ikanban 0.4.0 → 0.4.1

package/README.md

@@ -35,6 +35,24 @@ the site's responses and does not attack. It scans only a URL the team registere
 Infrastructure, so it always needs `--team` and a key. Findings show on the Infrastructure tab. A
 missing Trivy or Docker is reported as SKIPPED with the install command, never as a pass.
 
+`infrascan` starts with an inventory of each `--path` (repeat it when infrastructure lives in
+another folder or repository): what it found, what Trivy scanned, and what it could not scan and
+why. Trivy reads Dockerfile/Containerfile, Kubernetes, Helm, Terraform, CloudFormation and Azure
+ARM files. Images named in docker-compose files are scanned too (`--no-compose-images` to skip).
+Infrastructure written as code (AWS CDK, Pulumi, CDK for Terraform, Vagrant, Ansible, cloud-SDK
+scripts) is listed as found but not scannable, with the next step (for CDK: `npx cdk synth`, then
+rescan). A path with no infrastructure-as-code file is never a pass: its control stays Missing.
+Container images file critical and high findings (all severities stay in the report); a section
+over 500 findings files the 500 worst and counts as incomplete. Trivy runs from the scan folder with
+its own config and ignore file, so a repository's `trivy.yaml` or `.trivyignore` changes nothing, and
+only valid image names from compose files are scanned.
+
+## Scan files
+
+Every scanner keeps its raw tool output and its report in `.iKanban/scans/<scanner>-<time>/` in
+the repository (`--work-dir PATH` or `IKANBAN_SCAN_DIR` to put it elsewhere). The folder holds its
+own `.gitignore`, so nothing in it is committed. Delete old runs whenever you like.
+
 ## Pipelines
 
 Every scanner takes `--task IKA-123` (or `IKANBAN_TASK`) and `--task-team` (default `--team`). The

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ikanban",
-  "version": "0.4.0",
+  "version": "0.4.1",
   "description": "iKanban CLI: AI and security scans of your own repo, with results filed into iKanban",
   "bin": { "ikanban": "bin/ikanban.js" },
   "files": ["bin", "lib", "hooks", "scanners", "README.md", "LICENSE.md"],

package/scanners/ikanban-aiscan.py

@@ -57,7 +57,7 @@ PROMPTFOO_VERSION = "0.123.1"
 # so this string is the release identity. Bump it when publishing a release —
 # a customer pinning a version is pinning this value, and re-uploading different
 # bytes under a version someone already fetched defeats the sha256 they pinned.
-AISCAN_VERSION = "0.4.0"
+AISCAN_VERSION = "0.5.0"
 
 # The ten categories, their labels, and their plugins -- the forward map, copied
 # from promptfoo's OWASP_LLM_TOP_10_MAPPING (src/redteam/constants/frameworks.ts).
@@ -386,14 +386,41 @@ def run_promptfoo(args, cwd, allow_remote):
 EVAL_FAILED_TESTS_EXIT = 100
 
 
+SECRET_KEY = re.compile(r"token|authorization|api.?key|secret|password|bearer", re.I)
+
+
+def config_secrets(node) -> set:
+    """Every credential-looking value in a promptfoo config (header, auth token, key)."""
+    out = set()
+    if isinstance(node, dict):
+        for k, v in node.items():
+            if isinstance(v, str) and SECRET_KEY.search(str(k)) and len(v) >= 8:
+                out |= {v, v.removeprefix("Bearer ").strip()}
+            out |= config_secrets(v)
+    elif isinstance(node, list):
+        for v in node:
+            out |= config_secrets(v)
+    return {x for x in out if len(x) >= 8}
+
+
 def scan_category(label, target, cfg, workdir, allow_remote):
-    """generate + eval one category. Returns (findings, plugins_that_ran, errors)."""
-    cfg_path = workdir / "config.yaml"
-    cases_path = workdir / "cases.yaml"
-    out_path = workdir / "results.json"
-    for p in (cases_path, out_path):
-        if p.exists():
-            p.unlink()
+    """generate + eval one category. Returns (findings, plugins_that_ran, errors).
+
+    Plan 11 H12-T10 review: promptfoo's config and cases hold the iKanban token, so they live
+    in a private folder (0700, deleted after the category) that is also promptfoo's working
+    folder, away from the repository and its .npmrc. Only the results, with every credential
+    replaced, are copied into the scan's work folder."""
+    private = Path(tempfile.mkdtemp(prefix="ikanban-aiscan-"))  # mkdtemp creates it 0700
+    try:
+        return _scan_category(label, target, cfg, workdir, allow_remote, private)
+    finally:
+        shutil.rmtree(private, ignore_errors=True)
+
+
+def _scan_category(label, target, cfg, workdir, allow_remote, private):
+    cfg_path = private / "config.yaml"
+    cases_path = private / "cases.yaml"
+    out_path = private / "results.json"
 
     # promptfoo reads YAML, but its config loader accepts JSON in a .yaml file
     # (YAML 1.2 is a JSON superset) -- which keeps this file free of a YAML
@@ -401,7 +428,7 @@ def scan_category(label, target, cfg, workdir, allow_remote):
     cfg_path.write_text(json.dumps(cfg, indent=2), encoding="utf-8")
 
     if not run_promptfoo(
-        ["redteam", "generate", "-c", str(cfg_path), "-o", str(cases_path)], workdir, allow_remote
+        ["redteam", "generate", "-c", str(cfg_path), "-o", str(cases_path)], private, allow_remote
     ):
         return None
     if not cases_path.exists():
@@ -411,13 +438,18 @@ def scan_category(label, target, cfg, workdir, allow_remote):
     # tests failed, i.e. attacks got through, i.e. exactly the findings we came
     # for. The results file decides, not the exit code.
     run_promptfoo(
-        ["redteam", "eval", "-c", str(cases_path), "-o", str(out_path), "--no-cache"], workdir, allow_remote
+        ["redteam", "eval", "-c", str(cases_path), "-o", str(out_path), "--no-cache"], private, allow_remote
     )
     if not out_path.exists():
         log("  promptfoo wrote no results file — the run genuinely failed")
         return None
 
-    doc = json.loads(out_path.read_text(encoding="utf-8"))
+    raw = out_path.read_text(encoding="utf-8")
+    redacted = raw
+    for secret in sorted(config_secrets(cfg), key=len, reverse=True):
+        redacted = redacted.replace(secret, "[hidden]")
+    write_private(workdir / f"results-{re.sub(r'[^A-Za-z0-9_-]+', '_', label)}.json", redacted)
+    doc = json.loads(raw)
     rows = doc.get("results", {}).get("results", [])
     # Coverage is whatever actually produced test rows. A plugin that needed the
     # hosted generator contributes none, and is named in the report rather than
@@ -669,6 +701,41 @@ def publish(findings, run_id, base_url, token, team_id, coverage, plugin_results
         return False, 0, 0
 
