plexavo 0.2.4__tar.gz → 0.2.6__tar.gz

plexavo-0.2.6/PKG-INFO

@@ -0,0 +1,180 @@
+Metadata-Version: 2.4
+Name: plexavo
+Version: 0.2.6
+Summary: Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else.
+Author: Kavee
+License: AGPL-3.0-or-later
+Project-URL: Homepage, https://github.com/plexavo/Plexavo
+Project-URL: Issues, https://github.com/plexavo/Plexavo/issues
+Project-URL: Security, https://github.com/plexavo/Plexavo/blob/main/SECURITY.md
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
+Classifier: Topic :: Security
+Classifier: Environment :: Console
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3>=1.34
+Requires-Dist: python-dateutil>=2.9
+Requires-Dist: rich>=13.7
+Requires-Dist: jinja2>=3.1
+Requires-Dist: markupsafe>=2.1
+Requires-Dist: fpdf2>=2.8
+Provides-Extra: ai
+Requires-Dist: anthropic>=0.116; extra == "ai"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pypdf>=4.0; extra == "dev"
+Dynamic: license-file
+
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="assets/plexavo-logo-dark.png">
+    <img src="assets/plexavo-logo-light.png" alt="Plexavo" height="115">
+  </picture>
+</div>
+
+# Plexavo
+
+<div align="center">
+  <img src="assets/demo.gif" alt="Plexavo interactive scan demo" width="800">
+</div>
+
+Plexavo is an open-source cloud security tool that audits AWS accounts
+for real-world misconfigurations. It runs entirely with your own local
+AWS credentials, the same way you'd run `aws s3 ls`, so nothing about
+your account is ever handed to anyone else. Each scan produces a 0-100
+security score and a plain-English report: what's wrong, what an
+attacker would actually do with it, and the exact command to fix it.
+
+Detection is pure Python/boto3, never AI. Claude only rewrites
+already-found technical findings into something a non-security founder
+can read, and it's entirely optional. See [Cost](#cost).
+
+## What it checks
+
+31 checks across 6 categories, run against real AWS accounts:
+
+- **IAM**: privilege escalation paths, wildcard admin, cross-account
+  trust, root usage, dormant credentials
+- **Network**: security groups and RDS instances exposed to the
+  internet
+- **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
+  Block Public Access
+- **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
+- **Logging**: CloudTrail coverage and encryption, GuardDuty status
+- **Usage**: permissions granted but never used, roles nobody has
+  assumed in 90+ days
+
+See the `docs/*-TEST-MATRIX.md` files for exactly how each check was
+verified.
+
+## Installation
+
+Every path below installs Plexavo into its own isolated environment.
+
+### macOS & Linux
+
+```bash
+curl -LsSf https://astral.sh/uv/install.sh | sh   # skip if you have uv
+uv tool install plexavo
+```
+
+Prefer [pipx](https://pipx.pypa.io/)? `pipx install plexavo` works the
+same way.
+
+### Windows
+
+`uv`/`pipx` still work, but the launcher they put on your PATH is
+unsigned, and Windows Smart App Control blocks it. Run Plexavo through
+Python instead, two options:
+
+**Option 1, uv (recommended)**
+
+```powershell
+uv tool install plexavo
+Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
+if (!(Test-Path $PROFILE)) { New-Item -ItemType File -Path $PROFILE -Force }
+Add-Content $PROFILE 'function plexavo { & "$env:APPDATA\uv\tools\plexavo\Scripts\python.exe" -m plexavo @args }'
+```
+
+Open a new terminal. `plexavo` now works exactly like it does on
+macOS/Linux, routed through uv's signed Python instead of the blocked
+launcher.
+
+**Option 2, plain venv**
+
+```powershell
+py -m venv plexavo-venv
+.\plexavo-venv\Scripts\Activate.ps1
+python -m pip install plexavo
+python -m plexavo
+```
+
+Use `python -m` for everything here too. The venv's own `pip.exe` and
+`plexavo.exe` are unsigned as well, only `python.exe` is signed.
+
+### AI narration (optional)
+
+Want each finding rewritten as a full narrative? Install `"plexavo[ai]"`
+instead of `plexavo`, and set `ANTHROPIC_API_KEY`. See [Cost](#cost).
+
+## Using Plexavo
+
+Run it with no arguments and it walks you through everything: picking an
+AWS profile, choosing HTML or PDF, then scanning and showing your score
+with every finding.
+
+```bash
+plexavo             # macOS/Linux, and Windows Option 1
+python -m plexavo   # Windows Option 2
+```
+
+<div align="center">
+  <img src="assets/screenshot-cli.png" alt="Plexavo interactive CLI" width="700">
+</div>
+
+## The report
+
+Reports are generated as HTML, PDF, or both. Every finding gets a free,
+template-based fix by default, no key, no cost. Full AI-written
+narration is offered automatically only when an `ANTHROPIC_API_KEY` is
+detected, see [Cost](#cost).
+
+<div align="center">
+  <img src="assets/screenshot-report.png" alt="Plexavo HTML report" width="700">
+</div>
+
+Severity, confidence, and evidence are always shown as separate signals.
+A low-confidence Critical never reads the same as a high-confidence
+Medium.
+
+## Cost
+
+Detection and the free templates always cost nothing. Live AI only runs
+with `--explain`, using **your own** `ANTHROPIC_API_KEY` in **your own**
+Anthropic account. Plexavo never sees your key and never calls the API
+without it. A full scan with `--explain` typically costs a few cents.
+
+## Contributing
+
+```bash
+git clone https://github.com/plexavo/plexavo.git
+cd plexavo
+uv pip install -e .
+```
+
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
+new check.
+
+## Security
+
+Found a vulnerability in the tool itself, not a misconfiguration in your
+own AWS account (that's the tool working correctly)? See
+[`SECURITY.md`](SECURITY.md) for a private reporting path.
+
+## License
+
+AGPL-3.0, see [`LICENSE`](LICENSE). Use, run, and modify it freely. If
+you run a modified version as a hosted service, you're required to
+publish those modifications too.

