omen-sec-cli 1.0.15 → 1.0.17

package/bin/index.js

@@ -15,7 +15,7 @@ async function main() {
   }
 
   if (args.flags.version) {
-    console.log('1.0.14');
+    console.log('1.0.17');
     return;
   }
 

package/core/generator.js

@@ -18,6 +18,11 @@ export async function generateOutputs(scanData) {
   }
 
   const jsonContent = JSON.stringify(scanData, null, 2);
+
+  // Simple Schema Validation
+  if (!scanData.schema_version || !scanData.scan_id || !Array.isArray(scanData.vulnerabilities)) {
+    console.error(chalk.red('\n[Error] Report data validation failed. Schema 1.0 requirements not met.'));
+  }
   
   // JSON Report
   const jsonReportPath = path.join(outputDir, 'omen-report.json');
@@ -26,7 +31,28 @@ export async function generateOutputs(scanData) {
   
   // TXT Report
   const txtReportPath = path.join(outputDir, 'omen-report.txt');
-  const txtContent = `OMEN SECURITY REPORT\n\nTarget: ${scanData.target}\nScore: ${scanData.score}\nRisk: ${scanData.riskLevel}\n\nVulnerabilities:\n${scanData.vulnerabilities.map(v => `- ${v.description}`).join('\n')}`;
+  let txtContent = `OMEN SECURITY REPORT\n`;
+  txtContent += `====================\n`;
+  txtContent += `Target: ${scanData.target}\n`;
+  txtContent += `Scan ID: ${scanData.scan_id}\n`;
+  txtContent += `Date: ${scanData.timestamp}\n`;
+  txtContent += `Score: ${scanData.score}/100\n`;
+  txtContent += `Risk Level: ${scanData.riskLevel}\n\n`;
+
+  txtContent += `VULNERABILITIES FOUND:\n`;
+  txtContent += `----------------------\n`;
+  
+  if (scanData.vulnerabilities.length === 0) {
+    txtContent += `No vulnerabilities detected.\n`;
+  } else {
+    scanData.vulnerabilities.forEach(v => {
+      txtContent += `[${v.severity.toUpperCase()}] ${v.title || v.description}\n`;
+      txtContent += `Category: ${v.category} | Confidence: ${v.confidence}\n`;
+      txtContent += `Description: ${v.description}\n`;
+      if (v.remediation) txtContent += `Remediation: ${v.remediation}\n`;
+      txtContent += `----------------------\n`;
+    });
+  }
   await fs.writeFile(txtReportPath, txtContent);
   console.log(` /omen-reports/omen-report.txt`);
   

package/core/local-scanner.js

@@ -45,10 +45,15 @@ export async function scanLocalProject() {
           osvRes.data.vulns.forEach(vuln => {
             vulnerabilities.push({
               id: vuln.id,
-              type: 'Vulnerable Component (OSV.dev)',
-              severity: 'High',
+              kind: 'tech',
+              category: 'confirmed',
+              confidence: 'high',
+              severity: 'high',
+              title: `Vulnerable Dependency: ${name}`,
               description: `Real CVE found for ${name}@${cleanVersion}: ${vuln.summary || vuln.details}`,
-              cwe: vuln.database_specific?.cwe_ids?.[0] || 'N/A'
+              cwe: vuln.database_specific?.cwe_ids?.[0] || 'N/A',
+              evidence: { package: name, version: cleanVersion, vuln_id: vuln.id },
+              remediation: `Update ${name} to a secure version as recommended by OSV/NVD.`
             });
           });
         }
@@ -57,27 +62,33 @@ export async function scanLocalProject() {
       }
     }
 
-    // Exemplos de dependências conhecidas (fallback mock)
+    // Fallback mocks
     if (deps['lodash'] && deps['lodash'].match(/[~^]?4\.17\.[0-20]/)) {
       vulnerabilities.push({
         id: `LOC-VULN-${Date.now()}-1`,
-        category: 'Confirmed',
-        confidence: 'High',
-        severity: 'High',
+        kind: 'tech',
+        category: 'confirmed',
+        confidence: 'high',
+        severity: 'high',
+        title: 'Vulnerable Lodash Version',
         description: `Outdated dependency detected in package.json: lodash (${deps['lodash']}). Known Prototype Pollution risk.`,
         cwe: 'CWE-1321',
-        evidence: { file: 'package.json', finding: `lodash: ${deps['lodash']}` }
+        evidence: { file: 'package.json', finding: `lodash: ${deps['lodash']}` },
+        remediation: 'Update lodash to version 4.17.21 or higher.'
       });
     }
     if (deps['express'] && deps['express'].match(/[~^]?3\./)) {
       vulnerabilities.push({
         id: `LOC-VULN-${Date.now()}-2`,
-        category: 'Confirmed',
-        confidence: 'High',
-        severity: 'High',
+        kind: 'tech',
+        category: 'confirmed',
+        confidence: 'high',
+        severity: 'high',
+        title: 'Critical Outdated Express',
         description: `Severely outdated Express.js version (${deps['express']}) detected. Multiple CVEs exist.`,
         cwe: 'CWE-1104',
-        evidence: { file: 'package.json', finding: `express: ${deps['express']}` }
+        evidence: { file: 'package.json', finding: `express: ${deps['express']}` },
+        remediation: 'Upgrade Express.js to the latest stable version (4.x or 5.x).'
       });
     }
   } catch (err) {
@@ -98,55 +109,67 @@ export async function scanLocalProject() {
       filesScanned.push(path.basename(file));
 
       lines.forEach((line, index) => {
-        // Regra 1: Hardcoded Secrets (AWS Keys, API Keys simples)
+        // Regra 1: Hardcoded Secrets
         if (/(api_key|apikey|secret|password|token)\s*=\s*['"][a-zA-Z0-9_-]{10,}['"]/i.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-3`,
-            category: 'Confirmed',
-            confidence: 'Medium', // Could be a test key
-            severity: 'Critical',
+            kind: 'content',
+            category: 'confirmed',
+            confidence: 'medium',
+            severity: 'critical',
+            title: 'Hardcoded Secret Detected',
             description: `Potential hardcoded secret found in ${path.basename(file)} at line ${index + 1}`,
             cwe: 'CWE-798',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Move secrets to environment variables or a secure vault.'
           });
         }
 