 
+# ── Scan work folder (plan 11 H12-T10, owner): raw tool output and the report live under
+# <repo>/.iKanban/scans/<scanner>-<UTC time>/, never the system temp folder. The scans folder
+# holds its own .gitignore ("*"), so nothing in it is committed and no repo .gitignore is edited.
+def add_work_dir_arg(ap):
+    ap.add_argument("--work-dir", default=os.environ.get("IKANBAN_SCAN_DIR", ""),
+                    help="Folder for this scan's files (or IKANBAN_SCAN_DIR; default "
+                         "<repository>/.iKanban/scans)")
+
+
+def scan_work_dir(scanner: str, base: Path, override: str = "") -> Path:
+    scans = Path(override).expanduser().resolve() if override else base / ".iKanban" / "scans"
+    scans.mkdir(parents=True, exist_ok=True)
+    ignore = scans / ".gitignore"
+    if not ignore.exists():
+        ignore.write_text("*\n")
+    run_dir = scans / f"{scanner}-{datetime.now(timezone.utc):%Y%m%d-%H%M%S}"
+    run_dir.mkdir(mode=0o700, exist_ok=True)
+    os.chmod(run_dir, 0o700)  # mkdir's mode is masked by umask; raw tool output stays private
+    return run_dir
+
+
+def write_private(path: Path, text: str) -> None:
+    """Write a file (0600) without following a symlink planted at its name: write a new
+    temp file next to it (O_EXCL | O_NOFOLLOW), then rename it over the name."""
+    tmp = path.with_name(f".{path.name}.{os.getpid()}.tmp")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0), 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        f.write(text)
+    os.replace(tmp, path)
+
+
+def slug(text: str) -> str:
+    return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_")[:80] or "x"
+
+
 # ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
 # Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
 # "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
@@ -828,6 +895,7 @@ def main(argv=None):
                          "directory. Off by default so a mistyped path cannot overwrite "
                          "something elsewhere; turn it on for CI writing to an artifacts dir.")
     add_pipeline_args(ap)
+    add_work_dir_arg(ap)
     args = ap.parse_args(argv)
 
     # Resolve every caller-supplied path up front, before any scanning happens.
@@ -837,6 +905,9 @@ def main(argv=None):
         args.html = safe_path(args.html, "--html", args.allow_outside_cwd)
     if args.out:
         args.out = safe_path(args.out, "--out", args.allow_outside_cwd)
+    # Plan 11 H12-T10: the scan's own folder follows the same rule as every other path.
+    if args.work_dir:
+        args.work_dir = str(safe_path(args.work_dir, "--work-dir", args.allow_outside_cwd))
 
     if args.config:
         args.config = safe_path(args.config, "--config", args.allow_outside_cwd)
@@ -910,66 +981,65 @@ def main(argv=None):
     # than leaving 'no findings' to mean three different things.
     per_category = []
 
-    with tempfile.TemporaryDirectory(prefix="ikanban-aiscan-") as tmp:
-        workdir = Path(tmp)
-        for _collection, label, plugins in selected:
-            if not plugins:
-                # LLM03. promptfoo ships no supply-chain plugins at all, so this
-                # row can never be earned. Reporting "0 findings" would read as a
-                # pass, which is the one thing it must not do.
-                skipped.append(label)
-                per_category.append({"category": label, "asked": 0, "ran": 0, "skipped": []})
-                log(f"{label}: SKIPPED — promptfoo ships no plugins for this category")
-                continue
-            log(f"{label}: generating and running {args.num_tests} tests per plugin…")
-            cfg = build_config(args.target, spec, plugins, args.num_tests,
-                               args.base_url, args.token, args.workspace_id)
-            got = scan_category(label, args.target, cfg, workdir, args.allow_remote_generation)
-            if got is None:
-                failed.append(label)
-                per_category.append(
-                    {"category": label, "asked": len(plugins), "ran": 0, "skipped": sorted(plugins)}
-                )
-                continue
-            category_findings, ran, cat_errors, tally = got
-            total_errors += cat_errors
-            plugins_ran |= ran
-            # IKA-1786: one row per plugin per category. A plugin can appear in
-            # two categories (pii:* spans LLM02 and LLM08), and those are
-            # separate measurements -- 'prompt-extraction under LLM07' is the
-            # thing a weakest-areas ranking is about, not the plugin in general.
-            for plugin, t in sorted(tally.items()):
-                plugin_results.append(
-                    {
-                        "plugin_id": plugin,
-                        "llm_category": label,
-                        "target": args.target,
-                        "severity": t["severity"],
-                        "attempted": t["attempted"],
-                        "failed": t["failed"],
-                        "errored": t["errored"],
-                    }
-                )
-            missing = sorted(set(plugins) - ran)
-            plugins_skipped |= set(missing)
+    workdir = scan_work_dir("aiscan", Path.cwd(), args.work_dir)
+    for _collection, label, plugins in selected:
+        if not plugins:
+            # LLM03. promptfoo ships no supply-chain plugins at all, so this
+            # row can never be earned. Reporting "0 findings" would read as a
+            # pass, which is the one thing it must not do.
+            skipped.append(label)
+            per_category.append({"category": label, "asked": 0, "ran": 0, "skipped": []})
+            log(f"{label}: SKIPPED — promptfoo ships no plugins for this category")
+            continue
+        log(f"{label}: generating and running {args.num_tests} tests per plugin…")
+        cfg = build_config(args.target, spec, plugins, args.num_tests,
+                           args.base_url, args.token, args.workspace_id)
+        got = scan_category(label, args.target, cfg, workdir, args.allow_remote_generation)
+        if got is None:
+            failed.append(label)
             per_category.append(
+                {"category": label, "asked": len(plugins), "ran": 0, "skipped": sorted(plugins)}
+            )
+            continue
+        category_findings, ran, cat_errors, tally = got
+        total_errors += cat_errors
+        plugins_ran |= ran
+        # IKA-1786: one row per plugin per category. A plugin can appear in
+        # two categories (pii:* spans LLM02 and LLM08), and those are
+        # separate measurements -- 'prompt-extraction under LLM07' is the
+        # thing a weakest-areas ranking is about, not the plugin in general.
+        for plugin, t in sorted(tally.items()):
+            plugin_results.append(
                 {
-                    "category": label,
-                    "asked": len(plugins),
-                    "ran": len(set(plugins) & ran),
-                    "skipped": missing,
+                    "plugin_id": plugin,
+                    "llm_category": label,
+                    "target": args.target,
+                    "severity": t["severity"],
+                    "attempted": t["attempted"],
+                    "failed": t["failed"],
+                    "errored": t["errored"],
                 }
             )
-            if missing:
-                uncovered.append((label, missing))
-                log(f"  did not run: {', '.join(missing)}")
-            if not ran:
-                log("  NOTHING RAN — every plugin here needs promptfoo's hosted generator")
-            else:
-                scanned += 1
-            log(f"  {len(category_findings)} finding(s)"
-                + (f", {cat_errors} error(s)" if cat_errors else ""))
-            findings.extend(category_findings)
+        missing = sorted(set(plugins) - ran)
+        plugins_skipped |= set(missing)
+        per_category.append(
+            {
+                "category": label,
+                "asked": len(plugins),
+                "ran": len(set(plugins) & ran),
+                "skipped": missing,
+            }
+        )
+        if missing:
+            uncovered.append((label, missing))
+            log(f"  did not run: {', '.join(missing)}")
+        if not ran:
+            log("  NOTHING RAN — every plugin here needs promptfoo's hosted generator")
+        else:
+            scanned += 1
+        log(f"  {len(category_findings)} finding(s)"
+            + (f", {cat_errors} error(s)" if cat_errors else ""))
+        findings.extend(category_findings)
 