plexavo-0.2.6/README.md

@@ -0,0 +1,151 @@
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="assets/plexavo-logo-dark.png">
+    <img src="assets/plexavo-logo-light.png" alt="Plexavo" height="115">
+  </picture>
+</div>
+
+# Plexavo
+
+<div align="center">
+  <img src="assets/demo.gif" alt="Plexavo interactive scan demo" width="800">
+</div>
+
+Plexavo is an open-source cloud security tool that audits AWS accounts
+for real-world misconfigurations. It runs entirely with your own local
+AWS credentials, the same way you'd run `aws s3 ls`, so nothing about
+your account is ever handed to anyone else. Each scan produces a 0-100
+security score and a plain-English report: what's wrong, what an
+attacker would actually do with it, and the exact command to fix it.
+
+Detection is pure Python/boto3, never AI. Claude only rewrites
+already-found technical findings into something a non-security founder
+can read, and it's entirely optional. See [Cost](#cost).
+
+## What it checks
+
+31 checks across 6 categories, run against real AWS accounts:
+
+- **IAM**: privilege escalation paths, wildcard admin, cross-account
+  trust, root usage, dormant credentials
+- **Network**: security groups and RDS instances exposed to the
+  internet
+- **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
+  Block Public Access
+- **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
+- **Logging**: CloudTrail coverage and encryption, GuardDuty status
+- **Usage**: permissions granted but never used, roles nobody has
+  assumed in 90+ days
+
+See the `docs/*-TEST-MATRIX.md` files for exactly how each check was
+verified.
+
+## Installation
+
+Every path below installs Plexavo into its own isolated environment.
+
+### macOS & Linux
+
+```bash
+curl -LsSf https://astral.sh/uv/install.sh | sh   # skip if you have uv
+uv tool install plexavo
+```
+
+Prefer [pipx](https://pipx.pypa.io/)? `pipx install plexavo` works the
+same way.
+
+### Windows
+
+`uv`/`pipx` still work, but the launcher they put on your PATH is
+unsigned, and Windows Smart App Control blocks it. Run Plexavo through
+Python instead, two options:
+
+**Option 1, uv (recommended)**
+
+```powershell
+uv tool install plexavo
+Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
+if (!(Test-Path $PROFILE)) { New-Item -ItemType File -Path $PROFILE -Force }
+Add-Content $PROFILE 'function plexavo { & "$env:APPDATA\uv\tools\plexavo\Scripts\python.exe" -m plexavo @args }'
+```
+
+Open a new terminal. `plexavo` now works exactly like it does on
+macOS/Linux, routed through uv's signed Python instead of the blocked
+launcher.
+
+**Option 2, plain venv**
+
+```powershell
+py -m venv plexavo-venv
+.\plexavo-venv\Scripts\Activate.ps1
+python -m pip install plexavo
+python -m plexavo
+```
+
+Use `python -m` for everything here too. The venv's own `pip.exe` and
+`plexavo.exe` are unsigned as well, only `python.exe` is signed.
+
+### AI narration (optional)
+
+Want each finding rewritten as a full narrative? Install `"plexavo[ai]"`
+instead of `plexavo`, and set `ANTHROPIC_API_KEY`. See [Cost](#cost).
+
+## Using Plexavo
+
+Run it with no arguments and it walks you through everything: picking an
+AWS profile, choosing HTML or PDF, then scanning and showing your score
+with every finding.
+
+```bash
+plexavo             # macOS/Linux, and Windows Option 1
+python -m plexavo   # Windows Option 2
+```
+
+<div align="center">
+  <img src="assets/screenshot-cli.png" alt="Plexavo interactive CLI" width="700">
+</div>
+
+## The report
+
+Reports are generated as HTML, PDF, or both. Every finding gets a free,
+template-based fix by default, no key, no cost. Full AI-written
+narration is offered automatically only when an `ANTHROPIC_API_KEY` is
+detected, see [Cost](#cost).
+
+<div align="center">
+  <img src="assets/screenshot-report.png" alt="Plexavo HTML report" width="700">
+</div>
+
+Severity, confidence, and evidence are always shown as separate signals.
+A low-confidence Critical never reads the same as a high-confidence
+Medium.
+
+## Cost
+
+Detection and the free templates always cost nothing. Live AI only runs
+with `--explain`, using **your own** `ANTHROPIC_API_KEY` in **your own**
+Anthropic account. Plexavo never sees your key and never calls the API
+without it. A full scan with `--explain` typically costs a few cents.
+
+## Contributing
+
+```bash
+git clone https://github.com/plexavo/plexavo.git
+cd plexavo
+uv pip install -e .
+```
+
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
+new check.
+
+## Security
+
+Found a vulnerability in the tool itself, not a misconfiguration in your
+own AWS account (that's the tool working correctly)? See
+[`SECURITY.md`](SECURITY.md) for a private reporting path.
+
+## License
+
+AGPL-3.0, see [`LICENSE`](LICENSE). Use, run, and modify it freely. If
+you run a modified version as a hosted service, you're required to
+publish those modifications too.

{plexavo-0.2.4 → plexavo-0.2.6}/plexavo/__init__.py

@@ -4,4 +4,4 @@ Runs entirely with your own local AWS credentials. Nothing is sent to
 anyone else. See README.md for usage, or `plexavo scan --help`.
 """
 
-__version__ = "0.2.4"
+__version__ = "0.2.6"

{plexavo-0.2.4 → plexavo-0.2.6}/plexavo/cli.py

@@ -83,7 +83,7 @@ def _build_parser() -> argparse.ArgumentParser:
                             "key. No key set, or a call fails for any reason? That finding falls back to raw "
                             "detail automatically, the scan never stops because of it. Off by default — without "
                             "it, findings still get free, no-API-key-needed remediation text wherever a template "
-                            "exists (10 common check types); --explain always uses live AI instead, for every "
+                            "exists (11 common check types); --explain always uses live AI instead, for every "
                             "finding, not just the non-templated ones.")
     scan.add_argument("--explain-limit", type=int, default=25,
                        help="Safety cap on how many findings get a live AI call when --explain is passed, in "

{plexavo-0.2.4 → plexavo-0.2.6}/plexavo/report/ai_narration.py

@@ -172,7 +172,7 @@ def _parse_sections(raw_text: str) -> tuple[str, str, str]:
 
