veritensor 1.6.3__tar.gz → 1.7.0__tar.gz

{veritensor-1.6.3/src/veritensor.egg-info → veritensor-1.7.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veritensor
-Version: 1.6.3
+Version: 1.7.0
 Summary: Antivirus for the AI Supply Chain. Scans models, datasets, notebooks, and RAG documents for threats.
 Author-email: Arsenii Brazhnyk <veritensor@gmail.com>
 License: Apache-2.0
@@ -27,6 +27,8 @@ Requires-Dist: requests>=2.31.0
 Requires-Dist: pyyaml>=6.0
 Requires-Dist: huggingface_hub>=0.19.0
 Requires-Dist: cyclonedx-python-lib>=6.0.0
+Requires-Dist: jinja2>=3.1.0
+Requires-Dist: pillow>=12.2.0
 Provides-Extra: test
 Requires-Dist: pytest>=7.0.0; extra == "test"
 Requires-Dist: pytest-mock>=3.10.0; extra == "test"
@@ -92,7 +94,7 @@ Unlike standard SAST tools (which focus on code), Veritensor understands the bin
 *   **De-obfuscation Engine:** Automatically detects and decodes **Base64** strings to uncover hidden payloads (e.g., `SWdub3Jl...` -> `Ignore previous instructions`).
 *   **Magic Number Validation:** Detects malware masquerading as safe files (e.g., an `.exe` renamed to `invoice.pdf`).
 *   **Smart Filtering & Entropy Analysis:** Drastically reduces false positives in Jupyter Notebooks. Uses Shannon Entropy to find real, unknown API keys (WandB, Pinecone, Telegram) while ignoring safe UUIDs and standard imports.
-
+*   **CISO-Ready HTML Reports:** Generate beautiful, standalone HTML security reports with interactive charts and severity breakdowns using the `--html` flag.
 ---
 
 ## 📦 Installation
@@ -175,6 +177,12 @@ Check code cells, markdown, and saved outputs for threats:
 veritensor scan ./research/experiment.ipynb
 ```
 
+### 10. Generate a CISO-Friendly HTML Report
+Create a standalone, interactive HTML dashboard of your scan results:
+```bash
+veritensor scan ./project --html
+```
+
 **Example Output:**
 ```Text
 ╭────────────────────────────────╮
@@ -296,17 +304,23 @@ with DAG('secure_rag_ingestion', start_date=datetime(2026, 1, 1)) as dag:
 
 Veritensor supports industry-standard formats for integration with security dashboards and audit tools.
 