     log("")
     # Errors get their own number. A run where many tests errored is not a clean
@@ -995,6 +1065,8 @@ def main(argv=None):
         detail=summary_detail(counts, len(findings), []) + (f"; {len(failed)} categories did not run" if failed else ""),
         skipped=scanned == 0 and not findings,
     )
+    write_private(workdir / "report.md", LAST_RUN["report"])
+    log(f"scan files: {workdir}")
 
     coverage = {
         "target": args.target,

package/scanners/ikanban-dastscan.py

@@ -36,14 +36,13 @@ import re
 import shutil
 import subprocess
 import sys
-import tempfile
 import urllib.error
 import urllib.parse
 import urllib.request
 from datetime import datetime, timezone
 from pathlib import Path
 
-DASTSCAN_VERSION = "1.0.0"
+DASTSCAN_VERSION = "1.1.0"
 
 SEVERITIES = ["critical", "high", "medium", "low", "info"]
 SEVERITY_RANK = {s: i for i, s in enumerate(SEVERITIES)}
@@ -141,28 +140,31 @@ def build_report(url: str, findings: list, skipped: list, ran: list) -> tuple:
     return "\n".join(L), counts, total
 
 
-def run_zap(url: str, minutes: int, max_minutes: int) -> tuple[dict | None, str]:
-    """(report, "") or (None, why it did not run)."""
+def run_zap(url: str, minutes: int, max_minutes: int, work: Path) -> tuple[dict | None, str]:
+    """(report, "") or (None, why it did not run). ZAP writes zap.json into <work>/zap/."""
     if not shutil.which("docker"):
         return None, DOCKER_INSTALL
-    with tempfile.TemporaryDirectory() as tmp:
-        os.chmod(tmp, 0o777)  # the ZAP image writes as its own user
-        cmd = ["docker", "run", "--rm", "-v", f"{tmp}:/zap/wrk/:rw", ZAP_IMAGE, "zap-baseline.py",
-               "-t", url, "-J", "zap.json", "-m", str(minutes), "-T", str(max_minutes)]
-        try:
-            p = subprocess.run(cmd, capture_output=True, text=True, timeout=(max_minutes + 5) * 60)
-        except FileNotFoundError:
-            return None, DOCKER_INSTALL
-        except subprocess.TimeoutExpired:
-            return None, f"ZAP did not finish within {max_minutes + 5} minutes"
-        out = Path(tmp) / "zap.json"
-        if p.returncode not in (0, 1, 2) or not out.exists():
-            why = (p.stderr or p.stdout or "").strip()[-300:]
-            return None, f"ZAP failed (exit {p.returncode}): {why or 'no report'}"
-        try:
-            return json.loads(out.read_text() or "{}"), ""
-        except ValueError:
-            return None, "ZAP wrote no JSON report"
+    # The ZAP image writes as its own user, so it gets its own zap/ subfolder it may write to;
+    # the run folder stays 0700, so nobody else on this machine can reach zap/ through it.
+    zap_dir = work / "zap"
+    zap_dir.mkdir(exist_ok=True)
+    os.chmod(zap_dir, 0o777)
+    cmd = ["docker", "run", "--rm", "-v", f"{zap_dir}:/zap/wrk/:rw", ZAP_IMAGE, "zap-baseline.py",
+           "-t", url, "-J", "zap.json", "-m", str(minutes), "-T", str(max_minutes)]
+    try:
+        p = subprocess.run(cmd, capture_output=True, text=True, timeout=(max_minutes + 5) * 60)
+    except FileNotFoundError:
+        return None, DOCKER_INSTALL
+    except subprocess.TimeoutExpired:
+        return None, f"ZAP did not finish within {max_minutes + 5} minutes"
+    out = zap_dir / "zap.json"
+    if p.returncode not in (0, 1, 2) or not out.exists():
+        why = (p.stderr or p.stdout or "").strip()[-300:]
+        return None, f"ZAP failed (exit {p.returncode}): {why or 'no report'}"
+    try:
+        return json.loads(out.read_text() or "{}"), ""
+    except ValueError:
+        return None, "ZAP wrote no JSON report"
 
 
 # ── copied from ikanban-secscan.py: key-host pinning and the API call ──────────────────
@@ -224,6 +226,41 @@ def registered(url: str, args) -> str | None:
     return None
 
 
+# ── Scan work folder (plan 11 H12-T10, owner): raw tool output and the report live under
+# <repo>/.iKanban/scans/<scanner>-<UTC time>/, never the system temp folder. The scans folder
+# holds its own .gitignore ("*"), so nothing in it is committed and no repo .gitignore is edited.
+def add_work_dir_arg(ap):
+    ap.add_argument("--work-dir", default=os.environ.get("IKANBAN_SCAN_DIR", ""),
+                    help="Folder for this scan's files (or IKANBAN_SCAN_DIR; default "
+                         "<repository>/.iKanban/scans)")
+
+
+def scan_work_dir(scanner: str, base: Path, override: str = "") -> Path:
+    scans = Path(override).expanduser().resolve() if override else base / ".iKanban" / "scans"
+    scans.mkdir(parents=True, exist_ok=True)
+    ignore = scans / ".gitignore"
+    if not ignore.exists():
+        ignore.write_text("*\n")
+    run_dir = scans / f"{scanner}-{datetime.now(timezone.utc):%Y%m%d-%H%M%S}"
+    run_dir.mkdir(mode=0o700, exist_ok=True)
+    os.chmod(run_dir, 0o700)  # mkdir's mode is masked by umask; raw tool output stays private
+    return run_dir
+
+
+def write_private(path: Path, text: str) -> None:
+    """Write a file (0600) without following a symlink planted at its name: write a new
+    temp file next to it (O_EXCL | O_NOFOLLOW), then rename it over the name."""
+    tmp = path.with_name(f".{path.name}.{os.getpid()}.tmp")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0), 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        f.write(text)
+    os.replace(tmp, path)
+
+
+def slug(text: str) -> str:
+    return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_")[:80] or "x"
+
+
 # ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
 # Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
 # "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
@@ -369,6 +406,7 @@ def main(argv=None):
     ap.add_argument("--fail-on", choices=SEVERITIES, default=None,
                     help="Exit 1 if any finding is at or above this severity")
     add_pipeline_args(ap)
+    add_work_dir_arg(ap)
     args = ap.parse_args(argv)
 
     if args.list_targets:
@@ -404,12 +442,14 @@ def main(argv=None):
         print(f"error: {why}", file=sys.stderr)
         return 2
 