-        // Regra 2: Uso de Eval (Code Injection)
+        // Regra 2: Uso de Eval
         if (/eval\s*\(/.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-4`,
-            category: 'Confirmed',
-            confidence: 'High',
-            severity: 'Critical',
+            kind: 'content',
+            category: 'confirmed',
+            confidence: 'high',
+            severity: 'critical',
+            title: 'Dangerous eval() Usage',
             description: `Dangerous use of eval() detected in ${path.basename(file)} at line ${index + 1}`,
             cwe: 'CWE-94',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Avoid using eval(). Use safer alternatives like JSON.parse() or specific logic.'
           });
         }
 
-        // Regra 3: SQLi (Concatenação crua de strings com SELECT)
+        // Regra 3: SQLi
         if (/SELECT.*FROM.*WHERE.*(\+|`|\${)/i.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-5`,
-            category: 'Probable',
-            confidence: 'Medium',
-            severity: 'Critical',
+            kind: 'content',
+            category: 'probable',
+            confidence: 'medium',
+            severity: 'critical',
+            title: 'Potential SQL Injection',
             description: `Potential SQL Injection (raw string concatenation) in ${path.basename(file)} at line ${index + 1}.`,
             cwe: 'CWE-89',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Use parameterized queries or an ORM to prevent SQL injection.'
           });
         }
 
-        // Regra 6: Local File Inclusion (LFI) via require/import dinâmico
+        // Regra 6: LFI
         if (/(require|import)\s*\(['"]?.*(\+|`|\${)/i.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-6`,
-            category: 'Probable',
-            confidence: 'Medium',
-            severity: 'High',
-            description: `Potential LFI detected in ${path.basename(file)} at line ${index + 1}. Dynamic loading of files based on user input can lead to sensitive data exposure.`,
+            kind: 'content',
+            category: 'probable',
+            confidence: 'medium',
+            severity: 'high',
+            title: 'Potential LFI',
+            description: `Potential Local File Inclusion (LFI) detected in ${path.basename(file)} at line ${index + 1}.`,
             cwe: 'CWE-22',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Validate and sanitize file paths before dynamic loading.'
           });
         }
 
@@ -154,12 +177,15 @@ export async function scanLocalProject() {
         if (/\.prototype\.[a-zA-Z0-9_]+\s*=\s*/.test(line)) {
           vulnerabilities.push({
             id: `LOC-VULN-${Date.now()}-7`,
-            category: 'Hardening',
-            confidence: 'Low',
-            severity: 'Medium',
-            description: `Direct prototype modification in ${path.basename(file)} at line ${index + 1}. This can lead to Prototype Pollution if user input reaches this assignment.`,
+            kind: 'content',
+            category: 'hardening',
+            confidence: 'low',
+            severity: 'medium',
+            title: 'Prototype Modification Risk',
+            description: `Direct prototype modification in ${path.basename(file)} at line ${index + 1}.`,
             cwe: 'CWE-1321',
-            evidence: { file: path.basename(file), line: index + 1, code: line.trim() }
+            evidence: { file: path.basename(file), line: index + 1, code: line.trim() },
+            remediation: 'Avoid direct prototype modification. Use Object.defineProperty if necessary.'
           });
         }
 

package/core/remote-scanner.js

@@ -36,47 +36,54 @@ export async function scanRemoteTarget(targetUrl) {
       headers_analysis["Strict-Transport-Security"] = "Missing";
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-1`,
-        category: 'Hardening',
-        confidence: 'High',
-        severity: 'Medium',
-        description: `HSTS Header is missing. This lacks forced HTTPS enforcement for browsers that have already visited the site.`,
+        kind: 'header',
+        category: 'hardening',
+        confidence: 'high',
+        severity: 'medium',
+        title: 'HSTS Header Missing',
+        description: `HTTP Strict-Transport-Security (HSTS) header is missing. This prevents the browser from enforcing HTTPS-only connections for future visits.`,
         cwe: 'CWE-319',
         evidence: { 
           request: { headers: { ...response.request.headers } }, 
           response: { status: response.status, headers: response.headers },
           reason: 'Security header "Strict-Transport-Security" not found in server response.'
-        }
+        },
+        remediation: 'Implement the Strict-Transport-Security header with a long max-age (e.g., 31536000) and the includeSubDomains directive.'
       });
-    } else {
-      headers_analysis["Strict-Transport-Security"] = headers['strict-transport-security'];
     }
 