-### 1. GitHub Security (SARIF)
+### 1. Interactive HTML Dashboard
+Generate a visually rich, standalone HTML report designed for CISOs and security audits. Includes severity breakdowns, charts, and easy copy-to-clipboard functionality for Jira tickets.
+```bash
+veritensor scan ./models --html
+```
+
+### 2. GitHub Security (SARIF)
 Generate a report compatible with GitHub Code Scanning:
 ```bash
 veritensor scan ./models --sarif > veritensor-report.sarif
 ```
-### 2. Software Bill of Materials (SBOM)
+### 3. Software Bill of Materials (SBOM)
 Generate a CycloneDX v1.5 SBOM to inventory your AI assets:
 ```bash
 veritensor scan ./models --sbom > sbom.json
 ```
-### 3. Raw JSON
+### 4. Raw JSON
 For custom parsers and SOAR automation:
 ```bash
 veritensor scan ./models --json
@@ -360,7 +374,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Veritensor Scan
-        uses: arsbr/Veritensor@v1.6.3 
+        uses: arsbr/Veritensor@v1.7.0 
         with:
           path: '.'
           jobs: '4'
@@ -371,7 +385,7 @@ Prevent committing malicious models to your repository. Add this to .pre-commit-
 ```yaml
 repos:
   - repo: https://github.com/arsbr/Veritensor
-    rev: v1.6.3
+    rev: v1.7.0
     hooks:
       - id: veritensor-scan
 ```
@@ -399,8 +413,8 @@ veritensor_audit:
 | **Datasets** | `.parquet`, `.csv`, `.tsv`, `.jsonl`, `.ndjson`, `.ldjson` | Streaming Regex Scan (URLs, Injections, PII) |
 | **Notebooks** | `.ipynb` | JSON Structure Analysis + Code AST + Markdown Phishing |
 | **Documents** | `.pdf`, `.docx`, `.pptx`, `.txt`, `.md`, `.html` | DOM Extraction, Stealth/CSS Detection, PII |
-| **Archives** | `.zip`, `.tar`, `.gz`, `.tgz`, `.whl` | Recursive In-Memory Inspection |
-| **RAG Docs** | `requirements.txt`, `poetry.lock`, `Pipfile.lock` | Typosquatting, OSV.dev CVE Lookup |
+| **Media & Archives** | `.png`, `.jpg`, `.zip`, `.tar`, `.gz`, `.whl` | EasyOCR, LSB Steganography, YARA (Enterprise) |
+| **Supply Chain** | `requirements.txt`, `pyproject.toml`, `poetry.lock`, `Pipfile.lock` | Typosquatting, OSV.dev CVE Lookup |
 
 ---
 

{veritensor-1.6.3 → veritensor-1.7.0}/README.md

@@ -34,7 +34,7 @@ Unlike standard SAST tools (which focus on code), Veritensor understands the bin
 *   **De-obfuscation Engine:** Automatically detects and decodes **Base64** strings to uncover hidden payloads (e.g., `SWdub3Jl...` -> `Ignore previous instructions`).
 *   **Magic Number Validation:** Detects malware masquerading as safe files (e.g., an `.exe` renamed to `invoice.pdf`).
 *   **Smart Filtering & Entropy Analysis:** Drastically reduces false positives in Jupyter Notebooks. Uses Shannon Entropy to find real, unknown API keys (WandB, Pinecone, Telegram) while ignoring safe UUIDs and standard imports.
-
+*   **CISO-Ready HTML Reports:** Generate beautiful, standalone HTML security reports with interactive charts and severity breakdowns using the `--html` flag.
 ---
 
 ## 📦 Installation
@@ -117,6 +117,12 @@ Check code cells, markdown, and saved outputs for threats:
 veritensor scan ./research/experiment.ipynb
 ```
 
+### 10. Generate a CISO-Friendly HTML Report
+Create a standalone, interactive HTML dashboard of your scan results:
+```bash
+veritensor scan ./project --html
+```
+
 **Example Output:**
 ```Text
 ╭────────────────────────────────╮
@@ -238,17 +244,23 @@ with DAG('secure_rag_ingestion', start_date=datetime(2026, 1, 1)) as dag:
 
 Veritensor supports industry-standard formats for integration with security dashboards and audit tools.
 
-### 1. GitHub Security (SARIF)
+### 1. Interactive HTML Dashboard
+Generate a visually rich, standalone HTML report designed for CISOs and security audits. Includes severity breakdowns, charts, and easy copy-to-clipboard functionality for Jira tickets.
+```bash
+veritensor scan ./models --html
+```
+
+### 2. GitHub Security (SARIF)
 Generate a report compatible with GitHub Code Scanning:
 ```bash
 veritensor scan ./models --sarif > veritensor-report.sarif
 ```
-### 2. Software Bill of Materials (SBOM)
+### 3. Software Bill of Materials (SBOM)
 Generate a CycloneDX v1.5 SBOM to inventory your AI assets:
 ```bash
 veritensor scan ./models --sbom > sbom.json
 ```
-### 3. Raw JSON
+### 4. Raw JSON
 For custom parsers and SOAR automation:
 ```bash
 veritensor scan ./models --json
@@ -302,7 +314,7 @@ jobs:
     steps:
       - uses: actions/checkout@v4
       - name: Veritensor Scan
-        uses: arsbr/Veritensor@v1.6.3 
+        uses: arsbr/Veritensor@v1.7.0 
         with:
           path: '.'
           jobs: '4'
@@ -313,7 +325,7 @@ Prevent committing malicious models to your repository. Add this to .pre-commit-
 ```yaml
 repos:
   - repo: https://github.com/arsbr/Veritensor
-    rev: v1.6.3
+    rev: v1.7.0
     hooks:
       - id: veritensor-scan
 ```
@@ -341,8 +353,8 @@ veritensor_audit:
 | **Datasets** | `.parquet`, `.csv`, `.tsv`, `.jsonl`, `.ndjson`, `.ldjson` | Streaming Regex Scan (URLs, Injections, PII) |
 | **Notebooks** | `.ipynb` | JSON Structure Analysis + Code AST + Markdown Phishing |
 | **Documents** | `.pdf`, `.docx`, `.pptx`, `.txt`, `.md`, `.html` | DOM Extraction, Stealth/CSS Detection, PII |
-| **Archives** | `.zip`, `.tar`, `.gz`, `.tgz`, `.whl` | Recursive In-Memory Inspection |
-| **RAG Docs** | `requirements.txt`, `poetry.lock`, `Pipfile.lock` | Typosquatting, OSV.dev CVE Lookup |
+| **Media & Archives** | `.png`, `.jpg`, `.zip`, `.tar`, `.gz`, `.whl` | EasyOCR, LSB Steganography, YARA (Enterprise) |
+| **Supply Chain** | `requirements.txt`, `pyproject.toml`, `poetry.lock`, `Pipfile.lock` | Typosquatting, OSV.dev CVE Lookup |
 