-    report, skipped_why = run_zap(url, args.minutes, args.max_minutes)
+    work = scan_work_dir("dastscan", Path.cwd(), args.work_dir)
+    report, skipped_why = run_zap(url, args.minutes, args.max_minutes, work)
     findings = parse_zap(report) if report is not None else []
     ran = [f"zap-baseline.py -t {url} -m {args.minutes}"] if report is not None else []
     md, counts, total = build_report(url, findings, [skipped_why] if skipped_why else [], ran)
     LAST_RUN.update(report=md, detail=summary_detail(counts, total, [] if ran else [skipped_why]),
                     skipped=not ran)
+    write_private(work / "report.md", md)
     if args.out:
         Path(args.out).write_text(md)
     if args.json:
@@ -417,6 +457,7 @@ def main(argv=None):
     else:
         print(md)
     sys.stdout.flush()
+    print(f"scan files: {work}", file=sys.stderr)
 
     if args.publish:
         ok, info = api("POST", "/security/scan-reports", args.base_url, args.token,

package/scanners/ikanban-infrascan.py

@@ -3,10 +3,19 @@
 ikanban-infrascan — container image and IaC (infrastructure as code) scan of YOUR OWN
 repository and images, reporting into iKanban's Infrastructure tab (plan 11 H12).
 
-    npx ikanban infrascan                          # IaC misconfiguration scan of cwd
+    npx ikanban infrascan                          # inventory + IaC scan of cwd
+    npx ikanban infrascan --path . --path ../infra # infra in another folder or repo too
     npx ikanban infrascan --image myapp:latest     # also scan a container image
     npx ikanban infrascan --publish --team TEAM    # file the report and its findings
 
+Plan 11 H12-T10 (owner: assume messy development). It starts with an inventory of each path:
+what infrastructure it found, what Trivy scanned, and what it could not scan and why. Infra
+written as code (CDK, Pulumi, CDK for Terraform, Vagrant, Ansible, cloud-SDK scripts) is listed
+as found but not scannable. Images named in docker-compose files are scanned too. A path with no
+infrastructure-as-code file is never reported complete, so its control stays Missing.
+Raw Trivy JSON and the report go to <first path>/.iKanban/scans/infrascan-<UTC time>/ (or
+--work-dir / IKANBAN_SCAN_DIR); that folder ignores itself in git.
+
 It runs Trivy (Apache-2.0, https://github.com/aquasecurity/trivy), which must already be
 installed; a missing Trivy is reported as SKIPPED with the install lines, never as a clean
 scan, and nothing is filed for a check that did not run.
@@ -35,7 +44,6 @@ import re
 import shutil
 import subprocess
 import sys
-import tempfile
 import urllib.error
 import urllib.parse
 import urllib.request
@@ -43,7 +51,7 @@ from dataclasses import dataclass, field
 from datetime import datetime, timezone
 from pathlib import Path
 
-INFRASCAN_VERSION = "1.0.0"
+INFRASCAN_VERSION = "1.1.0"
 
 SEVERITIES = ["critical", "high", "medium", "low", "info"]
 SEVERITY_RANK = {s: i for i, s in enumerate(SEVERITIES)}
@@ -77,6 +85,31 @@ class Section:
     skipped: list = field(default_factory=list)
     ran: list = field(default_factory=list)
     complete: bool = False
+    filed: list | None = None   # what publish sends; None = every finding (plan_filing sets it)
+    notes: list = field(default_factory=list)
+
+
+# The server takes at most this many findings in one publish (security_scan_findings.rs).
+MAX_FILED = 500
+
+
+def plan_filing(sec: Section) -> None:
+    """Plan 11 H12-T10 review: container images file critical and high only (the rest stay in
+    the report); any section over MAX_FILED files the worst MAX_FILED and is published
+    incomplete, so the rescan never closes findings that were only cut."""
+    keep = sec.findings
+    if sec.kind == "container":
+        keep = [f for f in keep if f.severity in ("critical", "high")]
+        if len(keep) < len(sec.findings):
+            sec.notes.append(f"{len(sec.findings) - len(keep)} medium and low findings are in this report only; "
+                             "iKanban files critical and high for container images.")
+    if len(keep) > MAX_FILED:
+        keep = sorted(keep, key=lambda f: (SEVERITY_RANK.get(f.severity, 99), f.title))
+        sec.notes.append(f"Filed the {MAX_FILED} worst; {len(keep) - MAX_FILED} more were left out of iKanban "
+                         "(this run counts as incomplete, so nothing closes).")
+        keep = keep[:MAX_FILED]
+        sec.complete = False
+    sec.filed = keep
 
 
 def run(cmd, cwd=None, timeout=900):
@@ -90,19 +123,29 @@ def run(cmd, cwd=None, timeout=900):
         return False, "", f"timed out after {timeout}s"
 
 
-def trivy_json(args: list) -> tuple[dict | None, str]:
-    """Run trivy with --format json into a temp file; (report, "") or (None, why skipped)."""
+def trivy_json(args: list, target: str, out: Path) -> tuple[dict | None, str]:
+    """Run `trivy SUBCOMMAND [ARGS] -- TARGET` with --format json into `out`; (report, "") or
+    (None, why skipped). Plan 11 H12-T10 review: trivy runs from the scan's work folder with a
+    scanner-owned --config and --ignorefile (both default to files in the working folder,
+    trivy.dev CLI reference: `-c, --config ... (default "trivy.yaml")`, `--ignorefile ...
+    (default ".trivyignore")`), so a repository's trivy.yaml or .trivyignore changes nothing.
+    The target comes after `--`, so a name starting with '-' can never be read as a flag."""
     if not shutil.which("trivy"):
         return None, TRIVY_INSTALL
-    with tempfile.TemporaryDirectory() as tmp:
-        out = os.path.join(tmp, "trivy.json")
-        ok, _o, err = run(["trivy", *args[:1], "--format", "json", "--output", out, *args[1:]])
-        if not ok or not os.path.exists(out):
-            return None, f"trivy {args[0]} failed: {(err or '').strip()[-300:] or 'no output'}"
-        try:
-            return json.loads(Path(out).read_text() or "{}"), ""
-        except ValueError:
-            return None, f"trivy {args[0]} wrote no JSON"
+    work = out.parent
+    conf, ignore = work / "trivy-config.yaml", work / "trivyignore"
+    if not conf.exists():
+        write_private(conf, "{}\n")
+    if not ignore.exists():
+        write_private(ignore, "")
+    ok, _o, err = run(["trivy", *args[:1], "--config", str(conf), "--ignorefile", str(ignore),
+                       "--format", "json", "--output", str(out), *args[1:], "--", target], cwd=work)
+    if not ok or not out.exists():
+        return None, f"trivy {args[0]} failed: {(err or '').strip()[-300:] or 'no output'}"
+    try:
+        return json.loads(out.read_text() or "{}"), ""
+    except ValueError:
+        return None, f"trivy {args[0]} wrote no JSON"
 