     if (!headers['content-security-policy']) {
       headers_analysis["Content-Security-Policy"] = "Missing";
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-2`,
-        category: 'Confirmed',
-        confidence: 'High',
-        severity: 'High',
+        kind: 'header',
+        category: 'confirmed',
+        confidence: 'high',
+        severity: 'high',
+        title: 'Content-Security-Policy Missing',
         description: `CSP header is missing. Without a strict Content-Security-Policy, the application is highly vulnerable to Cross-Site Scripting (XSS) and data injection attacks.`,
         cwe: 'CWE-1022',
         evidence: { 
           request: { headers: { ...response.request.headers } }, 
           response: { status: response.status, headers: response.headers },
           reason: 'Security header "Content-Security-Policy" not found in server response.'
-        }
+        },
+        remediation: 'Define a strict Content-Security-Policy to restrict source domains for scripts, styles, and other resources.'
       });
     } else {
       headers_analysis["Content-Security-Policy"] = headers['content-security-policy'];
       if (headers['content-security-policy'].includes("unsafe-inline")) {
         vulnerabilities.push({
           id: `REM-VULN-${Date.now()}-3`,
-          category: 'Confirmed',
-          confidence: 'High',
-          severity: 'High',
-          description: `Weak CSP detected: 'unsafe-inline' is allowed.`,
+          kind: 'header',
+          category: 'confirmed',
+          confidence: 'high',
+          severity: 'high',
+          title: 'Insecure CSP (unsafe-inline)',
+          description: `The Content-Security-Policy allows 'unsafe-inline' for scripts or styles, significantly weakening protection against XSS.`,
           cwe: 'CWE-16',
-          evidence: { finding: `policy: ${headers['content-security-policy']}` }
+          evidence: { finding: `policy: ${headers['content-security-policy']}` },
+          remediation: 'Refactor the application to avoid inline scripts and styles, then remove "unsafe-inline" from the CSP.'
         });
       }
     }
@@ -86,19 +93,20 @@ export async function scanRemoteTarget(targetUrl) {
       headers_analysis["X-Frame-Options"] = "Missing";
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-4`,
-        category: 'Hardening',
-        confidence: 'High',
-        severity: 'Low',
-        description: `Missing X-Frame-Options. Increases risk of Clickjacking.`,
+        kind: 'header',
+        category: 'hardening',
+        confidence: 'high',
+        severity: 'low',
+        title: 'X-Frame-Options Missing',
+        description: `Missing X-Frame-Options header. This allows the application to be embedded in an iframe on other domains, increasing Clickjacking risk.`,
         cwe: 'CWE-1021',
         evidence: { 
           request: { headers: { ...response.request.headers } }, 
           response: { status: response.status, headers: response.headers },
           reason: 'Security header "X-Frame-Options" not found. This allows the site to be embedded in iframes on third-party domains.'
-        }
+        },
+        remediation: 'Set the X-Frame-Options header to DENY or SAMEORIGIN.'
       });
-    } else {
-      headers_analysis["X-Frame-Options"] = headers['x-frame-options'];
     }
 
     // 4. Server Header Leak
@@ -106,27 +114,31 @@ export async function scanRemoteTarget(targetUrl) {
       headers_analysis["Server"] = headers['server'];
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-5`,
-        category: 'Informational',
-        confidence: 'High',
-        severity: 'Low',
-        description: `Server header leaks technology stack: ${headers['server']}`,
+        kind: 'tech',
+        category: 'informational',
+        confidence: 'high',
+        severity: 'low',
+        title: 'Server Header Disclosure',
+        description: `Server header leaks technology stack information: ${headers['server']}`,
         cwe: 'CWE-200',
-        evidence: { finding: `Server: ${headers['server']}` }
+        evidence: { finding: `Server: ${headers['server']}` },
+        remediation: 'Configure the web server to hide or spoof the "Server" header.'
       });
-    } else {
-      headers_analysis["Server"] = "Hidden (Good)";
     }
 
     // 5. X-Powered-By Leak
     if (headers['x-powered-by']) {
       vulnerabilities.push({
         id: `REM-VULN-${Date.now()}-6`,
-        category: 'Informational',
-        confidence: 'High',
-        severity: 'Low',
-        description: `X-Powered-By header leaks framework: ${headers['x-powered-by']}`,
+        kind: 'tech',
+        category: 'informational',
+        confidence: 'high',
+        severity: 'low',
+        title: 'X-Powered-By Disclosure',
+        description: `X-Powered-By header leaks framework information: ${headers['x-powered-by']}`,
         cwe: 'CWE-200',
-        evidence: { finding: `X-Powered-By: ${headers['x-powered-by']}` }
+        evidence: { finding: `X-Powered-By: ${headers['x-powered-by']}` },
+        remediation: 'Disable the X-Powered-By header in the application framework settings.'
       });
     }
 
@@ -175,6 +187,22 @@ export async function scanRemoteTarget(targetUrl) {
       });
     }
 