 ---
 

{veritensor-1.6.3 → veritensor-1.7.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "veritensor"
-version = "1.6.3"
+version = "1.7.0"
 description = "Antivirus for the AI Supply Chain. Scans models, datasets, notebooks, and RAG documents for threats."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -32,6 +32,8 @@ dependencies = [
     "pyyaml>=6.0",
     "huggingface_hub>=0.19.0",
     "cyclonedx-python-lib>=6.0.0",
+    "jinja2>=3.1.0",
+    "pillow>=12.2.0",
     # Fickling removed from here to avoid installing PyTorch (800MB+) for regular users
 ]
 

veritensor-1.7.0/src/veritensor/__init__.py

@@ -0,0 +1,2 @@
+__version__ = "1.7.0"
+

{veritensor-1.6.3 → veritensor-1.7.0}/src/veritensor/cli/main.py

@@ -36,16 +36,18 @@ from veritensor.engines.content.injection import scan_document, TEXT_EXTENSIONS,
 from veritensor.engines.static.notebook_engine import scan_notebook
 from veritensor.engines.data.dataset_engine import scan_dataset
 from veritensor.engines.static.dependency_engine import scan_dependencies
-from veritensor.engines.data.excel_engine import scan_excel # <--- NEW
-from veritensor.engines.container.archive_engine import scan_archive # <--- NEW
+from veritensor.engines.data.excel_engine import scan_excel 
+from veritensor.engines.container.archive_engine import scan_archive # 
 
 # Reporting
 from veritensor.reporting.telemetry import send_report
 from veritensor.reporting.sarif import generate_sarif_report
 from veritensor.reporting.sbom import generate_sbom
-from veritensor.reporting.manifest import generate_manifest # <--- NEW
+from veritensor.reporting.manifest import generate_manifest
+from veritensor.reporting.html_report import generate_html_report
 
 from veritensor.integrations.enterprise_scanner import EnterpriseScanner
+from veritensor.engines.static.mcp_scanner import scan_mcp_server
 