 
 def parse_misconfigurations(report: dict) -> list:
@@ -142,23 +185,35 @@ def parse_vulnerabilities(report: dict, image: str) -> list:
     return out
 
 
-def scan_iac(root: Path, scope: str) -> Section:
-    sec = Section("IaC misconfiguration", "iac", scope)
-    report, why = trivy_json(["fs", "--scanners", "misconfig", str(root)])
+def scan_iac(root: Path, scope: str, inv: dict, work: Path) -> Section:
+    sec = Section(f"IaC misconfiguration — {scope}", "iac", scope)
+    if not any(inv[c] for c in TRIVY_IAC):
+        # Owner: no IaC file found is not a pass. complete stays False: the control stays Missing.
+        sec.skipped.append(f"No infrastructure-as-code files found in {root} — if the infrastructure lives in "
+                           "another folder or repository, add it with another --path")
+        return sec
+    # ponytail: trivy.dev does not say what --skip-dirs is relative to with an absolute target;
+    # the absolute and the ** form are both passed. A miss only means a vendored folder is read too.
+    skip = [x for d in SKIP_DIRS for x in ("--skip-dirs", f"{root.resolve()}/{d}", "--skip-dirs", f"**/{d}")]
+    report, why = trivy_json(["fs", "--scanners", "misconfig", *skip], str(root.resolve()),
+                             work / f"trivy-iac-{slug(scope)}.json")
     if report is None:
         sec.skipped.append(why)
         return sec
     sec.ran.append(f"trivy fs --scanners misconfig {root.name}")
     sec.findings = parse_misconfigurations(report)
     for f in sec.findings:  # paths relative to the repository, like secscan
-        f.location = f.location.removeprefix(str(root) + os.sep)
+        f.location = f.location.removeprefix(str(root) + os.sep).removeprefix(str(root.resolve()) + os.sep)
     sec.complete = True
     return sec
 
 
-def scan_image(image: str) -> Section:
+def scan_image(image: str, work: Path) -> Section:
     sec = Section(f"Container image {image}", "container", image)
-    report, why = trivy_json(["image", image])
+    if not valid_image_ref(image):
+        sec.skipped.append(f"`{image[:80]}` is not a valid image name; not scanned")
+        return sec
+    report, why = trivy_json(["image"], image, work / f"trivy-image-{slug(image)}.json")
     if report is None:
         sec.skipped.append(why)
         return sec
@@ -168,6 +223,155 @@ def scan_image(image: str) -> Section:
     return sec
 