 
 # ---------------------------------------------------------------------------
-# Templates for the 10 most common, narratively-generic check types.
+# Templates for the 11 most common, narratively-generic check types.
 # Every specific fact (resource names, chain targets) already lives in
 # the Finding's own fields, computed deterministically in Python — the
 # template just substitutes them into fixed prose matching the same
@@ -373,6 +373,31 @@ def _template_enc29(f: Finding) -> Explanation:
     )
 
 
+def _template_log25(f: Finding) -> Explanation:
+    return Explanation(
+        impact=(
+            "GuardDuty is not enabled in this region, so there is no automated threat detection watching the "
+            "account. GuardDuty continuously analyzes CloudTrail, VPC flow logs, and DNS logs for known-bad "
+            "signals — an access key suddenly used from a new country or a Tor exit node, an EC2 instance "
+            "calling a known crypto-mining or malware domain, someone running account-wide recon with calls "
+            "like iam:ListUsers, ec2:DescribeInstances, and s3:ListAllMyBuckets in quick succession. With it "
+            "off, all of that happens with nothing raising an alert, so a compromise is usually only noticed "
+            "once it causes visible damage or a surprise bill."
+        ),
+        how_to_fix=(
+            "Enable GuardDuty in this region, then confirm the detector is active:\n"
+            "aws guardduty create-detector --enable\n"
+            "aws guardduty list-detectors\n"
+            "GuardDuty is per-region, so repeat this in every region you run workloads in, or enable it for "
+            "the whole organization from your AWS Organizations management account. It is free for the first "
+            "30 days, then billed on the volume of logs analyzed (typically a few dollars a month for a small "
+            "account)."
+        ),
+        next_step="Turn GuardDuty on in this region now: aws guardduty create-detector --enable",
+        source="template",
+    )
+
+
 COMMON_CHECK_TEMPLATES = {
     "IAM-01": _template_iam01,
     "IAM-06": _template_iam06,
@@ -384,18 +409,19 @@ COMMON_CHECK_TEMPLATES = {
     "NET-02": _template_net02,
     "STOR-19": _template_stor19,
     "ENC-29": _template_enc29,
+    "LOG-25": _template_log25,
 }
 
 
 def explain_finding(finding: Finding, client=None, use_ai: bool = False) -> Explanation | None:
     """use_ai=False (default): route to the free template (zero API cost,
-    zero network) for the 10 most common, narratively-generic check
+    zero network) for the 11 most common, narratively-generic check
     types; every other check returns None (raw finding detail only — no
     API call is ever attempted in this mode, regardless of whether a key
     is configured). This is the always-on baseline — no flag needed to
     get free remediation guidance where a template exists.
 
-    use_ai=True: every finding, including the 10 templated ones, is sent
+    use_ai=True: every finding, including the 11 templated ones, is sent
     to Claude instead — deliberately bypasses the template shortcut so
     "AI narration on" always means fully AI-written content, never a mix
     of template and AI.

