phpwarden 2.3.0__tar.gz → 2.5.0__tar.gz

{phpwarden-2.3.0 → phpwarden-2.5.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: phpwarden
-Version: 2.3.0
-Summary: PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies.
+Version: 2.5.0
+Summary: PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS; blocks exploits inside PHP (shield). Offline, zero dependencies.
 Author: oroma-alfred
 License-Expression: Apache-2.0
 Project-URL: Homepage, https://phpwarden.io
 Project-URL: Source, https://github.com/oroma-alfred/phpwarden
 Project-URL: Issues, https://github.com/oroma-alfred/phpwarden/issues
-Keywords: php,composer,wordpress,php-fpm,security,vulnerability,cve,kev,epss,sca,scanner
+Keywords: php,composer,wordpress,php-fpm,security,vulnerability,cve,kev,epss,sca,sast,waf,scanner
 Classifier: Development Status :: 4 - Beta
 Classifier: Environment :: Console
 Classifier: Intended Audience :: System Administrators
@@ -28,8 +28,9 @@ exploited (CISA KEV, as of 2026-11-14). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
-It scans the PHP engine/FPM version, Composer dependencies and WordPress
-installs against one bundled, offline advisory feed. Zero runtime dependencies
+It scans the PHP engine/FPM version, Composer dependencies, WordPress installs
+and your own PHP code, checks live sites from outside, and can block exploits
+inside PHP, against one bundled, offline advisory feed. Zero runtime dependencies
 (Python 3.8+), Apache-2.0.
 
 **Reproducible benchmark:** on four real PHP stacks, phpwarden found 295 of 295
@@ -141,10 +142,44 @@ files / high or critical `code` and `probe` findings (`probe` also on any
 known-exploited finding) / anything to act on now or this week (`assess`),
 `2` possibly exposed (`scan`), `3` PHP version unknown (`scan`), `4` input
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
-error. Full table: `phpwarden --help`.
-
-
-## New in 2.3.0 and 2.2
+error. `1` also means `feed update` failed. Full table: `phpwarden --help`.
+
+
+## New in 2.5.0, 2.4.0, 2.3.0 and 2.2
+
+- **2.5.0: live check behind a login.** On a site that has proved ownership,
+  `probe --cookie` / `--cookie-file` / `--header` (or a saved test-account login
+  on the dashboard, one same-origin login POST) repeats a few read-only requests
+  signed in: on WordPress, `/wp-admin/` (version) and `plugins.php` (plugin
+  versions). Logout, delete and nonce URLs are never requested; credential values
+  are never printed or logged, are stored encrypted (AES-256-GCM) and are deleted
+  with the project. Use a low-privilege test account. [Docs](https://phpwarden.io/docs#probe-auth).
+- **2.5.0: PhpStorm plugin** in `integrations/phpstorm-plugin`, at parity with
+  the VS Code extension. Not on JetBrains Marketplace yet: build it and install
+  from disk.
+- **2.5.0: `phpwarden code` resolves table names fixed in the code** (constants,
+  `define()`, Laravel `config()`, Symfony parameters, concatenation, `$wpdb->prefix`
+  and core table properties, Eloquent `$table`), closing the dynamic-table-name
+  limit of 2.4.0. Benchmark results are unchanged.
+
+- **2.4.0: `phpwarden code` follows data through the database and callbacks.**
+  Request data saved with raw SQL, `$wpdb`, Eloquent, the query builder or
+  Doctrine and read back from the same table is traced to where it is printed
+  or queried (stored XSS, second-order SQL injection), and callbacks passed to
+  `array_map`, `usort`, `preg_replace_callback`, `add_filter` and the like,
+  `$f()` and first-class callables are followed. DVWA: 8/8/7 of 8 types under
+  the comparison's scorer (was 7/7/6); clean-code counts unchanged.
+- **2.4.0: shield rate limits.** Per-client limits on WordPress login, password
+  reset, xmlrpc and `system.multicall`, Laravel login and reset, component
+  writes, and a burst guard. Log-only until promoted, then 429; APCu or file
+  store; fails open. `--trust-proxy CIDR`, `--no-limits`, `--limit-path REGEX`.
+  0 trips on 6,000 ordinary requests; 6 of 6 abuse scenarios caught. Pairing
+  with Cloudflare or nginx: [EDGE.md](src/phpwarden/shield/EDGE.md).
+- **2.4.0: `phpwarden trivy-import` and `assess --trivy FILE` / `--run-trivy`.**
+  Trivy's JSON (npm/JS, OS packages, images, IaC, secrets) in the same ranked
+  list as PHP findings: KEV, then EPSS (`--kev`, `--epss`), then severity.
+  Secrets by file and line only. Never downloads Trivy. See
+  [src/phpwarden/thirdparty/README.md](src/phpwarden/thirdparty/README.md).
 