 
+# ── Inventory (plan 11 H12-T10) ───────────────────────────────────────────────────────
+# What Trivy's misconfiguration scanner reads, from trivy.dev "IaC" coverage (Kubernetes,
+# Docker: Dockerfile/Containerfile, Terraform: *.tf *.tf.json, CloudFormation, Azure ARM,
+# Helm). docker-compose, Ansible, Bicep, CDK, Pulumi and Vagrant are not in that table.
+TRIVY_IAC = ("Dockerfile", "Kubernetes manifest", "Helm chart", "Terraform", "CloudFormation", "Azure ARM template")
+NOT_SCANNABLE = {
+    "Dockerfile with another name": "Trivy reads files named Dockerfile or Containerfile; this one may not be checked",
+    "docker-compose file": "its images are scanned as containers; the compose settings themselves are not checked",
+    "AWS CDK app": "run `npx cdk synth` and rescan: the templates in cdk.out are scanned as CloudFormation",
+    "CDK for Terraform app": "run `cdktf synth` and rescan: the Terraform JSON in cdktf.out is scanned",
+    "Pulumi program": "found, not scannable: review by hand or audit the cloud account",
+    "Vagrant": "found, not scannable: provisioning by script; review by hand",
+    "Ansible playbook": "found, not scannable by Trivy: review by hand",
+    "Azure Bicep": "run `az bicep build` and rescan: the ARM JSON it writes is scanned",
+    "Cloud SDK code": "found, not scannable: infrastructure created in code; review by hand or audit the cloud account",
+}
+# Imports that mean code talks to a cloud API (examples; the real set is broader).
+SDK_MARKERS = ("import boto3", "from boto3", "from botocore", "@aws-sdk/", "'aws-sdk'", '"aws-sdk"',
+               "github.com/aws/aws-sdk-go", "software.amazon.awssdk", "from google.cloud",
+               "from google.cloud import", "@google-cloud/", "cloud.google.com/go/", "azure.mgmt",
+               "@azure/arm-", "github.com/Azure/azure-sdk-for-go")
+SDK_EXTS = {".py", ".js", ".mjs", ".cjs", ".ts", ".go", ".java", ".kt", ".cs", ".rb"}
+SKIP_DIRS = (".git", "node_modules", "vendor", "dist", "build", ".venv", "venv", "target", ".iKanban/scans",
+             ".terraform", "__pycache__")
+MAX_READ = 512 * 1024
+
+
+def _head(p: Path) -> str:
+    try:
+        with p.open("rb") as f:
+            return f.read(MAX_READ).decode("utf-8", "ignore")
+    except OSError:
+        return ""
+
+
+def _skipped(rel: Path) -> bool:
+    parts = rel.parts
+    return any(d in parts for d in SKIP_DIRS if "/" not in d) or rel.as_posix().startswith(".iKanban/scans")
+
+
+def inventory(root: Path) -> dict:
+    """Infra files under root, by kind (paths relative to root). Never raises."""
+    inv = {k: [] for k in (*TRIVY_IAC, *NOT_SCANNABLE)}
+    files = []
+    for dirpath, dirnames, filenames in os.walk(root):
+        rel_dir = Path(dirpath).relative_to(root)
+        dirnames[:] = [d for d in dirnames if not _skipped(rel_dir / d)]
+        files += [rel_dir / f for f in filenames]
+    charts = {f.parent for f in files if f.name == "Chart.yaml"}
+    inv["Helm chart"] = sorted(c.as_posix() or "." for c in charts)
+    for rel in sorted(files):
+        name, low = rel.name, rel.name.lower()
+        posix = rel.as_posix()
+        in_chart = any(c == rel.parent or c in rel.parents for c in charts)
+        if name in ("Dockerfile", "Containerfile"):
+            inv["Dockerfile"].append(posix)
+        elif low.endswith(".dockerfile") or low.startswith("dockerfile."):
+            inv["Dockerfile with another name"].append(posix)
+        elif re.match(r"^(docker-)?compose[\w.-]*\.ya?ml$", low):
+            inv["docker-compose file"].append(posix)
+        elif low.endswith((".tf", ".tf.json")):
+            inv["Terraform"].append(posix)
+        elif name == "cdk.json":
+            inv["AWS CDK app"].append(posix)
+        elif name == "cdktf.json":
+            inv["CDK for Terraform app"].append(posix)
+        elif name in ("Pulumi.yaml", "Pulumi.yml"):
+            inv["Pulumi program"].append(posix)
+        elif name == "Vagrantfile":
+            inv["Vagrant"].append(posix)
+        elif low.endswith(".bicep"):
+            inv["Azure Bicep"].append(posix)
+        elif low.endswith((".yaml", ".yml", ".json")) and not in_chart:
+            text = _head(root / rel)
+            if "AWSTemplateFormatVersion" in text or re.search(r"""["']?Type["']?\s*:\s*["']?AWS::""", text):
+                inv["CloudFormation"].append(posix)
+            elif low.endswith(".json") and "deploymentTemplate.json" in text:
+                inv["Azure ARM template"].append(posix)
+            elif re.search(r"(?m)^apiVersion:\s*\S", text) and re.search(r"(?m)^kind:\s*\S", text):
+                inv["Kubernetes manifest"].append(posix)
+            elif re.search(r"(?m)^-\s+(name:.*\n\s+)?hosts:\s*\S", text) and re.search(r"(?m)^\s+(tasks|roles):", text):
+                inv["Ansible playbook"].append(posix)
+        elif rel.suffix in SDK_EXTS:
+            text = _head(root / rel)
+            if any(m in text for m in SDK_MARKERS):
+                inv["Cloud SDK code"].append(posix)
+    return inv
+
+
+def cdk_note(inv: dict) -> str:
+    """CDK synth output (cdk.out) holds CloudFormation templates: say they were scanned."""
+    synthed = [p for p in inv["CloudFormation"] if p.split("/")[-2:-1] == ["cdk.out"] or "/cdk.out/" in f"/{p}"]
+    return "synthesized templates in cdk.out are scanned as CloudFormation" if synthed else NOT_SCANNABLE["AWS CDK app"]
+
+
+# Plan 11 H12-T10 review: compose `image:` values come from the repository, so only a plain
+# image reference (registry[:port]/path:tag@sha256:digest, lower case, no leading '-') may
+# reach trivy's command line.
+IMAGE_REF = re.compile(
+    r"^[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?(?::[0-9]{1,5})?"        # registry host or first path part
+    r"(?:/[a-z0-9](?:[a-z0-9._-]*[a-z0-9])?)*"                     # more path parts
+    r"(?::[A-Za-z0-9_][A-Za-z0-9_.-]{0,127})?"                     # tag
+    r"(?:@sha256:[a-f0-9]{64})?$")
+
+
+def valid_image_ref(ref: str) -> bool:
+    return 0 < len(ref) <= 255 and ".." not in ref and bool(IMAGE_REF.match(ref))
+
+
+IMAGE_LINE = re.compile(r"""^\s*image:\s*["']?([^"'\s#]+)["']?\s*(#.*)?$""")
+
+
+def compose_images(root: Path, inv: dict) -> tuple[list, list, list]:
+    """(images named in compose files, names with ${VARS}, names that are not a valid image)."""
+    images, unresolved, rejected = [], [], []
+    for rel in inv["docker-compose file"]:
+        for line in _head(root / rel).splitlines():
+            m = IMAGE_LINE.match(line)
+            if not m:
+                continue
+            name = m.group(1)
+            (unresolved if "$" in name else images if valid_image_ref(name) else rejected).append(name)
+    return sorted(set(images)), sorted(set(unresolved)), sorted(set(rejected))
+
+
+def inventory_rows(inv: dict, scanned_iac: bool, iac_why: str, rejected: list = ()) -> list:
+    """Markdown table rows: what | found | scanned | note."""
+    rows = []
+    if rejected:
+        shown = ", ".join(f"`{r[:60]}`" for r in rejected[:5])
+        rows.append(f"| Image name in a compose file | {len(rejected)}: {shown} | no | not a valid image name, "
+                    "so it was not passed to Trivy; check the compose file |")
+    for kind, paths in inv.items():
+        if not paths:
+            continue
+        shown = ", ".join(f"`{p}`" for p in paths[:5]) + (f" (+{len(paths) - 5} more)" if len(paths) > 5 else "")
+        if kind in TRIVY_IAC:
+            state, note = ("yes", "Trivy misconfiguration checks") if scanned_iac else ("no", iac_why)
+        elif kind == "AWS CDK app":
+            note = cdk_note(inv)
+            state = "yes (cdk.out)" if note.startswith("synthesized") else "no"
+        elif kind == "docker-compose file":
+            state, note = "images only", NOT_SCANNABLE[kind]
+        else:
+            state, note = "no", NOT_SCANNABLE[kind]
+        rows.append(f"| {kind} | {len(paths)}: {shown} | {state} | {note} |")
+    return rows
+
+
 def build_report(title: str, sections: list) -> tuple:
     counts = {s: 0 for s in SEVERITIES}
     for sec in sections:
@@ -181,6 +385,10 @@ def build_report(title: str, sections: list) -> tuple:
     if not total:
         L.append("| _none_ | 0 |")
     L += ["", f"**{total} finding(s).**", ""]
+    for scope, rows in INVENTORY:
+        L += [f"## Inventory — {scope}", "", "| What | Found | Scanned | Note |", "|---|---|---|---|"]
+        L += rows or ["| _no infrastructure files found_ | 0 | — | add the folder or repository that holds them with another --path |"]
+        L.append("")
     for sec in sections:
         L.append(f"## {sec.name}")
         if sec.ran:
@@ -189,13 +397,16 @@ def build_report(title: str, sections: list) -> tuple:
             L.append(f"- ⚠️ **SKIPPED** — {s}")
         if not sec.findings and sec.complete:
             L.append("- ✅ no findings")
+        for n in sec.notes:
+            L.append(f"- ℹ️ {n}")
         for f in sorted(sec.findings, key=lambda x: (SEVERITY_RANK.get(x.severity, 99), x.title)):
             loc = f" — `{f.location}{':' + f.line if f.line else ''}`" if f.location else ""
             L.append(f"- **[{f.severity}]** {f.title}{loc}")
             if f.detail:
                 L.append(f"  - {f.detail}")
         L.append("")
-    L += ["---", "", "Skipped checks are gaps, not passes — install the named tool and re-run."]
+    L += ["---", "", "Skipped checks are gaps, not passes — install the named tool and re-run.",
+          "Found but not scannable is a gap too: review it by hand."]
     return "\n".join(L), counts, total
 