+    // --- TECHNOLOGY FINGERPRINTING (Update categories) ---
+    if (techStack.length > 0) {
+      vulnerabilities.push({
+        id: `REM-TECH-${Date.now()}`,
+        kind: 'tech',
+        category: 'informational',
+        confidence: 'high',
+        severity: 'info',
+        title: 'Technology Stack Identified',
+        description: `Fingerprinting identified the following technologies: ${techStack.join(', ')}`,
+        cwe: 'CWE-200',
+        evidence: { tech_stack: techStack },
+        remediation: 'Minimal tech disclosure is recommended to prevent targeted attacks.'
+      });
+    }
+
     // --- DEEP CRAWL: robots.txt, sitemap.xml, and JS files ---
     const robotsUrl = new URL('/robots.txt', targetUrl).href;
     try {
@@ -335,22 +363,28 @@ async function validateFuzzerFinding(path, response, url) {
     if (typeof data === 'string' && !data.trim().startsWith('<html')) {
       return {
         id: `REM-CONFIRMED-FILE-${Date.now()}`,
-        category: 'Confirmed',
-        confidence: 'High',
-        severity: 'Critical',
+        kind: 'content',
+        category: 'confirmed',
+        confidence: 'high',
+        severity: 'critical',
+        title: 'Sensitive File Exposed',
         description: `CRITICAL: Sensitive file exposed at ${url}. Contents contain raw configuration data.`,
         cwe: 'CWE-538',
-        evidence: { ...evidence, reason: 'Raw sensitive file content detected (Non-HTML response on sensitive path)' }
+        evidence: { ...evidence, reason: 'Raw sensitive file content detected (Non-HTML response on sensitive path)' },
+        remediation: 'Immediately remove the file from the web server and ensure sensitive files are not publicly accessible.'
       };
     } else {
       return {
         id: `REM-POTENTIAL-FILE-${Date.now()}`,
-        category: 'Informational',
-        confidence: 'Low',
-        severity: 'Info',
+        kind: 'path',
+        category: 'informational',
+        confidence: 'low',
+        severity: 'info',
+        title: 'Potential Sensitive Path Discovered',
         description: `Potential sensitive path found at ${url}, but returned HTML content. Likely a redirect or custom error page.`,
         cwe: 'CWE-200',
-        evidence: { ...evidence, reason: 'HTML response on sensitive file path' }
+        evidence: { ...evidence, reason: 'HTML response on sensitive file path' },
+        remediation: 'Verify if this path should be accessible and ensure no sensitive information is leaked through custom error pages.'
       };
     }
   }
@@ -361,36 +395,48 @@ async function validateFuzzerFinding(path, response, url) {
     if (typeof data === 'string' && /password|login/i.test(data)) {
       return {
         id: `REM-INFO-LOGIN-${Date.now()}`,
-        category: 'Informational',
-        confidence: 'High',
-        severity: 'Info',
-        description: `Admin login page discovered at ${url}. This is part of the attack surface.`,
+        kind: 'path',
+        category: 'informational',
+        confidence: 'high',
+        severity: 'info',
+        title: 'Admin Login Page Discovered',
+        description: `Admin login page discovered at ${url}.`,
         cwe: 'CWE-200',
-        evidence
+        evidence: { ...evidence, reason: '200 OK with login/password patterns detected in HTML.' },
+        remediation: 'Ensure the admin login page is protected by strong authentication and not easily discoverable if not necessary.'
       };
     }
     // If it's a 200 but not a login page, it could be an exposed panel
     return {
       id: `REM-PROBABLE-PANEL-${Date.now()}`,
-      category: 'Probable',
-      confidence: 'Medium',
-      severity: 'High',
-      description: `Potential exposed admin panel at ${url}. Manual verification required.`,
-      cwe: 'CWE-284', // Improper Access Control
-      evidence
+      kind: 'path',
+      category: 'probable',
+      confidence: 'low',
+      severity: 'medium',
+      title: 'Potential Admin Panel Exposure',
+      description: `Potential exposed admin panel or dashboard at ${url}. Manual verification required.`,
+      cwe: 'CWE-284',
+      evidence: { ...evidence, reason: '200 OK on admin-like path, but no explicit login form detected. Could be an unauthorized dashboard.' },
+      remediation: 'Restrict access to the admin panel using IP whitelisting or other access control mechanisms.'
     };
   }
 
-  // Rule 4: Treat 403 Forbidden as low-confidence informational
+  // Rule 4: Treat 403 Forbidden as low-confidence informational (Path Enumeration)
   if (status === 403) {
     return {
       id: `REM-INFO-FORBIDDEN-${Date.now()}`,
-      category: 'Informational',
-      confidence: 'Low',
-      severity: 'Info',
-      description: `Path exists but access is restricted (403 Forbidden): ${url}. This confirms the path's existence but does not prove exposure.`,
-      cwe: 'CWE-204', // Response Discrepancy (Path Enumeration)
-      evidence
+      kind: 'path',
+      category: 'informational',
+      confidence: 'medium',
+      severity: 'info',
+      title: 'Protected Path Discovered',
+      description: `Potential protected path discovered (403 Forbidden): ${url}. This confirms the path exists but access is restricted.`,
+      cwe: 'CWE-204',
+      evidence: { 
+        ...evidence, 
+        reason: 'Server returned 403 Forbidden. This confirms path existence but access control is active. No immediate exposure detected.' 
+      },
+      remediation: 'None required, but ensure that the 403 response does not leak information about the internal structure.'
     };
   }
 

package/core/scanner.js

@@ -48,39 +48,49 @@ export async function runScannerSteps(target, flags) {
     spinner.succeed(`[${i + 1}/${steps.length}] ${step.text}`);
   }
 
+  const scanData = {
+    schema_version: "1.0",
+    target: target,
+    scan_id: `OMEN-${Date.now()}`,
+    timestamp: new Date().toISOString(),
+    score: 100,
+    riskLevel: 'Low',
+    attack_surface: {
+      endpoints: attack_surface.endpoints || [],
+      parameters: attack_surface.parameters || [],
+      forms: attack_surface.forms || [],
+      tech_stack: attack_surface.tech_stack || []
+    },
+    vulnerabilities: allVulnerabilities
+  };
+
   // Calculate dynamic score based on confidence and severity
-  const baseScore = 100;
-  const penalties = allVulnerabilities.reduce((acc, v) => {
+  let penalties = scanData.vulnerabilities.reduce((acc, v) => {
     // Only penalize for Confirmed or Probable issues
-    if (v.category !== 'Confirmed' && v.category !== 'Probable') return acc;
+    if (v.category !== 'confirmed' && v.category !== 'probable') return acc;
 
     let severityWeight = 0;
-    if (v.severity === 'Critical') severityWeight = 25;
-    else if (v.severity === 'High') severityWeight = 15;
-    else if (v.severity === 'Medium') severityWeight = 10;
-    else if (v.severity === 'Low') severityWeight = 5;
+    if (v.severity === 'critical') severityWeight = 25;
+    else if (v.severity === 'high') severityWeight = 15;
+    else if (v.severity === 'medium') severityWeight = 10;
+    else if (v.severity === 'low') severityWeight = 5;
+
+    // Reduzir peso de achados baseados em caminhos (potential/enumeration)
+    if (v.kind === 'path' && v.category === 'probable') severityWeight *= 0.5;
 
     let confidenceMultiplier = 1;
-    if (v.confidence === 'Medium') confidenceMultiplier = 0.6;
-    if (v.confidence === 'Low') confidenceMultiplier = 0.3;
+    if (v.confidence === 'medium') confidenceMultiplier = 0.6;
+    if (v.confidence === 'low') confidenceMultiplier = 0.3;
 
     return acc + (severityWeight * confidenceMultiplier);
   }, 0);
   