 - **`phpwarden probe URL`**: a live check of a running site using GET and HEAD
   requests only. It looks for exposed files (`.env`, `.git`, backups), open debug
@@ -158,14 +193,13 @@ error. Full table: `phpwarden --help`.
   includes, redirects and HTTP clients, with a trace per finding (SARIF
   `codeFlows`). Models Laravel, Symfony and WordPress: routes with no auth check,
   mass assignment, raw Blade/Twig output, IDOR hints, CSRF exclusions, nonces.
-  Follows data stored in the session or WordPress options (second-order).
-  89 rules. On the same pinned apps it found more than Semgrep and Psalm with far
+  Follows data stored in the session or WordPress options, and (2.4.0; names resolved in 2.5.0) data saved to database tables (second-order), matched by table name: literal names, constants, Laravel config / Symfony parameters, `$wpdb->prefix` + name, `$wpdb->posts` etc. and Eloquent `$table` are resolved; table names built from run-time data are not matched.
+  89 rules. In our published comparison (2026-11-15) it found more than Semgrep, Psalm and Snyk Code, with far
   fewer findings on clean framework code ([comparison](https://github.com/oroma-alfred/phpwarden/tree/main/bench/sast-compare-2026-11)).
-  Data that round-trips through the database is not followed.
 - **`phpwarden shield`**: one PHP file loaded before your app that blocks exploit
   attempts against the exploited vulnerabilities this site actually has, scoped
   to their entry points. Logs until you promote rules (7-day burn-in, explicit
-  flag), fails open, has a kill switch, about 0.07 ms per request. Not an edge
+  flag), fails open, has a kill switch, about 0.1 ms per request in our benchmark. Not an edge
   WAF: no DDoS, bot or TLS handling.
 - **`phpwarden assess`**: one ranked list from every view of a site: installed
   versions, your code, the live site from outside, and the access log, with the
@@ -180,9 +214,11 @@ error. Full table: `phpwarden --help`.
 - **Coverage commitment**: in-scope CISA KEV entries are in the maintained feed
   within 24 hours of listing, checked on every rebuild and published at
   https://phpwarden.io/feeds/kev-status.json. Details: https://phpwarden.io/sla
-- **Editors**: a VS Code extension in `integrations/vscode` (build and install
-  the `.vsix` from that folder; not on the Marketplace yet) and PhpStorm External Tool steps in
-  `integrations/phpstorm`.
+- **Editors**: a VS Code extension on the
+  [Marketplace](https://marketplace.visualstudio.com/items?itemName=phpwarden.phpwarden)
+  (`code --install-extension phpwarden.phpwarden`; source in `integrations/vscode`) and a PhpStorm plugin
+  in `integrations/phpstorm-plugin` (not on JetBrains Marketplace yet: build it and
+  use Install Plugin from Disk; External Tool steps in `integrations/phpstorm`).
 
 ## Replacing Wordfence CLI
 
@@ -248,7 +284,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: v2.3.0        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.5.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass
@@ -259,14 +295,14 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 ## The feed
 
-The bundled community feed (2026.11.13.3 in this release) works forever, offline:
+The bundled community feed (2026.11.14.2 in this release) works forever, offline:
 
 - **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
-  and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch
-  fixed versions, exposure conditions and detection signatures. About 19,700 carry an
-  EPSS score; 41 distinct vulnerabilities were in KEV when this feed was built.
+  and 146 PHP engine/FPM CVEs, including hand-curated entries with per-branch
+  fixed versions, exposure conditions and detection signatures. About 18,200 distinct vulnerabilities carry an
+  EPSS score; 54 distinct vulnerabilities were in KEV when this feed was built.
 - **License-independent by construction.** Every source is open or
   public-domain (OSV, NVD, FriendsOfPHP, php-src release notes, CISA KEV, FIRST EPSS). No commercial
   vendor's feed is used, so coverage cannot be revoked or priced away.