 # Robust import for rules
 try:
@@ -72,8 +74,8 @@ PICKLE_EXTS = {".pt", ".pth", ".bin", ".pkl", ".ckpt", ".whl"}
 KERAS_EXTS = {".h5", ".keras"}
 NOTEBOOK_EXTS = {".ipynb"}
 DATASET_EXTS = {".parquet", ".csv", ".jsonl", ".tsv", ".ndjson"}
-EXCEL_EXTS = {".xlsx", ".xlsm", ".xltx"} # <--- NEW
-ARCHIVE_EXTS = {".zip", ".tar", ".gz", ".tgz"} # <--- NEW
+EXCEL_EXTS = {".xlsx", ".xlsm", ".xltx"} 
+ARCHIVE_EXTS = {".zip", ".tar", ".gz", ".tgz", ".tar.gz"}
 DEP_FILES = {"requirements.txt", "pyproject.toml", "Pipfile", "poetry.lock", "Pipfile.lock"}
 ALL_DOC_EXTS = TEXT_EXTENSIONS.union(DOC_EXTS)
 CODE_EXTS = {".py",".js",".ts",".java",".c",".cpp",".cs",".go",".rs",".php",".rb",".swift",".kt",".m",".scala",".dart",".r",".jl",".hs",".clj",".ex",".exs",
@@ -89,6 +91,40 @@ NOISE_PATTERNS = [
     "Metadata parse error", "Suspicious script/XSS", "Suspicious link"
 ]
 
+# Formats that we want to check on the server (OCR, YARA, Macros)
+HEAVY_EXTS = {
+            # --- Images & Media (OCR, Steganography) ---
+            ".png", ".jpg", ".jpeg", ".tiff", ".bmp",
+
+            # --- Office & Documents (Macros, PDF parsing, RAG Security) ---
+            ".pdf", ".docx", ".pptx", ".xlsx", ".xlsm", ".xltx", ".docm",
+
+            # --- Archives (YARA, Zip Bomb protection) ---
+            ".zip", ".tar", ".gz", ".tgz", ".whl",
+
+            # --- AI Notebooks (AST, Secrets, Outputs) ---
+            ".ipynb",
+
+            # --- Datasets (Сэмплируются перед отправкой!) ---
+            ".parquet", ".csv", ".tsv", ".jsonl", ".ndjson",
+
+            # --- Text & Markup (DeBERTa Semantic Scan, GLiNER) ---
+            ".txt", ".md", ".markdown", ".rst", ".adoc", ".asciidoc",
+            ".tex", ".org", ".wiki", ".html", ".htm",
+
+            # --- Data & Configs (Secrets, PII) ---
+            ".json", ".xml", ".yaml", ".yml", ".toml", 
+            ".ini", ".cfg", ".conf", ".env", ".properties",
+
+            # --- Infrastructure & Logs (High risk of PII and Secret leaks) ---
+            ".tf", ".tfvars", ".k8s", ".helm", ".tpl",
+            ".log", ".out", ".err"
+        }
+
+        # Specific files that are sent to the server (name verification)
+HEAVY_FILES = {"dockerfile"}
+
+
 def load_ignore_patterns(ignore_file: str = ".veritensorignore") -> List[str]:
     """Loads glob patterns from .veritensorignore file."""
     patterns = []
@@ -102,11 +138,14 @@ def load_ignore_patterns(ignore_file: str = ".veritensorignore") -> List[str]:
     return patterns
 
 def is_ignored(file_path: Path, ignore_patterns: List[str]) -> bool:
-    # Checks if a file matches any of the ignore patterns (supports directory matching)
+    path_str = str(file_path)
     for pattern in ignore_patterns:
-        if file_path.match(pattern) or file_path.name == pattern:
+        if fnmatch.fnmatch(file_path.name, pattern):
             return True
-        if any(p.match(pattern) or p.name == pattern for p in file_path.parents):
+        if fnmatch.fnmatch(path_str, f"*/{pattern}") or fnmatch.fnmatch(path_str, f"*/{pattern}/*"):
+            return True
+        # Direct comparison with a part of the path
+        if any(part == pattern for part in file_path.parts):
             return True
     return False
 