-  const finalScore = Math.max(0, Math.round(baseScore - penalties));
-  let riskLevel = 'Low';
-  if (finalScore < 50) riskLevel = 'Critical';
-  else if (finalScore < 70) riskLevel = 'High';
-  else if (finalScore < 90) riskLevel = 'Medium';
+  scanData.score = Math.max(0, Math.round(100 - penalties));
 
-  return {
-    target,
-    scan_id: `OMEN-REQ-${Date.now()}`,
-    timestamp: new Date().toISOString(),
-    score: finalScore,
-    riskLevel: riskLevel,
-    attack_surface,
-    headers_analysis,
-    vulnerabilities: allVulnerabilities.length > 0 ? allVulnerabilities : [{ id: 'INFO', type: 'Clean', severity: 'Info', description: 'No immediate vulnerabilities detected in the surface scan.' }]
-  };
+  if (scanData.score < 40) scanData.riskLevel = 'Critical';
+  else if (scanData.score < 60) scanData.riskLevel = 'High';
+  else if (scanData.score < 80) scanData.riskLevel = 'Medium';
+  else scanData.riskLevel = 'Low';
+
+  return scanData;
 }

package/core/ui-server.js

@@ -20,10 +20,11 @@ export async function startUIServer() {
         return 'text-green-500';
       };
 
-      const getConfidenceClass = (confidence) => {
-        if (confidence === 'High') return 'text-green-400';
-        if (confidence === 'Medium') return 'text-yellow-400';
-        return 'text-red-400';
+      const getCategoryBadge = (category) => {
+        if (category === 'Confirmed') return 'bg-red-900/50 text-red-400 border-red-800';
+        if (category === 'Probable') return 'bg-orange-900/50 text-orange-400 border-orange-800';
+        if (category === 'Hardening') return 'bg-blue-900/50 text-blue-400 border-blue-800';
+        return 'bg-gray-800 text-gray-400 border-gray-700';
       };
 
       const html = `
@@ -32,61 +33,134 @@ export async function startUIServer() {
       <head>
           <meta charset="UTF-8">
           <meta name="viewport" content="width=device-width, initial-scale=1.0">
-          <title>OMEN SEC-CLI Dashboard</title>
+          <title>OMEN SEC-CLI Evidence Center</title>
           <script src="https://cdn.tailwindcss.com"></script>
+          <link href="https://fonts.googleapis.com/css2?family=JetBrains+Mono:wght@400;700&family=Inter:wght@400;600;800&display=swap" rel="stylesheet">
           <style>
               body { background-color: #0a0a0c; color: #e0e0e0; font-family: 'Inter', sans-serif; }
+              .mono { font-family: 'JetBrains Mono', monospace; }
               .card { background-color: #16161a; border: 1px solid #2d2d3a; }
-              .tab { cursor: pointer; padding: 10px 15px; border-bottom: 2px solid transparent; }
-              .tab.active { border-bottom: 2px solid #ef4444; color: #ef4444; }
-              .collapsible { cursor: pointer; }
-              .content { display: none; }
-              pre { background-color: #000; padding: 10px; border-radius: 5px; overflow-x: auto; }
+              .tab-btn { cursor: pointer; padding: 12px 24px; border-bottom: 2px solid transparent; transition: all 0.2s; font-weight: 600; }
+              .tab-btn:hover { background-color: #1f1f26; }
+              .tab-btn.active { border-bottom: 2px solid #ef4444; color: #ef4444; background-color: #1f1f26; }
+              .content-area { display: none; }
+              .content-area.active { display: block; }
+              pre { background-color: #000; padding: 15px; border-radius: 8px; border: 1px solid #333; overflow-x: auto; font-size: 0.85rem; }
+              .finding-row { transition: background-color 0.2s; }
+              .finding-row:hover { background-color: #1f1f26; }
+              .evidence-panel { display: none; }
           </style>
       </head>
       <body class="p-4 md:p-8">
           <div class="max-w-7xl mx-auto">
-              <header class="flex justify-between items-center mb-8 border-b border-gray-800 pb-4">
-                  <h1 class="text-3xl font-bold tracking-tighter text-red-500">OMEN <span class="text-white">EVIDENCE-CENTER</span></h1>
-                  <div class="text-right text-sm">
-                      <p class="text-gray-400">Scan ID: ${report.scan_id}</p>
-                      <p class="text-gray-400">${new Date(report.timestamp).toLocaleString()}</p>
+              <header class="flex justify-between items-end mb-10 border-b border-gray-800 pb-6">
+                  <div>
+                      <h1 class="text-4xl font-extrabold tracking-tighter text-red-500 mb-1">OMEN <span class="text-white">SEC-CLI</span></h1>
+                      <p class="text-gray-500 font-medium">Professional DevSecOps Audit Framework</p>
+                  </div>
+                  <div class="text-right text-sm font-medium text-gray-500">
+                      <p>Scan ID: <span class="text-gray-300 mono">${report.scan_id}</span></p>
+                      <p>Date: <span class="text-gray-300">${new Date(report.timestamp).toLocaleString()}</span></p>
                   </div>
               </header>
 