{phpwarden-2.3.0 → phpwarden-2.5.0}/README.md

@@ -6,8 +6,9 @@ exploited (CISA KEV, as of 2026-11-14). phpwarden puts those first, then sorts
 by EPSS probability, then CVSS — so a `composer.lock` with 30 findings tells
 you which one to fix today.
 
-It scans the PHP engine/FPM version, Composer dependencies and WordPress
-installs against one bundled, offline advisory feed. Zero runtime dependencies
+It scans the PHP engine/FPM version, Composer dependencies, WordPress installs
+and your own PHP code, checks live sites from outside, and can block exploits
+inside PHP, against one bundled, offline advisory feed. Zero runtime dependencies
 (Python 3.8+), Apache-2.0.
 
 **Reproducible benchmark:** on four real PHP stacks, phpwarden found 295 of 295
@@ -119,10 +120,44 @@ files / high or critical `code` and `probe` findings (`probe` also on any
 known-exploited finding) / anything to act on now or this week (`assess`),
 `2` possibly exposed (`scan`), `3` PHP version unknown (`scan`), `4` input
 error, `5` `--report-to` upload failed on an otherwise clean run, `64` usage
-error. Full table: `phpwarden --help`.
-
-
-## New in 2.3.0 and 2.2
+error. `1` also means `feed update` failed. Full table: `phpwarden --help`.
+
+
+## New in 2.5.0, 2.4.0, 2.3.0 and 2.2
+
+- **2.5.0: live check behind a login.** On a site that has proved ownership,
+  `probe --cookie` / `--cookie-file` / `--header` (or a saved test-account login
+  on the dashboard, one same-origin login POST) repeats a few read-only requests
+  signed in: on WordPress, `/wp-admin/` (version) and `plugins.php` (plugin
+  versions). Logout, delete and nonce URLs are never requested; credential values
+  are never printed or logged, are stored encrypted (AES-256-GCM) and are deleted
+  with the project. Use a low-privilege test account. [Docs](https://phpwarden.io/docs#probe-auth).
+- **2.5.0: PhpStorm plugin** in `integrations/phpstorm-plugin`, at parity with
+  the VS Code extension. Not on JetBrains Marketplace yet: build it and install
+  from disk.
+- **2.5.0: `phpwarden code` resolves table names fixed in the code** (constants,
+  `define()`, Laravel `config()`, Symfony parameters, concatenation, `$wpdb->prefix`
+  and core table properties, Eloquent `$table`), closing the dynamic-table-name
+  limit of 2.4.0. Benchmark results are unchanged.
+
+- **2.4.0: `phpwarden code` follows data through the database and callbacks.**
+  Request data saved with raw SQL, `$wpdb`, Eloquent, the query builder or
+  Doctrine and read back from the same table is traced to where it is printed
+  or queried (stored XSS, second-order SQL injection), and callbacks passed to
+  `array_map`, `usort`, `preg_replace_callback`, `add_filter` and the like,
+  `$f()` and first-class callables are followed. DVWA: 8/8/7 of 8 types under
+  the comparison's scorer (was 7/7/6); clean-code counts unchanged.
+- **2.4.0: shield rate limits.** Per-client limits on WordPress login, password
+  reset, xmlrpc and `system.multicall`, Laravel login and reset, component
+  writes, and a burst guard. Log-only until promoted, then 429; APCu or file
+  store; fails open. `--trust-proxy CIDR`, `--no-limits`, `--limit-path REGEX`.
+  0 trips on 6,000 ordinary requests; 6 of 6 abuse scenarios caught. Pairing
+  with Cloudflare or nginx: [EDGE.md](src/phpwarden/shield/EDGE.md).
+- **2.4.0: `phpwarden trivy-import` and `assess --trivy FILE` / `--run-trivy`.**
+  Trivy's JSON (npm/JS, OS packages, images, IaC, secrets) in the same ranked
+  list as PHP findings: KEV, then EPSS (`--kev`, `--epss`), then severity.
+  Secrets by file and line only. Never downloads Trivy. See
+  [src/phpwarden/thirdparty/README.md](src/phpwarden/thirdparty/README.md).
 