plexavo-0.2.6/plexavo.egg-info/PKG-INFO

@@ -0,0 +1,180 @@
+Metadata-Version: 2.4
+Name: plexavo
+Version: 0.2.6
+Summary: Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else.
+Author: Kavee
+License: AGPL-3.0-or-later
+Project-URL: Homepage, https://github.com/plexavo/Plexavo
+Project-URL: Issues, https://github.com/plexavo/Plexavo/issues
+Project-URL: Security, https://github.com/plexavo/Plexavo/blob/main/SECURITY.md
+Classifier: Programming Language :: Python :: 3
+Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
+Classifier: Topic :: Security
+Classifier: Environment :: Console
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Requires-Dist: boto3>=1.34
+Requires-Dist: python-dateutil>=2.9
+Requires-Dist: rich>=13.7
+Requires-Dist: jinja2>=3.1
+Requires-Dist: markupsafe>=2.1
+Requires-Dist: fpdf2>=2.8
+Provides-Extra: ai
+Requires-Dist: anthropic>=0.116; extra == "ai"
+Provides-Extra: dev
+Requires-Dist: pytest>=8.0; extra == "dev"
+Requires-Dist: pypdf>=4.0; extra == "dev"
+Dynamic: license-file
+
+<div align="center">
+  <picture>
+    <source media="(prefers-color-scheme: dark)" srcset="assets/plexavo-logo-dark.png">
+    <img src="assets/plexavo-logo-light.png" alt="Plexavo" height="115">
+  </picture>
+</div>
+
+# Plexavo
+
+<div align="center">
+  <img src="assets/demo.gif" alt="Plexavo interactive scan demo" width="800">
+</div>
+
+Plexavo is an open-source cloud security tool that audits AWS accounts
+for real-world misconfigurations. It runs entirely with your own local
+AWS credentials, the same way you'd run `aws s3 ls`, so nothing about
+your account is ever handed to anyone else. Each scan produces a 0-100
+security score and a plain-English report: what's wrong, what an
+attacker would actually do with it, and the exact command to fix it.
+
+Detection is pure Python/boto3, never AI. Claude only rewrites
+already-found technical findings into something a non-security founder
+can read, and it's entirely optional. See [Cost](#cost).
+
+## What it checks
+
+31 checks across 6 categories, run against real AWS accounts:
+
+- **IAM**: privilege escalation paths, wildcard admin, cross-account
+  trust, root usage, dormant credentials
+- **Network**: security groups and RDS instances exposed to the
+  internet
+- **Storage**: public S3 buckets, via ACLs, bucket policies, or missing
+  Block Public Access
+- **Encryption**: unencrypted EBS volumes, RDS instances, S3 buckets
+- **Logging**: CloudTrail coverage and encryption, GuardDuty status
+- **Usage**: permissions granted but never used, roles nobody has
+  assumed in 90+ days
+
+See the `docs/*-TEST-MATRIX.md` files for exactly how each check was
+verified.
+
+## Installation
+
+Every path below installs Plexavo into its own isolated environment.
+
+### macOS & Linux
+
+```bash
+curl -LsSf https://astral.sh/uv/install.sh | sh   # skip if you have uv
+uv tool install plexavo
+```
+
+Prefer [pipx](https://pipx.pypa.io/)? `pipx install plexavo` works the
+same way.
+
