every finding with `suppressed` + `suppressedReason` set, so callers can filter for
+// scoring/CI purposes while still writing the full (marked) set to CSV/JSON/dashboard.
+export function applyBaseline(findings, baseline) {
+  return findings.map((f) => {
+    const fp = fingerprintFinding(f);
+    const entry = baseline.accepted.get(fp);
+    return { ...f, fingerprint: fp, suppressed: !!entry, suppressedReason: entry?.reason || null };
+  });
+}