 - **`phpwarden probe URL`**: a live check of a running site using GET and HEAD
   requests only. It looks for exposed files (`.env`, `.git`, backups), open debug
@@ -136,14 +171,13 @@ error. Full table: `phpwarden --help`.
   includes, redirects and HTTP clients, with a trace per finding (SARIF
   `codeFlows`). Models Laravel, Symfony and WordPress: routes with no auth check,
   mass assignment, raw Blade/Twig output, IDOR hints, CSRF exclusions, nonces.
-  Follows data stored in the session or WordPress options (second-order).
-  89 rules. On the same pinned apps it found more than Semgrep and Psalm with far
+  Follows data stored in the session or WordPress options, and (2.4.0; names resolved in 2.5.0) data saved to database tables (second-order), matched by table name: literal names, constants, Laravel config / Symfony parameters, `$wpdb->prefix` + name, `$wpdb->posts` etc. and Eloquent `$table` are resolved; table names built from run-time data are not matched.
+  89 rules. In our published comparison (2026-11-15) it found more than Semgrep, Psalm and Snyk Code, with far
   fewer findings on clean framework code ([comparison](https://github.com/oroma-alfred/phpwarden/tree/main/bench/sast-compare-2026-11)).
-  Data that round-trips through the database is not followed.
 - **`phpwarden shield`**: one PHP file loaded before your app that blocks exploit
   attempts against the exploited vulnerabilities this site actually has, scoped
   to their entry points. Logs until you promote rules (7-day burn-in, explicit
-  flag), fails open, has a kill switch, about 0.07 ms per request. Not an edge
+  flag), fails open, has a kill switch, about 0.1 ms per request in our benchmark. Not an edge
   WAF: no DDoS, bot or TLS handling.
 - **`phpwarden assess`**: one ranked list from every view of a site: installed
   versions, your code, the live site from outside, and the access log, with the
@@ -158,9 +192,11 @@ error. Full table: `phpwarden --help`.
 - **Coverage commitment**: in-scope CISA KEV entries are in the maintained feed
   within 24 hours of listing, checked on every rebuild and published at
   https://phpwarden.io/feeds/kev-status.json. Details: https://phpwarden.io/sla
-- **Editors**: a VS Code extension in `integrations/vscode` (build and install
-  the `.vsix` from that folder; not on the Marketplace yet) and PhpStorm External Tool steps in
-  `integrations/phpstorm`.
+- **Editors**: a VS Code extension on the
+  [Marketplace](https://marketplace.visualstudio.com/items?itemName=phpwarden.phpwarden)
+  (`code --install-extension phpwarden.phpwarden`; source in `integrations/vscode`) and a PhpStorm plugin
+  in `integrations/phpstorm-plugin` (not on JetBrains Marketplace yet: build it and
+  use Install Plugin from Disk; External Tool steps in `integrations/phpstorm`).
 