-              <!-- Tabs -->
-              <div class="flex border-b border-gray-700 mb-6">
-                  <div class="tab active" onclick="showTab('dashboard')">Dashboard</div>
-                  <div class="tab" onclick="showTab('findings')">Findings</div>
-                  <div class="tab" onclick="showTab('surface')">Attack Surface</div>
-                  <div class="tab" onclick="showTab('history')">History</div>
+              <!-- Navigation Tabs -->
+              <div class="flex border-b border-gray-800 mb-8 bg-[#111116] rounded-t-xl overflow-hidden">
+                  <div class="tab-btn active" data-target="dashboard">Dashboard</div>
+                  <div class="tab-btn" data-target="findings">Findings</div>
+                  <div class="tab-btn" data-target="surface">Attack Surface</div>
+                  <div class="tab-btn" data-target="history">History</div>
               </div>
 
               <!-- Dashboard Tab -->
-              <div id="dashboard" class="tab-content block">
-                  <div class="grid grid-cols-2 md:grid-cols-4 gap-4 mb-8">
-                      <div class="card p-4 rounded-lg"><h3 class="text-gray-400">Security Score</h3><p class="text-4xl font-bold ${getSeverityClass(report.riskLevel)}">${report.score}/100</p></div>
-                      <div class="card p-4 rounded-lg"><h3 class="text-gray-400">Risk Level</h3><p class="text-4xl font-bold ${getSeverityClass(report.riskLevel)}">${report.riskLevel}</p></div>
-                      <div class="card p-4 rounded-lg"><h3 class="text-gray-400">Confirmed</h3><p class="text-4xl font-bold">${report.vulnerabilities.filter(v => v.category === 'Confirmed').length}</p></div>
-                      <div class="card p-4 rounded-lg"><h3 class="text-gray-400">Probable</h3><p class="text-4xl font-bold">${report.vulnerabilities.filter(v => v.category === 'Probable').length}</p></div>
+              <div id="dashboard" class="content-area active">
+                  <div class="grid grid-cols-1 md:grid-cols-4 gap-6 mb-10">
+                      <div class="card p-6 rounded-xl shadow-2xl">
+                          <h3 class="text-gray-500 uppercase text-xs font-bold tracking-widest mb-2">Security Score</h3>
+                          <p class="text-5xl font-black ${getSeverityClass(report.riskLevel)}">${report.score || 0}/100</p>
+                      </div>
+                      <div class="card p-6 rounded-xl shadow-2xl">
+                          <h3 class="text-gray-500 uppercase text-xs font-bold tracking-widest mb-2">Risk Level</h3>
+                          <p class="text-5xl font-black ${getSeverityClass(report.riskLevel)}">${report.riskLevel || 'N/A'}</p>
+                      </div>
+                      <div class="card p-6 rounded-xl shadow-2xl">
+                          <h3 class="text-gray-500 uppercase text-xs font-bold tracking-widest mb-2">Confirmed Issues</h3>
+                          <p class="text-5xl font-black text-white">${(report.vulnerabilities || []).filter(v => v.category === 'confirmed').length}</p>
+                      </div>
+                      <div class="card p-6 rounded-xl shadow-2xl">
+                          <h3 class="text-gray-500 uppercase text-xs font-bold tracking-widest mb-2">Probable Issues</h3>
+                          <p class="text-5xl font-black text-white">${(report.vulnerabilities || []).filter(v => v.category === 'probable').length}</p>
+                      </div>
+                  </div>
+
+                  <div class="grid grid-cols-1 lg:grid-cols-2 gap-8">
+                      <div class="card p-6 rounded-xl">
+                          <h2 class="text-xl font-bold mb-6 flex items-center">
+                              <span class="w-2 h-2 bg-red-500 rounded-full mr-2"></span> Top Critical Findings
+                          </h2>
+                          <div class="space-y-4">
+                              ${(report.vulnerabilities || []).filter(v => v.severity === 'critical' || v.severity === 'high').slice(0, 5).map(v => `
+                                  <div class="p-4 bg-[#1c1c22] rounded-lg border border-gray-800">
+                                      <div class="flex justify-between items-start mb-2">
+                                          <span class="font-bold ${getSeverityClass(v.severity)} text-sm uppercase">${v.severity}</span>
+                                          <span class="px-2 py-0.5 rounded border text-[10px] uppercase font-bold ${getCategoryBadge(v.category)}">${v.category}</span>
+                                      </div>
+                                      <p class="text-sm font-medium text-gray-300">${v.title || v.description}</p>
+                                  </div>
+                              `).join('') || '<p class="text-gray-500 italic">No critical findings discovered.</p>'}
+                          </div>
+                      </div>
+                      <div class="card p-6 rounded-xl">
+                          <h2 class="text-xl font-bold mb-6 flex items-center">
+                              <span class="w-2 h-2 bg-blue-500 rounded-full mr-2"></span> Scan Intelligence
+                          </h2>
+                          <div class="space-y-4 text-sm">
+                              <div class="flex justify-between border-b border-gray-800 pb-2"> <span class="text-gray-500">Target URL</span> <span class="mono text-gray-300">${report.target || 'N/A'}</span> </div>
+                              <div class="flex justify-between border-b border-gray-800 pb-2"> <span class="text-gray-500">Tech Stack</span> <span class="text-gray-300">${(report.attack_surface?.tech_stack || []).join(', ') || 'N/A'}</span> </div>
+                              <div class="flex justify-between border-b border-gray-800 pb-2"> <span class="text-gray-500">Endpoints Discovered</span> <span class="text-gray-300">${(report.attack_surface?.endpoints || []).length}</span> </div>
+                              <div class="flex justify-between border-b border-gray-800 pb-2"> <span class="text-gray-500">Forms Detected</span> <span class="text-gray-300">${(report.attack_surface?.forms || []).length}</span> </div>
+                          </div>
+                      </div>
                   </div>
               </div>
 