@@ -122,7 +161,7 @@ def check_remote_cache(report_url: str, api_key: str, hashes: List[str], version
     
     cache_url = report_url.replace("/telemetry", "/cache/check")
     headers = {"X-API-Key": api_key}
-    payload = {"hashes": hashes, "scanner_version": __version__} # Added a version to the payload
+    payload = {"hashes": hashes, "scanner_version": version} # Added a version to the payload
     
     try:
         response = requests.post(cache_url, headers=headers, json=payload, timeout=5)
@@ -151,9 +190,14 @@ def fetch_server_policies(report_url: str, api_key: str) -> Tuple[Optional[dict]
     return None,[]
 
 def is_suppressed(file_path: str, threat_msg: str, suppressions: List[dict]) -> bool:
-    # Checks if there is a threat in the server exclusion list.
     for supp in suppressions:
-        if supp["file_path"] in file_path and supp["threat_type"] in threat_msg:
+        supp_path = supp.get("file_path", "")
+        supp_type = supp.get("threat_type", "")
+        # Require non-empty values and match by filename, not substring of full path
+        if not supp_path or not supp_type:
+            continue
+        file_name = Path(file_path).name
+        if file_name == supp_path and supp_type in threat_msg:
             return True
     return False
 
@@ -161,30 +205,28 @@ def is_suppressed(file_path: str, threat_msg: str, suppressions: List[dict]) ->
 def check_severity(threats: List[str], threshold: str) -> bool:
     threshold_val = SEVERITY_LEVELS.get(threshold.upper(), 4)
     for threat in threats:
-        parts = threat.split(":")
-        if len(parts) > 0:
-            level_str = parts[0].strip().upper()
-            level_val = SEVERITY_LEVELS.get(level_str, 3) 
-            if level_val >= threshold_val: return True
+        # Handle both "CRITICAL: ..." and "LINE 2: Semantic: CRITICAL: ..."
+        for part in threat.split(":"):
+            level_str = part.strip().upper()
+            level_val = SEVERITY_LEVELS.get(level_str, 0)
+            if level_val >= threshold_val:
+                return True
     return False
 
 # --- WORKER FUNCTION ---
-def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bool]) -> ScanResult:
+def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bool, Optional[str]]) -> ScanResult:
     file_path_str, config, repo, ignore_license, full_scan_dataset, is_s3, precalc_hash = args
 
     if is_s3:
         file_name = file_path_str.split("/")[-1]
-        # Using Path to extract ALL suffixes (e.g. .tar.gz )
-        ext = "".join(Path(file_name).suffixes).lower()
-        if not ext: 
-            ext = Path(file_name).suffix.lower()
         file_path = None 
     else:
         file_path = Path(file_path_str)
         file_name = file_path.name
-        ext = "".join(file_path.suffixes).lower()
-        if not ext: 
-            ext = file_path.suffix.lower()
+    # Take the full extension (for example, .tar.gz ) and fallback to normal    
+    ext = "".join(Path(file_name).suffixes).lower()
+    if ext not in ARCHIVE_EXTS and ext not in DATASET_EXTS:
+        ext = Path(file_name).suffix.lower()
     
     filename_lower = file_name.lower()
     scan_res = ScanResult(file_path=file_path_str)
@@ -193,20 +235,18 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
     # --- HYBRID ROUTING (Sending heavy files to the server) ---
     # If the user has an Enterprise server connected
     if config.report_url and config.api_key and not is_s3 and file_path:
-        # Formats that we want to check on the server (OCR, YARA, Macros)
-        HEAVY_EXTS = {'.png', '.jpg', '.jpeg', '.xlsm', '.docm', '.pdf'}
         
-        if ext in HEAVY_EXTS:
+        
+        # Check if the extension OR the exact file name matches (in lowercase)
+        if ext in HEAVY_EXTS or filename_lower in HEAVY_FILES:
             try:
                 scanner = EnterpriseScanner(config.report_url, config.api_key)
-                remote_threats = scanner.scan_file_remotely(file_path)
+                remote_threats = scanner.scan_file_remotely(file_path, full_scan=full_scan_dataset)
                 
                 if remote_threats:
                     for t in remote_threats: scan_res.add_threat(t)
                     