+### Windows
+
+`uv`/`pipx` still work, but the launcher they put on your PATH is
+unsigned, and Windows Smart App Control blocks it. Run Plexavo through
+Python instead, two options:
+
+**Option 1, uv (recommended)**
+
+```powershell
+uv tool install plexavo
+Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
+if (!(Test-Path $PROFILE)) { New-Item -ItemType File -Path $PROFILE -Force }
+Add-Content $PROFILE 'function plexavo { & "$env:APPDATA\uv\tools\plexavo\Scripts\python.exe" -m plexavo @args }'
+```
+
+Open a new terminal. `plexavo` now works exactly like it does on
+macOS/Linux, routed through uv's signed Python instead of the blocked
+launcher.
+
+**Option 2, plain venv**
+
+```powershell
+py -m venv plexavo-venv
+.\plexavo-venv\Scripts\Activate.ps1
+python -m pip install plexavo
+python -m plexavo
+```
+
+Use `python -m` for everything here too. The venv's own `pip.exe` and
+`plexavo.exe` are unsigned as well, only `python.exe` is signed.
+
+### AI narration (optional)
+
+Want each finding rewritten as a full narrative? Install `"plexavo[ai]"`
+instead of `plexavo`, and set `ANTHROPIC_API_KEY`. See [Cost](#cost).
+
+## Using Plexavo
+
+Run it with no arguments and it walks you through everything: picking an
+AWS profile, choosing HTML or PDF, then scanning and showing your score
+with every finding.
+
+```bash
+plexavo             # macOS/Linux, and Windows Option 1
+python -m plexavo   # Windows Option 2
+```
+
+<div align="center">
+  <img src="assets/screenshot-cli.png" alt="Plexavo interactive CLI" width="700">
+</div>
+
+## The report
+
+Reports are generated as HTML, PDF, or both. Every finding gets a free,
+template-based fix by default, no key, no cost. Full AI-written
+narration is offered automatically only when an `ANTHROPIC_API_KEY` is
+detected, see [Cost](#cost).
+
+<div align="center">
+  <img src="assets/screenshot-report.png" alt="Plexavo HTML report" width="700">
+</div>
+
+Severity, confidence, and evidence are always shown as separate signals.
+A low-confidence Critical never reads the same as a high-confidence
+Medium.
+
+## Cost
+
+Detection and the free templates always cost nothing. Live AI only runs
+with `--explain`, using **your own** `ANTHROPIC_API_KEY` in **your own**
+Anthropic account. Plexavo never sees your key and never calls the API
+without it. A full scan with `--explain` typically costs a few cents.
+
+## Contributing
+
+```bash
+git clone https://github.com/plexavo/plexavo.git
+cd plexavo
+uv pip install -e .
+```
+
+See [`CONTRIBUTING.md`](CONTRIBUTING.md) for the pattern used to add a
+new check.
+
+## Security
+
+Found a vulnerability in the tool itself, not a misconfiguration in your
+own AWS account (that's the tool working correctly)? See
+[`SECURITY.md`](SECURITY.md) for a private reporting path.
+
+## License
+
+AGPL-3.0, see [`LICENSE`](LICENSE). Use, run, and modify it freely. If
+you run a modified version as a hosted service, you're required to
+publish those modifications too.