 
@@ -218,7 +429,7 @@ def findings_payload(sec: Section, home: str | None = None) -> list:
         "location_file": clean(f.location) or None,
         "location_lines": f.line,
         "remediation": clean(" ".join(x for x in (f.detail, f.remediation) if x)),
-    } for f in sec.findings]
+    } for f in (sec.filed if sec.filed is not None else sec.findings)]
 
 
 # ── copied from ikanban-secscan.py: scope, key-host pinning, API ─────────────────────
@@ -306,11 +517,15 @@ def publish(md: str, title: str, sections: list, args) -> int:
     if not ok:
         return 2
     for sec in sections:
-        if not sec.complete:
+        nothing_found = any(x.startswith("No infrastructure-as-code files found") for x in sec.skipped)
+        cut = any("more were left out" in n for n in sec.notes)
+        if not sec.complete and not nothing_found and not cut:
             print(f"{sec.name}: did not run, nothing filed or closed", file=sys.stderr)
             continue
+        # A path with no IaC file is recorded as an incomplete run: iKanban shows when it was
+        # checked, the control stays Missing, and nothing closes.
         ok, data = api("POST", f"/teams/{args.team}/security/scan-findings", args.base_url, args.token,
-                       {"findings": findings_payload(sec), "scope": sec.scope, "complete": True,
+                       {"findings": findings_payload(sec), "scope": sec.scope, "complete": sec.complete,
                         "kind": sec.kind})
         if not ok:
             print(f"filing {sec.name} FAILED: {data or 'this iKanban server does not take infrastructure findings yet'}",
@@ -322,6 +537,41 @@ def publish(md: str, title: str, sections: list, args) -> int:
     return 0
 
 
+# ── Scan work folder (plan 11 H12-T10, owner): raw tool output and the report live under
+# <repo>/.iKanban/scans/<scanner>-<UTC time>/, never the system temp folder. The scans folder
+# holds its own .gitignore ("*"), so nothing in it is committed and no repo .gitignore is edited.
+def add_work_dir_arg(ap):
+    ap.add_argument("--work-dir", default=os.environ.get("IKANBAN_SCAN_DIR", ""),
+                    help="Folder for this scan's files (or IKANBAN_SCAN_DIR; default "
+                         "<repository>/.iKanban/scans)")
+
+
+def scan_work_dir(scanner: str, base: Path, override: str = "") -> Path:
+    scans = Path(override).expanduser().resolve() if override else base / ".iKanban" / "scans"
+    scans.mkdir(parents=True, exist_ok=True)
+    ignore = scans / ".gitignore"
+    if not ignore.exists():
+        ignore.write_text("*\n")
+    run_dir = scans / f"{scanner}-{datetime.now(timezone.utc):%Y%m%d-%H%M%S}"
+    run_dir.mkdir(mode=0o700, exist_ok=True)
+    os.chmod(run_dir, 0o700)  # mkdir's mode is masked by umask; raw tool output stays private
+    return run_dir
+
+
+def write_private(path: Path, text: str) -> None:
+    """Write a file (0600) without following a symlink planted at its name: write a new
+    temp file next to it (O_EXCL | O_NOFOLLOW), then rename it over the name."""
+    tmp = path.with_name(f".{path.name}.{os.getpid()}.tmp")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0), 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        f.write(text)
+    os.replace(tmp, path)
+
+
+def slug(text: str) -> str:
+    return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_")[:80] or "x"
+
+
 # ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
 # Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
 # "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
@@ -329,6 +579,7 @@ def publish(md: str, title: str, sections: list, args) -> int:
 _UUID = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.I)
 PIPE_CHUNK = 15 * 1024  # the server takes 16 KB per chunk
 LAST_RUN = {"report": "", "detail": "", "skipped": False}
+INVENTORY: list = []  # (scope, table rows) per --path, for the report
 
 
 def add_pipeline_args(ap):
@@ -451,10 +702,13 @@ def run_main(stage, main_fn, argv=None):
 def main(argv=None):
     ap = argparse.ArgumentParser(description="Container image and IaC scan (Trivy) that reports into iKanban.")
     ap.add_argument("--version", action="version", version=f"ikanban infrascan {INFRASCAN_VERSION}")
-    ap.add_argument("--path", default=".", help="Repository whose IaC files to scan (default: cwd)")
+    ap.add_argument("--path", action="append", default=[],
+                    help="A folder or repository holding infrastructure files (repeat for each; default: cwd)")
     ap.add_argument("--image", action="append", default=[], metavar="IMAGE",
                     help="Also scan this container image (repeat for each image)")
     ap.add_argument("--no-iac", action="store_true", help="Scan only the --image images")
+    ap.add_argument("--no-compose-images", action="store_true",
+                    help="Do not scan the images that docker-compose files name")
     ap.add_argument("--publish", action="store_true", help="File the report and findings into iKanban")
     ap.add_argument("--team", default=os.environ.get("IKANBAN_TEAM_ID", ""),
                     help="Team UUID to publish into (or IKANBAN_TEAM_ID)")
@@ -466,34 +720,59 @@ def main(argv=None):
     ap.add_argument("--fail-on", choices=SEVERITIES, default=None,
                     help="Exit 1 if any finding is at or above this severity")
     add_pipeline_args(ap)
+    add_work_dir_arg(ap)
     args = ap.parse_args(argv)
 
-    root = Path(args.path).expanduser().resolve()
-    if not root.is_dir():
-        print(f"error: {root} is not a directory", file=sys.stderr)
-        return 2
+    roots = [Path(p).expanduser().resolve() for p in (args.path or ["."])]
+    for root in roots:
+        if not root.is_dir():
+            print(f"error: {root} is not a directory", file=sys.stderr)
+            return 2
+    root = roots[0]
     if args.publish and (not args.token or not args.team):
         print("error: --publish needs --token (or VIBE_API_TOKEN) and --team (or IKANBAN_TEAM_ID)",
               file=sys.stderr)
         return 2
 