-                # If the file is checked on the server, we can skip the local checks.,
-                # to avoid doing double work (especially for PDF).
-                # We return the result immediately.
+                # Файл проверен на сервере (ML, OCR, YARA), пропускаем локальные проверки
                 return scan_res
             except Exception as e:
                 scan_res.add_threat(f"WARNING: Remote scan failed, falling back to local: {e}")
@@ -233,7 +273,7 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
     try:
         if ext in PICKLE_EXTS:
             with get_stream_for_path(file_path_str) as f:
-                threats = scan_pickle_stream(f, strict_mode=True)
+                threats = scan_pickle_stream(f, strict_mode=True, extra_allowed_modules=set(config.allowed_modules) if config.allowed_modules else None)
                 for t in threats: scan_res.add_threat(t)
         elif ext in KERAS_EXTS:
             if is_s3: scan_res.add_threat("WARNING: S3 scanning not supported for Keras yet.")
@@ -279,7 +319,11 @@ def scan_worker(args: Tuple[str, VeritensorConfig, Optional[str], bool, bool, bo
                     threats = scan_archive(file_path)
                     for t in threats: scan_res.add_threat(t)
         elif ext in CODE_EXTS:
-            pass
+            if ext == ".py" and file_path:
+                mcp_result = scan_mcp_server(file_path)
+                if mcp_result.mcp_tools_found:
+                    for t in mcp_result.to_threat_strings():
+                        scan_res.add_threat(t)
 
         else:
             # If the format is unknown to any engine at all.
@@ -354,11 +398,11 @@ def _run_scan_process(
     if jobs is None:
         try: jobs = multiprocessing.cpu_count()
         except NotImplementedError: jobs = 1
+    jobs = max(1, jobs)
     if len(files_to_scan) == 1: jobs = 1
 
     # 2. Prepare Tasks & Remote Cache Check
     tasks = []
-    files_to_hash =[]
     
     # First, we quickly calculate the hashes locally (using SQLite so as not to read the files again)
     local_hashes_map = {} # {filepath: hash}
@@ -389,12 +433,12 @@ def _run_scan_process(
     for f in files_to_scan:
         is_s3 = str(f).startswith("s3://")
         if is_s3:
-            tasks.append((str(f), config, repo, ignore_license, full_scan, True))
+            tasks.append((str(f), config, repo, ignore_license, full_scan, True, None))
             continue
             
         file_hash = local_hashes_map.get(str(f))
         
-        # Если сервер знает этот файл, мы НЕ добавляем его в tasks!
+        # If the server knows this file, we DON'T add it to tasks
         if file_hash and file_hash in remote_cache_results:
             remote_data = remote_cache_results[file_hash]
             res = ScanResult(file_path=str(f), status=remote_data["status"], file_hash=file_hash)
@@ -406,6 +450,9 @@ def _run_scan_process(
 
     # 3. Execute
     executor = None
+    if not tasks:
+        hash_cache.close()
+        return results
     try:
         with Progress(
             SpinnerColumn(), 
@@ -438,8 +485,11 @@ def _run_scan_process(
                     results.append(err_res)
                 progress.advance(main_task)
     finally:
-        if executor: executor.shutdown(wait=True)
-        hash_cache.close()
+        try:
+            if executor is not None:
+                executor.shutdown(wait=False, cancel_futures=True)
+        finally:
+            hash_cache.close()
         
     return results
 
@@ -458,25 +508,26 @@ def scan(
     report_to: Optional[str] = typer.Option(None, help="URL to send scan report (Enterprise)"),
     api_key: Optional[str] = typer.Option(None, envvar="VERITENSOR_API_KEY", help="API Key for reporting"),
     verbose: bool = typer.Option(False, "--verbose", "-v", help="Show detailed logs"),
+    html_output: bool = typer.Option(False, "--html", help="Generate a beautiful HTML report"),
+    output_file: Optional[str] = typer.Option(None, "--output-file", "-o", help="Save machine-readable output (JSON/SARIF/SBOM) to a file instead of stdout"),
 ):
     """
     Scans models, data, and code for security threats.
     """
     config = ConfigLoader.load()
     if verbose: logger.setLevel(logging.DEBUG)
-    is_machine_output = json_output or sarif_output or sbom_output
-
-    # Прокидываем флаги из консоли в глобальный объект config
+    is_machine_output = (json_output or sarif_output or sbom_output) and not output_file
+    
+    # Passing the flags from the console to the global config object
     config.report_url = report_to or config.report_url
     config.api_key = api_key or config.api_key
     