{plexavo-0.2.4 → plexavo-0.2.6}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "plexavo"
-version = "0.2.4"
+version = "0.2.6"
 description = "Open-source AWS misconfiguration scanner — runs with your own local AWS credentials, nothing sent to anyone else."
 readme = "README.md"
 license = { text = "AGPL-3.0-or-later" }

{plexavo-0.2.4 → plexavo-0.2.6}/tests/test_ai_narration_offline.py

@@ -73,7 +73,7 @@ assert_true(_short_name("arn:aws:iam::111111111111:role/my-role") == "my-role",
 assert_true(_short_name("arn:aws:s3:::my-bucket") == "my-bucket", "Extracts name after last : when no /")
 assert_true(_short_name("i-0abc123") == "i-0abc123", "Bare ID with no separators returned as-is")
 
-print("\n=== All 10 templates produce non-empty impact/next_step, with ZERO API contact ===")
+print("\n=== All 11 templates produce non-empty impact/next_step, with ZERO API contact ===")
 for check_id in COMMON_CHECK_TEMPLATES:
     finding = f(check_id)
     result = explain_finding(finding, client=ExplodingClient())
@@ -81,7 +81,19 @@ for check_id in COMMON_CHECK_TEMPLATES:
     assert_true(bool(result.impact.strip()), f"{check_id} impact is non-empty")
     assert_true(bool(result.how_to_fix.strip()), f"{check_id} how_to_fix is non-empty")
     assert_true(bool(result.next_step.strip()), f"{check_id} next_step is non-empty — this is new, every template must set it")
-assert_true(len(COMMON_CHECK_TEMPLATES) == 10, f"Exactly 10 templated checks exist (got {len(COMMON_CHECK_TEMPLATES)})")
+assert_true(len(COMMON_CHECK_TEMPLATES) == 11, f"Exactly 11 templated checks exist (got {len(COMMON_CHECK_TEMPLATES)})")
+
+print("\n=== LOG-25 (GuardDuty): account-level finding, template does not depend on a resource name ===")
+# LOG-25's real finding has resource_arn="account" — no per-resource
+# identifier to substitute, unlike bucket/volume/user templates. The
+# template must still produce complete, correct guidance.
+finding = f("LOG-25", resource_arn="account", raw_detail="GuardDuty is not enabled in this region.")
+result = explain_finding(finding, client=ExplodingClient())
+assert_true(result.source == "template", f"LOG-25 routes to template (got source={result.source})")
+assert_true("guardduty create-detector" in result.how_to_fix, "LOG-25 fix names the actual enable command")
+assert_true("guardduty create-detector" in result.next_step, "LOG-25 next_step names the actual enable command")
+assert_true("<PLACEHOLDER" not in result.how_to_fix and "<PLACEHOLDER" not in result.next_step,
+            "LOG-25 has no per-resource value to fill, so no placeholder should appear")
 
 print("\n=== Confidence/evidence are copied from the Finding, not decided by the template ===")
 finding = f("IAM-01", confidence="Likely — see note", evidence="Grant is scoped by a Condition block (aws:SourceIp)")