 ## Replacing Wordfence CLI
 
@@ -226,7 +262,7 @@ see [phpwarden/laravel](https://packagist.org/packages/phpwarden/laravel).
 ```yaml
 repos:
   - repo: https://github.com/oroma-alfred/phpwarden
-    rev: v2.3.0        # pin to a tag with `pre-commit autoupdate`
+    rev: v2.5.0        # pin to a tag with `pre-commit autoupdate`
     hooks:
       - id: phpwarden-deps
         # args: ["--no-reachability"]   # faster: skip the reachability pass
@@ -237,14 +273,14 @@ timer recipes are in [`docs/recipes.md`](docs/recipes.md).
 
 ## The feed
 
-The bundled community feed (2026.11.13.3 in this release) works forever, offline:
+The bundled community feed (2026.11.14.2 in this release) works forever, offline:
 
 - **~21,300 advisories**: ~8,800 Composer (from [OSV.dev](https://osv.dev) and
   [FriendsOfPHP](https://github.com/FriendsOfPHP/security-advisories)),
   ~12,300 WordPress (from [NVD](https://nvd.nist.gov): plugin, core and theme),
-  and 145 PHP engine/FPM CVEs, including hand-curated entries with per-branch
-  fixed versions, exposure conditions and detection signatures. About 19,700 carry an
-  EPSS score; 41 distinct vulnerabilities were in KEV when this feed was built.
+  and 146 PHP engine/FPM CVEs, including hand-curated entries with per-branch
+  fixed versions, exposure conditions and detection signatures. About 18,200 distinct vulnerabilities carry an
+  EPSS score; 54 distinct vulnerabilities were in KEV when this feed was built.
 - **License-independent by construction.** Every source is open or
   public-domain (OSV, NVD, FriendsOfPHP, php-src release notes, CISA KEV, FIRST EPSS). No commercial
   vendor's feed is used, so coverage cannot be revoked or priced away.

{phpwarden-2.3.0 → phpwarden-2.5.0}/pyproject.toml

@@ -4,14 +4,14 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "phpwarden"
-version = "2.3.0"
-description = "PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS. Offline, zero dependencies."
+version = "2.5.0"
+description = "PHP vulnerability scanner for the PHP engine, Composer, WordPress, your own code and the live site. Ranked by real-world exploitation (CISA KEV, then EPSS), not CVSS; blocks exploits inside PHP (shield). Offline, zero dependencies."
 readme = "README.md"
 requires-python = ">=3.8"
 license = "Apache-2.0"
 license-files = ["LICENSE"]
 authors = [{ name = "oroma-alfred" }]
-keywords = ["php", "composer", "wordpress", "php-fpm", "security", "vulnerability", "cve", "kev", "epss", "sca", "scanner"]
+keywords = ["php", "composer", "wordpress", "php-fpm", "security", "vulnerability", "cve", "kev", "epss", "sca", "sast", "waf", "scanner"]
 classifiers = [
     "Development Status :: 4 - Beta",
     "Environment :: Console",
@@ -39,4 +39,4 @@ package-dir = { "" = "src" }
 where = ["src"]
 
 [tool.setuptools.package-data]
-phpwarden = ["data/*.json", "shield/agent/*.php"]
+phpwarden = ["data/*.json", "shield/agent/*.php", "shield/*.md"]

{phpwarden-2.3.0 → phpwarden-2.5.0}/src/phpwarden/__init__.py

@@ -6,4 +6,4 @@ real-world exploitation (CISA KEV, then EPSS, then CVSS), and can watch PHP-FPM
 for active exploitation. The engine and the bundled feed are open; free users
 get weekly feed updates, and a subscription adds the feed rebuilt twice a day.
 """
-__version__ = "2.3.0"
+__version__ = "2.5.0"

{phpwarden-2.3.0 → phpwarden-2.5.0}/src/phpwarden/cli.py

@@ -455,8 +455,32 @@ def _probe(args):
               f"  3. A tag in the homepage <head>:\n       <meta name=\"phpwarden-verify\" content=\"{token}\">\n\n"
               f"Without it, probe only reads the homepage response (passive mode).")
         return 0
+    auth = None
+    if args.cookie or args.cookie_file or args.header:
+        if args.passive:
+            sys.stderr.write("error: --cookie/--cookie-file need the active checks; drop --passive\n")
+            return 4
+        try:
+            raw = list(args.cookie or [])
+            if args.cookie_file:
+                with open(args.cookie_file, encoding="utf-8") as fh:
+                    raw.append(fh.read())
+            cookies = {}
+            for r in raw:
+                cookies.update(pr.parse_cookies(r))
+            headers = {}
+            for hv in args.header or []:
+                k, sep, v = hv.partition(":")
+                if not sep:
+                    raise ValueError("header must be 'Name: value'")