     # --- CENTRALIZED POLICY SYNC ---
     server_suppressions =[]
-    if report_to and api_key:
+    if config.report_url and config.api_key:
         if not is_machine_output:
             console.print("[dim]🔄 Syncing policies from Veritensor Control Plane...[/dim]")
-        
-        server_config_dict, server_suppressions = fetch_server_policies(report_to, api_key)
+        server_config_dict, server_suppressions = fetch_server_policies(config.report_url, config.api_key)
         
         # If the server has returned the config, we overwrite the local settings.
         if server_config_dict:
@@ -531,20 +582,43 @@ def scan(
                     clean_res = ScanResult(res.file_path, status="PASS")
                     filtered_results.append(clean_res)
             else:
-                # Оставляем только реальные угрозы для вывода
+                # Leave only real threats for withdrawal
                 res.threats = real_threats
                 filtered_results.append(res)
         else:
             filtered_results.append(res)
 
-    if sarif_output: print(generate_sarif_report(results))
-    elif sbom_output: print(generate_sbom(results))
+    if html_output:
+        report_path = generate_html_report(filtered_results)
+        if not is_machine_output:
+            console.print(f"\n[bold green]✅ HTML Report saved to: {report_path}[/bold green]")        
+
+    machine_text = None        
+    if sarif_output:
+        machine_text = generate_sarif_report(results)
+    elif sbom_output:
+        machine_text = generate_sbom(results)
     elif json_output:
-        results_dicts =[r.__dict__ for r in results]
-        print(json.dumps(results_dicts, indent=2))
+        results_dicts = [r.__dict__ for r in results]
+        machine_text = json.dumps(results_dicts, indent=2)
+
+
+    if machine_text:
+        if output_file:
+
+            with open(output_file, "w", encoding="utf-8") as f:
+                f.write(machine_text)
+            if not is_machine_output:
+                console.print(f"[bold green]✅ Report saved to: {output_file}[/bold green]")
+            if not is_machine_output:
+                _print_table(filtered_results)
+        else:
+            print(machine_text)
     else:
         _print_table(filtered_results)
 
+    
+    # Telemetry
     if report_to or config.report_url:
         if not is_machine_output: console.print(f"[dim]📡 Sending telemetry...[/dim]")
         send_report(results, config, override_url=report_to, override_key=api_key)
@@ -570,6 +644,15 @@ def scan(
             block_reasons.append("License")
             exit_code = 1
 
+    if not is_machine_output:
+        failing_files = [r for r in filtered_results if r.status == "FAIL"]
+        if failing_files and exit_code == 0:
+            console.print(
+                f"\n[yellow]ℹ️  {len(failing_files)} file(s) have findings below "
+                f"the blocking threshold ({config.fail_on_severity}). "
+                f"Lower the threshold in veritensor.yaml to block these.[/yellow]"
+            )
+
     if exit_code != 0:
         if not is_machine_output: console.print(f"\n[bold red]❌ BLOCKING DEPLOYMENT due to: {', '.join(block_reasons)}[/bold red]")
         raise typer.Exit(code=1)
@@ -602,6 +685,7 @@ def manifest(
 
     saved_path = generate_manifest(results, output)
     console.print(f"[green]✅ Manifest saved to: {saved_path}[/green]")
+
 def _print_table(results: List[ScanResult]):
     table = Table(title="🛡️ Veritensor Scan Report", header_style="bold magenta")
     table.add_column("File", style="cyan", no_wrap=True)
@@ -643,7 +727,7 @@ def keygen(output_prefix: str = "veritensor"):
 
 @app.command()
 def update():
-    SIG_URL = "https://raw.githubusercontent.com/ArseniiBrazhnyk/Veritensor/main/src/veritensor/engines/static/signatures.yaml"
+    SIG_URL = "https://raw.githubusercontent.com/arsbr/Veritensor/main/src/veritensor/engines/static/signatures.yaml"
     target_dir = Path.home() / ".veritensor"
     target_file = target_dir / "signatures.yaml"
     console.print(f"⬇️  Checking for updates...")

{veritensor-1.6.3 → veritensor-1.7.0}/src/veritensor/core/config.py

@@ -8,12 +8,13 @@
 
 import os
 import logging
-import yaml # Now a hard dependency
+import yaml 
 from pathlib import Path
 from dataclasses import dataclass, field
 from typing import List, Optional, Set
+from veritensor import __version__
 
-VERSION = "1.6.3"
+VERSION = __version__
 logger = logging.getLogger(__name__)
 DEFAULT_CONFIG_PATH = Path("veritensor.yaml")
 
@@ -21,7 +22,7 @@ DEFAULT_CONFIG_PATH = Path("veritensor.yaml")
 class VeritensorConfig:
     allowed_modules: List[str] = field(default_factory=list)
     ignored_rules: List[str] = field(default_factory=list)
-    fail_on_severity: str = "CRITICAL"
+    fail_on_severity: str = "CRITICAL" 
     hf_token: Optional[str] = None
     private_key_path: Optional[str] = None
     output_format: str = "table"
@@ -82,13 +83,14 @@ class ConfigLoader:
             private_key_path=config_data.get("private_key_path"),
             output_format=config_data.get("output_format", "table"),
             fail_on_missing_license=config_data.get("fail_on_missing_license", False),
-            custom_restricted_licenses=config_data.get("restricted_licenses", []),
+            custom_restricted_licenses=config_data.get("custom_restricted_licenses", []),
             allowed_models=config_data.get("allowed_models", []),
             report_url=config_data.get("report_url"),
             api_key=config_data.get("api_key")
         )
         return cls._instance
 
+
     @classmethod
     def get_safe_modules(cls) -> Set[str]:
         from veritensor.engines.static.pickle_engine import SAFE_MODULES as DEFAULT_SAFE

veritensor-1.7.0/src/veritensor/core/networking.py

@@ -0,0 +1,59 @@
+# Veritensor 2026 Apache 2.0
+import socket
+import ipaddress
+import logging
+from urllib.parse import urlparse
+from contextlib import contextmanager
+
+logger = logging.getLogger(__name__)
+
+_orig_getaddrinfo = socket.getaddrinfo
+
+@contextmanager
+def safe_dns_resolve(url: str):
+    """
+    A context manager for protection against SSRF and DNS Rebinding.
+    Resolves the IP, verifies its security, and accelerates usage 
+    this IP is at the socket level, while maintaining valid TLS/SNI.
+    """
+    parsed = urlparse(url)
+    hostname = parsed.hostname
+
+    if not hostname:
+        yield  # Local file or invalid URL
+        return
+
+    try:
+        ip_list = _orig_getaddrinfo(hostname, None)
+        safe_ip = None
+        
+        for item in ip_list:
+            ip_addr = item[4][0]
+            ip_obj = ipaddress.ip_address(ip_addr)
+            
+            if (ip_obj.is_private or ip_obj.is_loopback or 
+                ip_obj.is_link_local or ip_obj.is_multicast or 
+                ip_obj.is_reserved or ip_obj.is_unspecified): 
+                raise ValueError(f"SSRF Protection: Access to private IP {ip_addr} is forbidden.")
+            
+            if not safe_ip:
+                safe_ip = ip_addr
+
+        if not safe_ip:
+            raise ValueError(f"Could not resolve public IP for {hostname}")
+
+        # Перехватываем резолв DNS только для целевого хоста
+        def _safe_getaddrinfo(host, port, family=0, type=0, proto=0, flags=0):
+            if host == hostname:
+                return _orig_getaddrinfo(safe_ip, port, family, type, proto, flags)
+            return _orig_getaddrinfo(host, port, family, type, proto, flags)
+
+        socket.getaddrinfo = _safe_getaddrinfo
+        try:
+            yield
+        finally:
+            socket.getaddrinfo = _orig_getaddrinfo
+
+    except socket.gaierror:
+        logger.warning(f"Could not resolve hostname: {hostname}")
+        yield