-    sections = [] if args.no_iac else [scan_iac(root, scan_scope(root))]
-    sections += [scan_image(i) for i in args.image]
-    if not sections:
+    if args.no_iac and not args.image:
         print("error: nothing to scan: drop --no-iac or add --image", file=sys.stderr)
         return 2
-    md, counts, total = build_report(root.name, sections)
-    nothing_ran = not any(sec.complete for sec in sections)
+    work = scan_work_dir("infrascan", root, args.work_dir)
+    sections, images, unresolved = [], list(args.image), []
+    INVENTORY.clear()
+    for r in roots:
+        inv = inventory(r)
+        rejected = []
+        if not args.no_compose_images:
+            found, skipped_vars, rejected = compose_images(r, inv)
+            images += [i for i in found if i not in images]
+            unresolved += skipped_vars
+        if not args.no_iac:
+            sec = scan_iac(r, scan_scope(r), inv, work)
+            sections.append(sec)
+            INVENTORY.append((sec.scope, inventory_rows(inv, sec.complete, "; ".join(sec.skipped), rejected)))
+        else:
+            INVENTORY.append((scan_scope(r), inventory_rows(inv, False, "--no-iac", rejected)))
+    sections += [scan_image(i, work) for i in images]
+    if unresolved:
+        sections.append(Section("Compose images not scanned", "container", "compose",
+                                skipped=[f"`{i}` uses a ${{VARIABLE}}; pass the real name with --image" for i in unresolved]))
+    for sec in sections:
+        plan_filing(sec)
+    md, counts, total = build_report(", ".join(r.name for r in roots), sections)
+    write_private(work / "report.md", md)
+    nothing_ran = not any(sec.ran for sec in sections)  # a cut section still ran
     LAST_RUN.update(report=md, skipped=nothing_ran, detail=summary_detail(
         counts, total, [s for sec in sections for s in sec.skipped] if nothing_ran else []))
     if args.out:
         Path(args.out).write_text(md)
     if args.json:
-        print(json.dumps({"path": str(root), "images": args.image, "total": total, "counts": counts,
-                          "skipped": [s for sec in sections for s in sec.skipped]}, indent=2))
+        print(json.dumps({"paths": [str(r) for r in roots], "images": images, "total": total, "counts": counts,
+                          "skipped": [s for sec in sections for s in sec.skipped], "work_dir": str(work)}, indent=2))
     else:
         print(md)
     sys.stdout.flush()
+    print(f"scan files: {work}", file=sys.stderr)
 
     if args.publish:
         title = f"Infrastructure scan — {root.name} — {datetime.now(timezone.utc):%Y-%m-%d %H:%M} UTC"

package/scanners/ikanban-secscan.py

@@ -64,7 +64,7 @@ from pathlib import Path
 # that npm no longer hosts the package. Starting at 1.0.0 rather than continuing
 # the npm package's 0.1.x line: that counter belonged to the wrapper, not to
 # this file, and reusing it would suggest a continuity that does not exist.
-SECSCAN_VERSION = "1.4.0"
+SECSCAN_VERSION = "1.5.0"
 
 SEVERITIES = ["critical", "high", "medium", "low", "info"]
 SEVERITY_RANK = {s: i for i, s in enumerate(SEVERITIES)}
@@ -205,6 +205,8 @@ def iter_files(root: Path):
             d for d in dirnames
             if d not in SKIP_DIRS
             and not d.startswith(".git")
+            # Plan 11 H12-T10: never read our own scan output.
+            and not (d == "scans" and Path(dirpath).name == ".iKanban")
             and not _is_nested_repo(Path(dirpath) / d, root)
         ]
         for fn in filenames:
@@ -859,6 +861,41 @@ def publish(md: str, title: str, base_url: str, token: str, team_id: str,
         return False, str(e)
 
 
+# ── Scan work folder (plan 11 H12-T10, owner): raw tool output and the report live under
+# <repo>/.iKanban/scans/<scanner>-<UTC time>/, never the system temp folder. The scans folder
+# holds its own .gitignore ("*"), so nothing in it is committed and no repo .gitignore is edited.
+def add_work_dir_arg(ap):
+    ap.add_argument("--work-dir", default=os.environ.get("IKANBAN_SCAN_DIR", ""),
+                    help="Folder for this scan's files (or IKANBAN_SCAN_DIR; default "
+                         "<repository>/.iKanban/scans)")
+
+
+def scan_work_dir(scanner: str, base: Path, override: str = "") -> Path:
+    scans = Path(override).expanduser().resolve() if override else base / ".iKanban" / "scans"
+    scans.mkdir(parents=True, exist_ok=True)
+    ignore = scans / ".gitignore"
+    if not ignore.exists():
+        ignore.write_text("*\n")
+    run_dir = scans / f"{scanner}-{datetime.now(timezone.utc):%Y%m%d-%H%M%S}"
+    run_dir.mkdir(mode=0o700, exist_ok=True)
+    os.chmod(run_dir, 0o700)  # mkdir's mode is masked by umask; raw tool output stays private
+    return run_dir
+
+
+def write_private(path: Path, text: str) -> None:
+    """Write a file (0600) without following a symlink planted at its name: write a new
+    temp file next to it (O_EXCL | O_NOFOLLOW), then rename it over the name."""
+    tmp = path.with_name(f".{path.name}.{os.getpid()}.tmp")
+    fd = os.open(tmp, os.O_WRONLY | os.O_CREAT | os.O_EXCL | getattr(os, "O_NOFOLLOW", 0), 0o600)
+    with os.fdopen(fd, "w", encoding="utf-8") as f:
+        f.write(text)
+    os.replace(tmp, path)
+
+
+def slug(text: str) -> str:
+    return re.sub(r"[^A-Za-z0-9._-]+", "_", text).strip("_")[:80] or "x"
+
+
 # ── Pipelines (plan 11 H12, owner): with --task, the scan shows in that task's Pipelines view ──
 # Same calls as `ikanban pipeline` (vibe-cli/lib/pipeline.js → routes/pipeline.rs): an event
 # "running" at the start, "passed" / "failed" / "skipped" at the end with a one-line detail,
@@ -1011,6 +1048,7 @@ def main(argv=None):
     ap.add_argument("--fail-on", choices=SEVERITIES, default=None,
                     help="Exit 1 if any finding is at or above this severity")
     add_pipeline_args(ap)
+    add_work_dir_arg(ap)
     args = ap.parse_args(argv)
 
     root = Path(args.path).expanduser().resolve()
@@ -1050,6 +1088,8 @@ def main(argv=None):
                 scan_secrets(root), scan_permissions(root)]
     md, counts, total = build_report(root, sections)
     LAST_RUN.update(report=md, detail=summary_detail(counts, total, []), skipped=False)
+    work = scan_work_dir("secscan", root, args.work_dir)
+    write_private(work / "report.md", md)
 
     if args.out:
         Path(args.out).write_text(md)
@@ -1062,6 +1102,7 @@ def main(argv=None):
     # The lines below go to stderr; flush first so they follow the report when both are
     # piped into one stream (an agent's `2>&1 | tail` would otherwise cut them off).
     sys.stdout.flush()
+    print(f"scan files: {work}", file=sys.stderr)
 
     if args.publish:
         if not args.token or not args.team: