penthera 1.1.0 → 1.1.1

package/CHANGELOG.md

@@ -4,6 +4,52 @@ All notable changes to Penthera are documented here. Versioning follows [SemVer]
 
 ## [Unreleased]
 
+## [1.1.1] - 2026-08-16
+
+A correctness release. One of these was a live outage: if you are on 1.1.0,
+upgrade.
+
+### Fixed
+
+- **JS dependency scanning was silently dead.** The Retire.js vulnerability
+  database URL pointed at a fork that now returns 404, so every scan reported
+  "no vulnerable JS libraries" without ever running the check. It now reads from
+  upstream RetireJS with a mirror, validates the payload, and when no source is
+  reachable it says the check did not run instead of returning a clean result.
+  The probe is also excluded from coverage in that case, so a compliance report
+  cannot claim supply-chain evidence that was never collected
+- **Command injection in the machine audit.** Binary paths read from
+  attacker-writable plists were interpolated into a shell string, so a malicious
+  persistence entry could execute code inside the scanner. Paths are now argv
+  entries and signature checks use the exit status, failing closed
+- Two built-in templates fired on any single-page app with catch-all routing:
+  the `.env.local` matcher accepted a bare `=` (present in every HTML attribute)
+  and the Firebase one accepted any 200 without the word "error", so an
+  `index.html` served at those paths was reported as critical
+- Time-based SQL and command injection no longer report on a single slow
+  response. A candidate delay is re-sampled and only reported when the median
+  holds, which a garbage-collection pause or cold start does not survive
+- Community template regexes ran unbounded against whole response bodies. A
+  catastrophically-backtracking pattern would hang the scanner; patterns with
+  nested quantifiers are now refused and input is capped
+- Dedupe and baseline comparison used different keys that included severity, so
+  re-rating a finding reported it as one resolved plus one new. Both now share
+  the audit loop's fingerprint
+- A measure with nothing scanned and nothing attested was scored as a gap,
+  telling an entity that had not yet filled in the self-assessment that it had
+  failed. That state is now reported as not assessed
+- The XSS canary was a fixed, fingerprintable string; it is now randomised per
+  probe
+- XProtect staleness was computed and discarded; it is now reported
+
+### Changed
+
+- The Nuclei loader documents the subset it actually implements and reports per
+  template which unsupported features it needs, instead of letting a template
+  that cannot match look like a clean pass
+- Provenance (confidence, method, collection time) now travels into SARIF, and
+  the terminal marks findings a scanner cannot adjudicate
+
 ## [1.1.0] - 2026-08-16
 
 NIS2 / Cyberbeveiligingswet readiness work: a hardening pass over the
@@ -164,5 +210,6 @@ First production-ready release.
 - Initial CLI: URL, repo, and machine scan modes
 - Built-in templates, TLS, CORS, SARIF export
 
+[1.1.1]: https://github.com/danoszz/penthera/compare/v1.1.0...v1.1.1
 [1.1.0]: https://github.com/danoszz/penthera/compare/v1.0.0...v1.1.0
 [1.0.0]: https://github.com/danoszz/penthera/compare/v0.2.0...v1.0.0

package/README.md

@@ -4,7 +4,7 @@
 
 <br/><br/>
 
-![version](https://img.shields.io/badge/version-1.1.0-0000ed)
+[![npm](https://img.shields.io/npm/v/penthera?color=0000ed)](https://www.npmjs.com/package/penthera)
 ![node](https://img.shields.io/badge/node-%E2%89%A518-0000ed)
 ![license](https://img.shields.io/badge/license-MIT-0000ed)
 [![CI](https://github.com/danoszz/penthera/actions/workflows/ci.yml/badge.svg)](https://github.com/danoszz/penthera/actions/workflows/ci.yml)
@@ -43,6 +43,34 @@ background to use it.
 Penthera is for hardening systems you own. It is powerful, so please use it
 carefully. See [Ethical use](#ethical-use--authorization) and the [Disclaimer](#disclaimer).
 
+Shipping in the EU? Penthera also generates your
+[NIS2 readiness report, policy pack, incident-report drafts, SBOM, and prefilled
+customer security questionnaires](#compliance-nis2-and-the-cyberwetgeving).
+Offline, no accounts. Readiness tooling, not a certification.
+
+### What you get
+
+```
+  Findings
+
+  HIGH  IDOR/BOLA: GET /api/users/{user_id}
+         http://localhost:3000/api/users/1 → 200
+  HIGH  OAuth open redirect
+         http://localhost:3000/api/oauth/callback?redirect_uri=... → 302
+  MED   Missing Content-Security-Policy
+  MED   No login rate limiting detected
+         http://localhost:3000/api/login → 401
+  LOW   Missing X-Frame-Options
+  INFO  Missing Referrer-Policy
+
+  ──────────────────────────────────────────────────────────
+  2 high · 5 medium · 2 low · 2 info
+```
+
+Every finding carries a confidence label (`confirmed`, `likely`, `potential`,
+`needs-human-review`), so a heuristic never poses as a certainty. Reports come
+out as Markdown, JSON, and SARIF, with the fixes in priority order.
+
 ---
 
 ## Run it
@@ -68,6 +96,12 @@ Then talk to your agent:
 "Find hardcoded secrets in this repo before I push"
 ```
 
+**Or try it with no install at all:**
+
+```bash
+npx penthera https://your-app.example
+```
+
 Prefer the terminal? Run `penthera` with no arguments for a guided wizard.
 
 > The skill adds an authorization gate: it instructs your agent to refuse targets
@@ -139,11 +173,11 @@ auditor, or run in CI so a regression shows up before it ships.
 | Art. 21(2) measure | What Penthera does | Coverage |
 |--------------------|--------------------|----------|
 | **(a)** Risk analysis & information-security policy | Findings, severity, and baseline history feed your risk analysis | Evidence |
-| **(b)** Incident handling | Report scaffolding (on the roadmap) | Planned |
+| **(b)** Incident handling | `--incident` drafts the 24h / 72h / 1-month reports against your authority's required content | Partial |
 | **(c)** Business continuity, backup, crisis management | Organisational; outside a scanner's reach | Out of scope |
-| **(d)** Supply-chain security | Known-CVE checks on JS dependencies (Retire.js); leaked third-party credentials (secret scan) | Partial |
+| **(d)** Supply-chain security | Known-CVE checks on JS dependencies, leaked credentials, a CycloneDX SBOM (`--sbom`), and passive supplier rating (`--suppliers`) | Partial |
 | **(e)** Security in acquisition, development & maintenance; **vulnerability handling** | The core: black- + white-box scanning mapped to OWASP WSTG, SARIF → GitHub, baseline regression, scan-and-fix loop | **Strong** |
-| **(f)** Assessing the effectiveness of measures | Baseline diff + re-scan-to-verify is a repeatable effectiveness check | Partial |
+| **(f)** Assessing the effectiveness of measures | Baseline diff, re-scan-to-verify, and `--history` tracking of time-to-fix, ageing, and drift | Partial |
 | **(g)** Cyber hygiene & training | Remediation playbook + secure-defaults guidance (guidance, not a training programme) | Partial |
 | **(h)** Cryptography & encryption | TLS protocol/cipher/certificate audit, HSTS, cookie `Secure` (transport layer only) | Partial |
 | **(i)** HR security, **access control**, asset management | Access control tested: JWT, IDOR/BOLA, OAuth redirect, client-side-auth, trust-boundary mapping | Partial |
@@ -513,6 +547,11 @@ npm run pentest:mock     # offline tests against a local mock vuln API
 npm run mock-server      # start the mock API on port 8765
 ```
 
+See the [roadmap](ROADMAP.md) for what is next and what is deliberately not planned.
+
+See the [roadmap](ROADMAP.md) for what is next and what is deliberately not
+planned.
+
 See [CONTRIBUTING.md](CONTRIBUTING.md) for the project layout, how to add a probe
 or template, the test matrix, and the release and publishing checklist.
 

package/lib/compliance/readiness.js

@@ -53,7 +53,11 @@ function combine(scanS, attestS) {
   const known = [];
   if (scanS === "met" || scanS === "partial") known.push(scanS);
   if (["met", "partial", "gap"].includes(attestS)) known.push(attestS);
-  if (known.length === 0) return attestS === "na" ? "n/a" : "gap";
+  // Nothing measured and nothing attested is not a failure, it is an unknown.
+  // Reporting it as a gap told an entity that had simply not filled in the
+  // self-assessment that it had failed ten measures, which is both wrong and
+  // the opposite of proportionate.
+  if (known.length === 0) return attestS === "na" ? "n/a" : "not-assessed";
   if (known.includes("gap")) return "gap";
   if (known.includes("partial")) return "partial";
   return "met";
@@ -113,7 +117,7 @@ export function buildReadiness(scanResult, opts = {}) {
     };
   });
 
-  const summary = { met: 0, partial: 0, gap: 0, "n/a": 0 };
+  const summary = { met: 0, partial: 0, gap: 0, "not-assessed": 0, "n/a": 0 };
   for (const m of measures) summary[m.status] = (summary[m.status] || 0) + 1;
   const assessed = measures.filter((m) => m.basis.attestation !== "none" || m.basis.scan !== "none").length;
 
@@ -132,7 +136,13 @@ export function buildReadiness(scanResult, opts = {}) {
   };
 }
 
-const STATUS_LABEL = { met: "Met", partial: "Partial", gap: "Gap", "n/a": "N/A" };
+const STATUS_LABEL = {
+  met: "Met",
+  partial: "Partial",
+  gap: "Gap",
+  "not-assessed": "Not assessed",
+  "n/a": "N/A",
+};
 
 /** Render a readiness report as Markdown. */
 export function formatReadinessMarkdown(readiness) {
@@ -147,7 +157,9 @@ export function formatReadinessMarkdown(readiness) {
   L.push("");
 
   const s = readiness.summary;
-  L.push(`**Summary:** ${s.met} met · ${s.partial} partial · ${s.gap} gap · ${s["n/a"]} n/a, across ${readiness.totalMeasures} Article 21 measures.`);
+  L.push(`**Summary:** ${s.met} met · ${s.partial} partial · ${s.gap} gap · ${s["not-assessed"]} not assessed · ${s["n/a"]} n/a, across ${readiness.totalMeasures} Article 21 measures.`);
+  L.push("");
+  L.push("*Not assessed* means neither the scan nor your self-assessment covered that measure yet. It is an unknown, not a failure. Run the self-assessment to turn those into real answers.");
   L.push("");
   L.push("Status combines what Penthera measured (technical) with your self-assessment (organisational). *Proportionality applies: for a small entity, a short policy or process that genuinely exists counts.*");
   L.push("");

package/lib/injections.js

@@ -38,6 +38,50 @@ async function safeFetch(url, opts = {}) {
   }
 }
 
+// ── Timing-based detection helpers ───────────────────────────────────────
+
+const TIMING_DELAY_MS = 2500; // payload asks the backend to sleep ~3s
+const TIMING_FLOOR_MS = 3000;
+
+function median(nums) {
+  if (!nums.length) return 0;
+  const s = [...nums].sort((a, b) => a - b);
+  const mid = Math.floor(s.length / 2);
+  return s.length % 2 ? s[mid] : Math.round((s[mid - 1] + s[mid]) / 2);
+}
+
+/**
+ * Confirm a suspected time-based injection.
+ *
+ * A single slow response proves nothing: a GC pause, a cold serverless start,
+ * or ordinary network jitter all look identical to an injected sleep. So a
+ * candidate is re-sent a few times and only reported when the MEDIAN delay
+ * holds, which jitter does not survive.
+ *
+ * @param {function(): Promise<{elapsed:number}>} send - re-issues the request
+ * @param {number} baselineMs
+ * @param {number} samples
+ * @returns {Promise<{confirmed: boolean, medianMs: number, samples: number[]}>}
+ */
+export async function confirmTimingDelay(send, baselineMs, samples = 3) {
+  const timings = [];
+  for (let i = 0; i < samples; i++) {
+    const res = await send();
+    if (!res || !res.ok) return { confirmed: false, medianMs: 0, samples: timings };
+    timings.push(res.elapsed);
+    // Bail early if a repeat comes back fast; a real sleep is consistent.
+    if (res.elapsed < baselineMs + TIMING_DELAY_MS) {
+      return { confirmed: false, medianMs: median(timings), samples: timings };
+    }
+  }
+  const m = median(timings);
+  return {
+    confirmed: m > baselineMs + TIMING_DELAY_MS && m > TIMING_FLOOR_MS,
+    medianMs: m,
+    samples: timings,
+  };
+}
+
 // ── SQL Injection Detection ──────────────────────────────────────────────
 
 const SQLI_ERROR_PATTERNS = [
@@ -128,33 +172,41 @@ export async function probeSqli(baseUrl, path, opts = {}) {
   ];
 
   for (const { payload, db } of timingPayloads) {
-    let res;
-    if (method === "GET") {
-      const sep = path.includes("?") ? "&" : "?";
-      res = await safeFetch(`${baseUrl}${path}${sep}id=${encodeURIComponent(payload)}`, {
-        method,
-        timeout: 8_000,
-      });
-    } else {
-      res = await safeFetch(`${baseUrl}${path}`, {
+    const send = () => {
+      if (method === "GET") {
+        const sep = path.includes("?") ? "&" : "?";
+        return safeFetch(`${baseUrl}${path}${sep}id=${encodeURIComponent(payload)}`, {
+          method,
+          timeout: 8_000,
+        });
+      }
+      return safeFetch(`${baseUrl}${path}`, {
         method,
         headers: { "Content-Type": "application/json" },
         body: JSON.stringify({ id: payload }),
         timeout: 8_000,
       });
-    }
+    };
 
-    // If response took significantly longer than baseline, possible blind SQLi
-    if (res.elapsed > baseline.elapsed + 2500 && res.elapsed > 3000) {
-      findings.push({
-        severity: "high",
-        title: `Possible blind SQL injection (time-based, ${db})`,
-        description: `Payload: ${payload}, response took ${res.elapsed}ms vs baseline ${baseline.elapsed}ms`,
-        url: `${baseUrl}${path}`,
-        status: res.status,
-        category: "sqli",
-        source: "injection-probe",
-      });
+    const res = await send();
+    if (!res.ok) continue;
+
+    // A slow first response is only a candidate. Re-sample before reporting, so
+    // jitter and cold starts don't get published as a high-severity finding.
+    if (res.elapsed > baseline.elapsed + TIMING_DELAY_MS && res.elapsed > TIMING_FLOOR_MS) {
+      const check = await confirmTimingDelay(send, baseline.elapsed);
+      if (check.confirmed) {
+        findings.push({
+          severity: "high",
+          confidence: "likely", // inferred from timing, not proven output
+          title: `Possible blind SQL injection (time-based, ${db})`,
+          description: `Payload: ${payload}. Delay held across ${check.samples.length} repeats (median ${check.medianMs}ms vs baseline ${baseline.elapsed}ms).`,
+          url: `${baseUrl}${path}`,
+          status: res.status,
+          category: "sqli",
+          source: "injection-probe",
+        });
+      }
     }
   }
 
@@ -380,12 +432,13 @@ export async function probeCmdi(baseUrl, path, opts = {}) {
   });
 
   for (const { payload, timing, pattern } of CMDI_PAYLOADS) {
-    const res = await safeFetch(`${baseUrl}${path}`, {
+    const send = () => safeFetch(`${baseUrl}${path}`, {
       method,
       headers: { "Content-Type": "application/json" },
       body: method === "POST" ? JSON.stringify({ input: payload, cmd: payload, command: payload }) : undefined,
       timeout: timing ? 8_000 : INJECT_TIMEOUT,
     });
+    const res = await send();
 
     if (!res.ok) continue;
 
@@ -402,17 +455,22 @@ export async function probeCmdi(baseUrl, path, opts = {}) {
       return findings;
     }
 
-    if (timing && res.elapsed > baseline.elapsed + 2500 && res.elapsed > 3000) {
-      findings.push({
-        severity: "high",
-        title: "Possible OS command injection (time-based)",
-        description: `Payload "${payload}", ${res.elapsed}ms vs baseline ${baseline.elapsed}ms`,
-        url: `${baseUrl}${path}`,
-        status: res.status,
-        category: "cmdi",
-        source: "injection-probe",
-      });
-      return findings;
+    // Same rule as blind SQLi: one slow response is a candidate, not a finding.
+    if (timing && res.elapsed > baseline.elapsed + TIMING_DELAY_MS && res.elapsed > TIMING_FLOOR_MS) {
+      const check = await confirmTimingDelay(send, baseline.elapsed);
+      if (check.confirmed) {
+        findings.push({
+          severity: "high",
+          confidence: "likely", // inferred from timing, not proven output
+          title: "Possible OS command injection (time-based)",
+          description: `Payload "${payload}". Delay held across ${check.samples.length} repeats (median ${check.medianMs}ms vs baseline ${baseline.elapsed}ms).`,
+          url: `${baseUrl}${path}`,
+          status: res.status,
+          category: "cmdi",
+          source: "injection-probe",
+        });
+        return findings;
+      }
     }
   }
 
@@ -421,7 +479,17 @@ export async function probeCmdi(baseUrl, path, opts = {}) {
 
 // ── Context-Aware XSS (Dalfox-style) ────────────────────────────────────
 
-const CANARY = "pnth3r4xss";
+/**
+ * Per-probe reflection canary.
+ *
+ * A fixed string is trivially WAF-fingerprintable and can collide with content
+ * left behind by an earlier scan, so each run gets a fresh one. It stays
+ * alphanumeric and lowercase so no context (attribute, JS string, URL) mangles
+ * or encodes it on the way through.
+ */
+export function makeCanary() {
+  return "pnth" + Math.random().toString(36).slice(2, 10) + "xss";
+}
 
 /**
  * Reflected content is only executable as XSS when the browser renders the
@@ -445,6 +513,7 @@ export function isHtmlResponse(res) {
  */
 export async function probeXss(baseUrl, path, opts = {}) {
   const findings = [];
+  const CANARY = makeCanary();
   const inputParams = ["q", "search", "query", "name", "input", "text", "value", "msg", "error", "redirect", "url", "id"];
 
   for (const param of inputParams) {

package/lib/machine.js

@@ -35,6 +35,27 @@ function run(cmd, opts = {}) {
   }
 }
 
+/**
+ * Verify a binary's code signature. Returns true only when codesign exits 0.
+ *
+ * Uses execFileSync so the path is an argv entry: these paths are read from
+ * plists that any local process can write, and interpolating one into a shell
+ * string would hand a malicious persistence entry command execution inside the
+ * scanner. Anything other than a clean exit counts as unsigned.
+ */
+function verifySignature(program) {
+  try {
+    execFileSync("codesign", ["-v", "--", program], {
+      encoding: "utf-8",
+      timeout: 15_000,
+      stdio: ["pipe", "pipe", "pipe"],
+    });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 function runFile(file, args = [], opts = {}) {
   try {
     return execFileSync(file, args, {
@@ -140,12 +161,22 @@ function checkFileVault() {
 function checkXProtect() {
   const version = run("xprotect version 2>&1");
   const status = run("xprotect status 2>&1");
-  const upToDate = !status.includes("updates available");
+  // XProtect ships enabled on modern macOS, so its presence isn't interesting.
+  // Pending signature updates are: they mean known malware may go undetected.
+  const updatesPending = /updates available/i.test(status);
   return {
     name: "XProtect (Apple Malware Detection)",
     status: version || "unknown",
     detail: status,
-    finding: null, // XProtect is always on in modern macOS
+    finding: updatesPending
+      ? {
+          severity: "low",
+          title: "XProtect signature updates pending",
+          description: "macOS reports XProtect updates are available. Until they install, recently known malware may not be detected.",
+          category: "machine",
+          source: "machine-audit",
+        }
+      : null,
   };
 }
 
@@ -192,11 +223,14 @@ function checkPersistence() {
 
       const isKnown = KNOWN_PREFIXES.some((p) => label.toLowerCase().startsWith(p));
 
-      // Check code signature of the binary
+      // Check code signature of the binary.
+      // `program` comes from an attacker-writable plist, so it is passed as an
+      // argv entry, never interpolated into a shell string. Verification uses
+      // codesign's exit status rather than string-matching its output, so an
+      // unexpected message can't be read as "signed" (fail closed, not open).
       let signed = null;
       if (program !== "unknown" && existsSync(program)) {
-        const sigOut = run(`codesign -v "${program}" 2>&1`);
-        signed = sigOut === "" || sigOut.includes("valid on disk"); // empty = valid
+        signed = verifySignature(program);
       }
 
       items.push({

package/lib/nuclei-loader.js

@@ -2,12 +2,19 @@
  * Nuclei Community Template Loader
  *
  * Parses and executes community-authored Nuclei YAML templates.
- * Supports the most common Nuclei template features:
+ *
+ * This is a useful subset of Nuclei, not a reimplementation of it. Supported:
  *   - HTTP requests with method, path, headers, body
- *   - Matchers: status, word, regex, negative-word, negative-regex, dsl
- *   - Extractors: regex, json, kval
- *   - Variables and dynamic helpers ({{BaseURL}}, {{Hostname}}, {{rand_int}})
- *   - Multi-request templates with matchers-condition
+ *   - Matchers: status, word, regex, negative-word, negative-regex
+ *   - Extractors: regex, json
+ *   - Placeholders: {{BaseURL}}, {{Hostname}}, {{RootURL}}
+ *
+ * Not supported, and reported rather than silently ignored (see
+ * collectUnsupported): dsl matchers, kval extractors, dynamic helpers such as
+ * {{rand_int}}, payload/attack modes, workflows, and multi-request chaining.
+ * Only the first path or raw entry of a request block is executed. A template
+ * relying on any of these will not match, so the loader says so instead of
+ * letting it look like a clean result.
  *
  * Requires the `yaml` npm package (zero-dependency YAML parser).
  *
@@ -121,6 +128,9 @@ function parseTemplateFile(filePath, parse) {
       },
       variables: doc.variables || {},
       http: http.map(normalizeHttpBlock),
+      // Features this loader can't execute. Non-empty means the template will
+      // not match even if the target is vulnerable.
+      unsupported: collectUnsupported(doc),
       _source: filePath,
     };
   } catch {
@@ -128,6 +138,47 @@ function parseTemplateFile(filePath, parse) {
   }
 }
 
+/**
+ * Report the Nuclei features a template needs that this loader does not
+ * implement. A template using any of them silently fails to match, which reads
+ * like "no vulnerability found", so callers surface this instead.
+ *
+ * @returns {string[]} human-readable reasons, empty when fully supported
+ */
+export function collectUnsupported(template) {
+  const reasons = new Set();
+  const blocks = template?.http || template?.requests || [];
+
+  if (Array.isArray(blocks) && blocks.length > 1) {
+    reasons.add("multi-request chaining (only the first request runs)");
+  }
+
+  for (const block of Array.isArray(blocks) ? blocks : []) {
+    if (Array.isArray(block?.path) && block.path.length > 1) {
+      reasons.add("multiple paths (only the first is requested)");
+    }
+    if (Array.isArray(block?.raw) && block.raw.length > 1) {
+      reasons.add("multiple raw requests (only the first is sent)");
+    }
+    if (block?.payloads || block?.attack) reasons.add("payload/attack modes");
+    for (const m of block?.matchers || []) {
+      if (m?.type === "dsl") reasons.add("dsl matchers");
+      if (m?.part && !["body", "header", "all", "response"].includes(m.part)) {
+        reasons.add(`matcher part "${m.part}"`);
+      }
+    }
+    for (const e of block?.extractors || []) {
+      if (e?.type === "kval") reasons.add("kval extractors");
+    }
+  }
+
+  const asText = JSON.stringify(blocks || "");
+  if (/\{\{\s*rand_/.test(asText)) reasons.add("dynamic helpers ({{rand_*}})");
+  if (template?.workflows) reasons.add("workflows");
+
+  return [...reasons];
+}
+
 /**
  * Normalize an HTTP request block to our internal format.
  */

package/lib/retirejs.js

@@ -14,8 +14,13 @@
  *   https://raw.githubusercontent.com/nickvergessen/retire.js/master/repository/jsrepository.json
  */
 
-const DB_URL =
-  "https://raw.githubusercontent.com/nickvergessen/retire.js/master/repository/jsrepository.json";
+// Upstream RetireJS repository. This previously pointed at a personal fork that
+// now 404s, which made every scan silently report "no vulnerable libraries".
+// A vulnerability database that fails closed and quietly is worse than none.
+const DB_URLS = [
+  "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json",
+  "https://cdn.jsdelivr.net/gh/RetireJS/retire.js@master/repository/jsrepository.json",
+];
 const DB_CACHE_MS = 3600_000; // 1 hour
 
 let cachedDb = null;
@@ -38,16 +43,22 @@ async function safeFetch(url, timeout = 15_000) {
 async function loadDb() {
   if (cachedDb && Date.now() - cachedAt < DB_CACHE_MS) return cachedDb;
 
-  const res = await safeFetch(DB_URL);
-  if (!res || !res.ok) return null;
-
-  try {
-    cachedDb = await res.json();
-    cachedAt = Date.now();
-    return cachedDb;
-  } catch {
-    return null;
+  // Try each mirror in turn so one host being down doesn't disable the check.
+  for (const url of DB_URLS) {
+    const res = await safeFetch(url);
+    if (!res || !res.ok) continue;
+    try {
+      const db = await res.json();
+      if (db && typeof db === "object" && Object.keys(db).length > 0) {
+        cachedDb = db;
+        cachedAt = Date.now();
+        return cachedDb;
+      }
+    } catch {
+      // Malformed response from this mirror; try the next.
+    }
   }
+  return null;
 }
 
 // ── Version comparison ───────────────────────────────────────────────────
@@ -149,8 +160,21 @@ export async function scanJsLibraries(baseUrl, opts = {}) {
   progress("Fetching Retire.js vulnerability database...");
   const db = await loadDb();
   if (!db) {
-    return result; // Can't check without DB
+    // Never return a silent "no vulnerable libraries" when the check could not
+    // run. Say so, and tell the caller the probe did not really execute.
+    result.dbLoaded = false;
+    result.findings.push({
+      severity: "info",
+      title: "JS dependency check did not run",
+      description: "Could not load the Retire.js vulnerability database (offline, or every mirror unreachable). Known-CVE checks on client-side JavaScript were skipped for this scan; this is not a clean result.",
+      url: baseUrl,
+      category: "config",
+      source: "retirejs",
+      confidence: "confirmed",
+    });
+    return result;
   }
+  result.dbLoaded = true;
 
   // Fetch the target page HTML
   const res = await safeFetch(baseUrl, timeout);

package/lib/templates.js

@@ -85,6 +85,24 @@ export async function executeTemplate(baseUrl, template) {
 /**
  * Run a single matcher against response data.
  */
+// Community templates are untrusted input: they arrive as YAML from a directory
+// the user points us at, and their regexes run against whole response bodies.
+// A catastrophically-backtracking pattern would hang the scanner, so bound both
+// the input and the pattern. This is a mitigation, not an immunity proof: real
+// guarantees need a non-backtracking engine or a killable worker.
+const REGEX_INPUT_CAP = 256 * 1024; // 256 KB is far past any real matcher's needs
+const NESTED_QUANTIFIER = /(\([^)]*[+*][^)]*\)|\[[^\]]*\][^)]*)[+*]\s*[+*]|\((?:\?:)?[^)]*[+*]\)[+*]/;
+
+function safeRegexTest(pattern, target, flags = "") {
+  if (NESTED_QUANTIFIER.test(String(pattern))) return false; // refuse the shape that blows up
+  try {
+    const input = target.length > REGEX_INPUT_CAP ? target.slice(0, REGEX_INPUT_CAP) : target;
+    return new RegExp(pattern, flags).test(input);
+  } catch {
+    return false; // invalid pattern in a template must not abort the scan
+  }
+}
+
 function runMatcher(matcher, ctx) {
   const part = matcher.part || "body";
   const target = part === "header" ? ctx.headers : ctx.body;
@@ -103,7 +121,7 @@ function runMatcher(matcher, ctx) {
 
     case "regex": {
       const patterns = matcher.regex || [];
-      const check = (p) => new RegExp(p, matcher.flags || "").test(target);
+      const check = (p) => safeRegexTest(p, target, matcher.flags);
       return matcher.condition === "and"
         ? patterns.every(check)
         : patterns.some(check);
@@ -116,7 +134,7 @@ function runMatcher(matcher, ctx) {
 
     case "negative-regex": {
       const patterns = matcher.regex || [];
-      return patterns.every(p => !new RegExp(p).test(target));
+      return patterns.every(p => !safeRegexTest(p, target));
     }
 
     default:
@@ -134,7 +152,9 @@ function runExtractor(extractor, ctx) {
   switch (extractor.type) {
     case "regex": {
       for (const pattern of extractor.regex || []) {
-        const match = target.match(new RegExp(pattern));
+        if (NESTED_QUANTIFIER.test(String(pattern))) continue;
+        const capped = target.length > REGEX_INPUT_CAP ? target.slice(0, REGEX_INPUT_CAP) : target;
+        const match = capped.match(new RegExp(pattern));
         if (match) return match[extractor.group || 0];
       }
       return null;
@@ -182,7 +202,11 @@ export const BUILT_IN_TEMPLATES = [
       method: "GET", path: "/.env.local",
       matchers: [
         { type: "status", status: [200] },
-        { type: "word", words: ["="], condition: "or" },
+        // Must look like a dotenv file, not just any 200 containing "=".
+        // SPAs serve index.html for unknown paths, and HTML is full of "=",
+        // which made this fire critical on healthy sites.
+        { type: "regex", regex: ["(?m)^[A-Z][A-Z0-9_]{2,}="] },
+        { type: "negative-word", words: ["<html", "<!DOCTYPE", "<script"] },
       ],
       "matchers-condition": "and",
     }],
@@ -247,7 +271,10 @@ export const BUILT_IN_TEMPLATES = [
       method: "GET", path: "/.json",
       matchers: [
         { type: "status", status: [200] },
-        { type: "negative-word", words: ["Permission denied", "error"] },
+        // Require an actual JSON body. Without this an SPA's index.html served
+        // at /.json counted as an open Firebase database.
+        { type: "regex", regex: ["^\\s*[\\{\\[]"] },
+        { type: "negative-word", words: ["Permission denied", "error", "<html", "<!DOCTYPE"] },
       ],
       "matchers-condition": "and",
     }],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "penthera",
-  "version": "1.1.0",
+  "version": "1.1.1",
   "type": "module",
   "description": "Lightweight security scanner for web apps — scan URLs or repos from the CLI",
   "repository": {
@@ -12,8 +12,8 @@
     "url": "https://github.com/danoszz/penthera/issues"
   },
   "bin": {
-    "penthera": "./bin/penthera.js",
-    "penthera-scan": "./bin/scan.js"
+    "penthera": "bin/penthera.js",
+    "penthera-scan": "bin/scan.js"
   },
   "files": [
     "bin",

package/skills/penthera/SKILL.md

@@ -13,7 +13,7 @@ compatibility: Node.js 18+, network access to target, Penthera CLI (npm link or
 allowed-tools: "Bash(node:*) Bash(npm:*) Bash(penthera:*) Read Write Edit"
 metadata:
   author: danoszz
-  version: 1.1.0
+  version: 1.1.1
   category: security
 ---
 

package/src/cli/baseline.js

@@ -2,10 +2,13 @@
  * Compare scan findings against a previous JSON report.
  */
 import { readFileSync } from "node:fs";
+import { fingerprintFinding } from "../../lib/audit-loop.js";
 
-function findingKey(f) {
-  return `${f.severity}::${f.title}::${f.url || ""}::${f.source || ""}`;
-}
+// Shared with dedupe and the audit loop so one finding has one identity
+// everywhere. Deliberately excludes severity: a finding whose severity is
+// re-rated is the same finding, and keying on it made every re-rating show up
+// as one resolved plus one new.
+const findingKey = fingerprintFinding;
 
 export function compareWithBaseline(currentFindings, baselinePath) {
   let baseline;

package/src/cli/merge-results.js

@@ -3,6 +3,7 @@
  */
 import { enrichFindingsWithWstg } from "../../lib/owasp-wstg.js";
 import { stampProvenance } from "../../lib/provenance.js";
+import { fingerprintFinding } from "../../lib/audit-loop.js";
 
 export function mergeResults(results) {
   let merged;
@@ -63,7 +64,8 @@ function mergeEndpoints(results) {
 export function dedupeFindings(findings) {
   const seen = new Set();
   return findings.filter((f) => {
-    const key = `${f.severity}::${f.title}::${f.url || ""}::${f.source || ""}`;
+    // Same identity function as the baseline diff and the audit loop.
+    const key = fingerprintFinding(f);
     if (seen.has(key)) return false;
     seen.add(key);
     return true;

package/src/cli.js

@@ -453,7 +453,7 @@ export async function run() {
     if (!opts.quiet && !opts.json) {
       const s = merged.readiness.summary;
       process.stderr.write(
-        `  NIS2 readiness  ${s.met} met · ${s.partial} partial · ${s.gap} gap · ${s["n/a"]} n/a\n`,
+        `  NIS2 readiness  ${s.met} met · ${s.partial} partial · ${s.gap} gap · ${s["not-assessed"]} not assessed\n`,
       );
       process.stderr.write(`  Readiness report ${rdPath}\n`);
     }

package/src/reporter.js

@@ -319,7 +319,11 @@ export function printReport(result, opts = {}) {
     for (const f of sorted) {
       const colorFn = SEV_COLOR[f.severity] || c.dim;
       const label = SEV_LABEL[f.severity] || "    ";
-      w(`  ${colorFn(label)}  ${f.title}`);
+      // Flag the ones a scanner genuinely can't adjudicate, so nobody reads a
+      // heuristic as a confirmed break. Certainties stay unannotated.
+      const needsReview = f.confidence === "needs-human-review" || f.confidence === "potential";
+      const tag = needsReview ? c.dim(` [${f.confidence}]`) : "";
+      w(`  ${colorFn(label)}  ${f.title}${tag}`);
       if (f.url)  w(`  ${" ".repeat(6)} ${c.dim(f.url)}${f.status ? c.dim(` \u2192 ${f.status}`) : ""}`);
       if (f.description && opts.verbose) w(`  ${" ".repeat(6)} ${c.dim(f.description)}`);
     }
@@ -457,7 +461,12 @@ export function writeSarifReport(result, filePath) {
       }] : [],
       properties: {
         severity: f.severity,
+        // Provenance travels with the finding into GitHub code scanning, so a
+        // heuristic result stays labelled as one wherever it is consumed.
+        confidence: f.confidence,
         source: f.source,
+        method: f.method,
+        collectedAt: f.collected_at,
         url: f.url,
         httpStatus: f.status,
         wstg: f.wstg || resolveWstgTags(f),

package/src/scan-url.js

@@ -76,6 +76,8 @@ export async function scanUrl(rawTarget, opts = {}) {
   const startTime = Date.now();
 
   const local = isPrivateHost(target);
+  // Set false when the Retire.js database can't load, so we don't claim the probe ran.
+  let retireJsRan = false;
   const hostname = new URL(target).hostname;
   const isIpHost = /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname) || hostname.includes(":");
 
@@ -385,6 +387,9 @@ export async function scanUrl(rawTarget, opts = {}) {
     progress("Scanning for vulnerable JS libraries (Retire.js)...");
     try {
       const jsResult = await scanJsLibraries(target, { onPhase: progress });
+      // Only count the probe as run when its database actually loaded, so the
+      // WSTG and compliance coverage can't claim a check that was skipped.
+      retireJsRan = jsResult.dbLoaded !== false;
       if (jsResult.libraries.length > 0) {
         result.jsLibraries = jsResult.libraries;
       }
@@ -500,6 +505,22 @@ export async function scanUrl(rawTarget, opts = {}) {
         severity: ["critical", "high", "medium"],
       });
       progress(`Loaded ${templates.length} templates, scanning...`);
+      // Templates needing Nuclei features this loader doesn't implement won't
+      // match even against a vulnerable target. Say so rather than letting the
+      // silence read as a clean result.
+      const limited = templates.filter((t) => t.unsupported?.length);
+      if (limited.length > 0) {
+        const reasons = [...new Set(limited.flatMap((t) => t.unsupported))];
+        progress(`${limited.length} template(s) use unsupported features and cannot match: ${reasons.join("; ")}`);
+        result.findings.push({
+          severity: "info",
+          title: `${limited.length} community template(s) could not run fully`,
+          description: `These templates rely on Nuclei features Penthera does not implement (${reasons.join("; ")}), so they cannot produce a match. Their silence is not a clean result. Templates affected: ${limited.slice(0, 5).map((t) => t.id).join(", ")}${limited.length > 5 ? ", ..." : ""}.`,
+          category: "config",
+          source: "plugin-loader",
+          confidence: "confirmed",
+        });
+      }
       const pluginFindings = await runTemplateScan(target, templates, { onPhase: progress });
       result.findings.push(...pluginFindings);
     } catch (e) {
@@ -547,7 +568,7 @@ export async function scanUrl(rawTarget, opts = {}) {
     ...(result.tls ? ["tls"] : []),
     ...(result.fingerprint?.headers ? ["security-headers"] : []),
     ...(auth.bearer ? ["jwt"] : []),
-    ...(!opts.skipRetireJs ? ["retirejs"] : []),
+    ...(!opts.skipRetireJs && retireJsRan ? ["retirejs"] : []),
     ...(!opts.skipParamDiscovery && hadEndpoints ? ["param-discovery"] : []),
     ...(opts.recon && !local ? ["recon"] : []),
     ...(opts.deep && hadEndpoints ? ["sqli", "ssti", "ssrf", "xss", "cmdi", "open-redirect"] : []),