               <!-- Findings Tab -->
-              <div id="findings" class="tab-content hidden">
-                  <div class="card p-4 rounded-lg">
-                      <h2 class="text-xl font-bold mb-4">Vulnerability Details</h2>
-                      <div class="space-y-3">
-                          ${report.vulnerabilities.map((v, i) => `
-                              <div>
-                                  <div class="collapsible flex justify-between items-center p-3 bg-gray-800 rounded-t-lg" onclick="toggleCollapse(${i})">
-                                      <span class="font-bold ${getSeverityClass(v.severity)}">${v.severity}</span>
-                                      <span class="flex-1 mx-4">${v.description}</span>
-                                      <span class="${getConfidenceClass(v.confidence)}">${v.confidence} Confidence</span>
+              <div id="findings" class="content-area">
+                  <div class="card rounded-xl overflow-hidden">
+                      <div class="p-6 border-b border-gray-800 flex justify-between items-center bg-[#111116]">
+                          <h2 class="text-xl font-bold">Vulnerability Evidence Catalog</h2>
+                          <div class="flex gap-2">
+                              <span class="text-xs font-bold text-gray-500 uppercase tracking-tighter">Click rows to expand evidence</span>
+                          </div>
+                      </div>
+                      <div class="divide-y divide-gray-800">
+                          ${(report.vulnerabilities || []).map((v, i) => `
+                              <div class="finding-row">
+                                  <div class="p-4 flex items-center cursor-pointer gap-4" onclick="toggleEvidence(${i})">
+                                      <div class="w-24 text-xs font-black uppercase ${getSeverityClass(v.severity)}">${v.severity}</div>
+                                      <div class="flex-1 text-sm font-semibold text-gray-300">${v.title || v.description}</div>
+                                      <div class="px-2 py-1 rounded border text-[10px] uppercase font-bold ${getCategoryBadge(v.category)}">${v.category}</div>
+                                      <div class="text-[10px] mono text-gray-600">${v.kind || 'N/A'}</div>
                                   </div>
-                                  <div id="content-${i}" class="content p-4 bg-gray-900 rounded-b-lg">
-                                      <h4 class="font-bold mb-2">Evidence</h4>
-                                      <pre>${JSON.stringify(v.evidence, null, 2)}</pre>
+                                  <div id="evidence-${i}" class="evidence-panel p-6 bg-black border-t border-gray-800">
+                                      <div class="grid grid-cols-1 md:grid-cols-2 gap-6">
+                                          <div>
+                                              <h4 class="text-xs font-bold uppercase text-gray-500 mb-3 tracking-widest">Discovery Evidence</h4>
+                                              <pre class="mono">${JSON.stringify(v.evidence || {}, null, 2)}</pre>
+                                          </div>
+                                          <div>
+                                              <h4 class="text-xs font-bold uppercase text-gray-500 mb-3 tracking-widest">Technical Details</h4>
+                                              <div class="space-y-3 text-sm">
+                                                  <p><span class="text-gray-500 font-bold uppercase text-[10px]">CWE:</span> <span class="text-blue-400 mono">${v.cwe || 'N/A'}</span></p>
+                                                  <p><span class="text-gray-500 font-bold uppercase text-[10px]">Confidence:</span> <span class="font-bold text-gray-300 uppercase">${v.confidence || 'N/A'}</span></p>
+                                                  <p><span class="text-gray-500 font-bold uppercase text-[10px]">Description:</span> <span class="text-gray-300">${v.description || 'N/A'}</span></p>
+                                                  <div class="mt-4 p-3 bg-blue-900/20 border border-blue-800 rounded">
+                                                      <h5 class="text-[10px] font-bold text-blue-400 uppercase mb-1">Remediation</h5>
+                                                      <p class="text-xs text-gray-300">${v.remediation || 'Consult OMEN AI Protocol for detailed fix.'}</p>
+                                                  </div>
+                                              </div>
+                                          </div>
+                                      </div>
                                   </div>
                               </div>
                           `).join('')}
@@ -95,36 +169,70 @@ export async function startUIServer() {
               </div>
 
               <!-- Attack Surface Tab -->
-              <div id="surface" class="tab-content hidden">
-                  <div class="grid grid-cols-1 md:grid-cols-2 gap-4">
-                      <div class="card p-4 rounded-lg"> <h3 class="font-bold mb-2">Tech Stack</h3> <pre>${Array.isArray(report.attack_surface.tech_stack) ? report.attack_surface.tech_stack.join('\n') : (report.attack_surface.tech_stack || '')}</pre> </div>
-                      <div class="card p-4 rounded-lg"> <h3 class="font-bold mb-2">Forms</h3> <pre>${JSON.stringify(report.attack_surface.forms || report.attack_surface.forms_detected || [], null, 2)}</pre> </div>
-                      <div class="card p-4 rounded-lg col-span-1 md:col-span-2"> <h3 class="font-bold mb-2">Discovered Links</h3> <pre class="max-h-96">${Array.isArray(report.attack_surface.endpoints) ? report.attack_surface.endpoints.join('\n') : (report.attack_surface.endpoints || report.attack_surface.endpoints_discovered || '')}</pre> </div>
+              <div id="surface" class="content-area">
+                  <div class="grid grid-cols-1 lg:grid-cols-3 gap-8">
+                      <div class="lg:col-span-2 space-y-8">
+                          <div class="card p-6 rounded-xl">
+                              <h3 class="text-xl font-bold mb-4">Discovered Assets</h3>
+                              <pre class="mono max-h-[600px]">${(report.attack_surface?.endpoints || []).join('\n') || 'No endpoints discovered.'}</pre>
+                          </div>
+                      </div>
+                      <div class="space-y-8">
+                          <div class="card p-6 rounded-xl">
+                              <h3 class="text-xl font-bold mb-4">Forms & Inputs</h3>
+                              <pre class="mono">${JSON.stringify(report.attack_surface?.forms || [], null, 2)}</pre>
+                          </div>
+                          <div class="card p-6 rounded-xl">
+                              <h3 class="text-xl font-bold mb-4">Tech Fingerprint</h3>
+                              <div class="flex flex-wrap gap-2">
+                                  ${(report.attack_surface?.tech_stack || []).map(t => `<span class="px-3 py-1 bg-gray-800 rounded-full text-xs font-bold text-blue-400 border border-gray-700">${t}</span>`).join('') || '<span class="text-gray-500 italic">No stack identified.</span>'}
+                              </div>
+                          </div>
+                      </div>
                   </div>
               </div>
 