+                headers[k.strip()] = v.strip()
+            auth = pr.Auth(cookies=cookies, headers=headers)
+        except (OSError, ValueError) as e:     # messages never contain the cookie value
+            sys.stderr.write(f"error: could not read the cookie: {e.__class__.__name__}"
+                             f"{'' if isinstance(e, OSError) else ': ' + str(e)}\n")
+            return 4
     res = pr.run_probe(url, token=token, active=False if args.passive else None,
-                       max_requests=args.max_requests)
+                       max_requests=args.max_requests, auth=auth)
     if args.json:
         print(json.dumps(res, indent=2))
     elif _fmt(args) == "sarif":
@@ -546,8 +570,29 @@ def _assess(args):
         if any("homepage unreachable" in n for n in probe_result.get("notes", [])):
             sys.stderr.write(f"error: could not reach {url}\n")
             return 4
+    trivy_fs, trivy_note = None, None
+    if args.trivy or args.run_trivy:
+        from phpwarden.thirdparty import trivy as tv
+        try:
+            kev, epss = tv.load_kev(args.kev), tv.load_epss(args.epss)
+            docs = [tv.load_report(f) for f in (args.trivy or [])]
+        except (OSError, ValueError) as e:
+            sys.stderr.write(f"error: {e}\n")
+            return 4
+        if args.run_trivy and args.path:
+            doc, msg = tv.run_trivy_fs(args.path)
+            if doc is not None:
+                docs.append(doc)
+            else:
+                trivy_note = msg
+                sys.stderr.write(msg + "\n")
+        trivy_fs = [f for d in docs for f in tv.findings(d, kev, epss)]
+        if docs and not (args.kev or args.epss):
+            trivy_note = (trivy_note + "; " if trivy_note else "") + \
+                "non-PHP findings ranked by severity only (pass --kev and --epss for exploitation data)"
     try:
-        res = vd.assess(args.path, probe_result=probe_result, logfile=args.log, run_code=not args.no_code)
+        res = vd.assess(args.path, probe_result=probe_result, logfile=args.log, run_code=not args.no_code,
+                        trivy_findings=trivy_fs, trivy_note=trivy_note)
     except OSError as e:                      # unreadable access log
         sys.stderr.write(f"error: {e}\n")
         return 4
@@ -563,6 +608,31 @@ def _assess(args):
     return vd.exit_code(res)
 
 
+def _trivy_import(args):
+    from phpwarden.thirdparty import trivy as tv
+    try:
+        kev, epss = tv.load_kev(args.kev), tv.load_epss(args.epss)
+        fs = [f for p in args.files for f in tv.findings(tv.load_report(p), kev, epss)]
+    except (OSError, ValueError) as e:
+        sys.stderr.write(f"error: {e}\n")
+        return 4
+    doc = tv.to_report_doc(fs, args.files)
+    if args.json:
+        print(json.dumps(doc, indent=2))
+    else:
+        kev_n = sum(1 for f in fs if f["known_exploited"])
+        print(f"{len(fs)} finding(s) from {len(args.files)} Trivy report(s); {kev_n} known exploited. "
+              f"Ranked by exploitation{'' if (args.kev or args.epss) else ' (no --kev/--epss: by severity)'}:")
+        for f in fs[:50]:
+            tag = " [KEV]" if f["known_exploited"] else (f" [EPSS {f['epss'] * 100:.0f}%]" if f.get("epss") else "")
+            dev = " (dev)" if f["dev"] else ""
+            print(f"  {f['severity']:<8} {tv.ident(f)}{tag}{dev}  {f['title'][:90]}")
+        if len(fs) > 50:
+            print(f"  ... and {len(fs) - 50} more; use --json for all")
+    rc = 1 if any(f["known_exploited"] or f["severity"] in ("critical", "high") for f in fs) else 0
+    return _combine(rc, _maybe_report(args, doc))
+
+
 def _shield(args):
     from pathlib import Path as _P
     from phpwarden.shield import policy as sp, report as sr
@@ -572,7 +642,9 @@ def _shield(args):
             sys.stderr.write(f"error: not a directory: {args.path}\n")
             return 4
         pol = sp.build_policy_for_path(str(root), FeedManager().current(), php_version=args.php_version,
-                                       php_sapi=args.php_sapi, log_path=args.log)
+                                       php_sapi=args.php_sapi, log_path=args.log,
+                                       limits=not args.no_limits, limit_paths=args.limit_path or [],
+                                       trust_proxy=args.trust_proxy or [])
         out = args.out or "phpwarden-shield.policy.json"