               <!-- History Tab -->
-              <div id="history" class="tab-content hidden">
-                  <div class="card p-4 rounded-lg">
-                      <h2 class="text-xl font-bold mb-4">Scan History</h2>
-                      <p class="text-gray-400">Feature coming soon. Historical data is being saved in the .omen/history/ directory.</p>
+              <div id="history" class="content-area text-center py-20">
+                  <div class="card p-10 rounded-2xl max-w-lg mx-auto border-dashed border-gray-700 bg-transparent">
+                      <h2 class="text-2xl font-bold mb-4 text-gray-400">Scan Timeline</h2>
+                      <p class="text-gray-500 mb-6">OMEN is currently tracking your security posture. Historical data is being indexed in <code class="mono text-red-400 bg-red-950/30 px-2 py-1 rounded">.omen/history/</code></p>
+                      <div class="inline-block px-4 py-2 bg-gray-800 rounded-full text-xs font-bold uppercase tracking-widest text-gray-400">Feature arriving in v1.0.17</div>
                   </div>
               </div>
 
-              <footer class="text-center text-gray-600 mt-12 border-t border-gray-800 pt-4">
-                  <p>OMEN Security Framework - v1.0.14</p>
+              <footer class="text-center text-gray-600 mt-16 border-t border-gray-900 pt-8 mb-10">
+                  <p class="text-xs uppercase tracking-widest font-bold mb-2">OMEN Security Framework - v1.0.17</p>
+                  <p class="text-[10px] text-gray-700 italic">"The eye that never sleeps, the code that never fails."</p>
               </footer>
           </div>
+
           <script>
-              function showTab(tabName) {
-                  document.querySelectorAll('.tab-content').forEach(tab => tab.classList.add('hidden'));
-                  document.getElementById(tabName).classList.remove('hidden');
-                  document.querySelectorAll('.tab').forEach(tab => tab.classList.remove('active'));
-                  document.querySelector(`[onclick="showTab('${tabName}')"]`).classList.add('active');
-              }
-              function toggleCollapse(index) {
-                  const content = document.getElementById('content-' + index);
-                  content.style.display = content.style.display === 'block' ? 'none' : 'block';
+              // Robust Tab System
+              document.querySelectorAll('.tab-btn').forEach(btn => {
+                  btn.addEventListener('click', () => {
+                      const target = btn.getAttribute('data-target');
+                      
+                      // Update buttons
+                      document.querySelectorAll('.tab-btn').forEach(b => b.classList.remove('active'));
+                      btn.classList.add('active');
+                      
+                      // Update areas
+                      document.querySelectorAll('.content-area').forEach(area => {
+                          area.classList.remove('active');
+                          if (area.id === target) area.classList.add('active');
+                      });
+                  });
+              });
+
+              // Robust Evidence Toggle
+              function toggleEvidence(index) {
+                  const panel = document.getElementById('evidence-' + index);
+                  if (panel.style.display === 'block') {
+                      panel.style.display = 'none';
+                  } else {
+                      panel.style.display = 'block';
+                  }
               }
           </script>
       </body>
@@ -132,7 +240,13 @@ export async function startUIServer() {
       `;
       res.send(html);
     } catch (err) {
-      res.status(500).send(`<h1>Error loading report</h1><p>Please run a scan first to generate omen-report.json. Error: ${err.message}</p>`);
+      res.status(500).send(`
+        <body style="background:#0a0a0c; color:#ff4d4d; font-family:sans-serif; padding:50px; text-align:center;">
+            <h1>Dashboard Failed to Load</h1>
+            <p style="color:#888;">Error details: ${err.message}</p>
+            <p style="margin-top:20px;"><a href="/" style="color:#fff; text-decoration:none; border:1px solid #333; padding:10px 20px; rounded:5px;">Retry</a></p>
+        </body>
+      `);
     }
   });
 

package/package.json

@@ -1,7 +1,10 @@
 {
   "name": "omen-sec-cli",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "description": "OMEN — AI Security Engine",
+  "engines": {
+    "node": ">=20.0.0"
+  },
   "main": "bin/index.js",
   "type": "module",
   "bin": {

package/ui/banner.js

@@ -9,7 +9,7 @@ export function showBanner() {
  ╚██████╔╝██║ ╚═╝ ██║███████╗██║ ╚████║ 
  `));
   console.log(chalk.cyan.bold(' OMEN — AI Security Engine '));
-  console.log(chalk.gray(' Version: 1.0.14 \n'));
+  console.log(chalk.gray(' Version: 1.0.17 \n'));
 }
 
 export function showHelp() {