         j, php = sp.write_policy(pol, out)
         if args.json:
@@ -754,6 +826,15 @@ def main(argv=None):
     _report_args(wpc)
     wpc.set_defaults(func=_wordpress)
 
+    tvi = sub.add_parser("trivy-import", help="read Trivy JSON reports (npm/JS, OS packages, images, IaC), "
+                                              "rank them by exploitation, optionally send them to the dashboard")
+    tvi.add_argument("files", nargs="+", metavar="TRIVY_JSON", help="output of trivy fs/image/config --format json")
+    tvi.add_argument("--kev", metavar="FILE", help="CISA KEV catalogue JSON")
+    tvi.add_argument("--epss", metavar="FILE", help="FIRST EPSS CSV (.csv or .csv.gz)")
+    tvi.add_argument("--json", action="store_true", help="machine-readable JSON output")
+    _report_args(tvi)
+    tvi.set_defaults(func=_trivy_import)
+
     sh = sub.add_parser("shield", help="protection inside PHP: block exploits of the vulnerabilities this site "
                                        "actually has (log-only until you promote rules)")
     shs = sh.add_subparsers(dest="shield_cmd", required=True, parser_class=_Parser)
@@ -763,6 +844,12 @@ def main(argv=None):
     shp.add_argument("--php-version", help="the production PHP version, for engine CVE rules")
     shp.add_argument("--php-sapi", choices=["fpm", "cgi", "cli"], help="the production SAPI")
     shp.add_argument("--log", help="where the agent should write its log (default: next to the agent)")
+    shp.add_argument("--no-limits", action="store_true",
+                     help="leave out the rate limits (login, password reset, xmlrpc, burst guard)")
+    shp.add_argument("--limit-path", action="append", metavar="REGEX",
+                     help="also rate-limit requests to this path (repeatable)")
+    shp.add_argument("--trust-proxy", action="append", metavar="CIDR",
+                     help="trust forwarded client IPs only from this proxy range, e.g. your CDN (repeatable)")
     shp.add_argument("--json", action="store_true", help="print the policy as JSON")
     shi = shs.add_parser("install", help="show how to load the agent (and copy it with --dest)")
     shi.add_argument("--dest", metavar="DIR", help="copy phpwarden-shield.php into this folder")
@@ -789,6 +876,12 @@ def main(argv=None):
     asx.add_argument("--baseline", metavar="FILE",
                      help="an earlier --out file: report what is fixed and verified, still open, and new")
     asx.add_argument("--json", action="store_true", help="machine-readable JSON output")
+    asx.add_argument("--trivy", metavar="FILE", action="append",
+                     help="add a Trivy JSON report (npm/JS, OS packages, images, IaC); repeatable")
+    asx.add_argument("--run-trivy", action="store_true",
+                     help="run `trivy fs` on the path if Trivy is installed (never downloads it)")
+    asx.add_argument("--kev", metavar="FILE", help="CISA KEV catalogue JSON, to rank non-PHP CVEs by exploitation")
+    asx.add_argument("--epss", metavar="FILE", help="FIRST EPSS CSV (.csv or .csv.gz) for non-PHP CVEs")
     asx.set_defaults(func=_assess)
 
     cd = sub.add_parser("code", help="scan your own PHP code for high-signal security bugs "
@@ -814,6 +907,14 @@ def main(argv=None):
                     help="show how to verify ownership of the site, then exit")
     pb.add_argument("--passive", action="store_true", help="read the homepage response only")
     pb.add_argument("--max-requests", type=int, default=60, help="request budget (default 60)")
+    pb.add_argument("--cookie", action="append", metavar="NAME=VALUE",
+                    help="session cookie for the signed-in check (repeatable; used only after ownership is "
+                         "verified, only on that site, GET/HEAD only; never printed). Use a low-privilege test account")
+    pb.add_argument("--cookie-file", metavar="FILE",
+                    help="read cookies from FILE (name=value lines or a Netscape cookies.txt); keeps them out of "
+                         "shell history")
+    pb.add_argument("--header", action="append", metavar="'NAME: VALUE'",
+                    help="extra header sent with the signed-in requests (repeatable; never printed)")
     pb.add_argument("--json", action="store_true", help="machine-readable JSON output")
     _format_arg(pb)
     pb.set_defaults(func=_probe)