wpsecscan 2.4.0__tar.gz → 2.6.0__tar.gz

{wpsecscan-2.4.0/wpsecscan.egg-info → wpsecscan-2.6.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wpsecscan
-Version: 2.4.0
+Version: 2.6.0
 Summary: Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only.
 Author-email: Bryan <bryaninbangkok@gmail.com>
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
@@ -693,6 +693,7 @@ Requires-Dist: httpx[http2]<0.29,>=0.27
 Requires-Dist: jinja2<4,>=3.1
 Requires-Dist: rich<14,>=13.7
 Requires-Dist: openpyxl<4,>=3.1
+Requires-Dist: keyring>=24
 Provides-Extra: pdf
 Requires-Dist: reportlab>=4.0; extra == "pdf"
 Provides-Extra: browser
@@ -705,6 +706,8 @@ Requires-Dist: bcrypt>=4.0; extra == "ops"
 Provides-Extra: ui
 Requires-Dist: Pillow>=10; extra == "ui"
 Requires-Dist: pystray>=0.19; extra == "ui"
+Provides-Extra: security
+Requires-Dist: defusedxml>=0.7; extra == "security"
 Provides-Extra: all
 Requires-Dist: reportlab>=4.0; extra == "all"
 Requires-Dist: playwright>=1.40; extra == "all"
@@ -713,6 +716,8 @@ Requires-Dist: redis>=5.0; extra == "all"
 Requires-Dist: bcrypt>=4.0; extra == "all"
 Requires-Dist: Pillow>=10; extra == "all"
 Requires-Dist: pystray>=0.19; extra == "all"
+Requires-Dist: keyring>=24; extra == "all"
+Requires-Dist: defusedxml>=0.7; extra == "all"
 Provides-Extra: test
 Requires-Dist: pytest>=7.4; extra == "test"
 Dynamic: license-file
@@ -725,9 +730,10 @@ Dynamic: license-file
 [![release](https://img.shields.io/github/v/release/bryanflowers/wpsecscan)](https://github.com/bryanflowers/wpsecscan/releases/latest)
 [![downloads](https://img.shields.io/github/downloads/bryanflowers/wpsecscan/total)](https://github.com/bryanflowers/wpsecscan/releases)
 [![python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
-[![checks](https://img.shields.io/badge/checks-200%2B-brightgreen)](FEATURES.md)
+[![checks](https://img.shields.io/badge/checks-268-brightgreen)](FEATURES.md)
 [![CVE sources](https://img.shields.io/badge/CVE%20sources-8-blue)](docs/data-sources.md)
-[![tests passing](https://img.shields.io/badge/tests-664%20passing-brightgreen)](tests/)
+[![tests passing](https://img.shields.io/badge/tests-780%20passing-brightgreen)](tests/)
+[![PyPI](https://img.shields.io/pypi/v/wpsecscan)](https://pypi.org/project/wpsecscan/)
 [![SLSA Level 3](https://img.shields.io/badge/SLSA-Level%203-success)](docs/verify-release.md)
 [![Sigstore signed](https://img.shields.io/badge/Sigstore-signed-blueviolet)](docs/verify-release.md)
 [![threat-intel](https://img.shields.io/badge/threat--intel-10%20providers-orange)](FEATURES.md)
@@ -744,7 +750,7 @@ Dynamic: license-file
 
 **The most thoroughly-sourced WordPress vulnerability scanner — open source, AGPLv3, runs locally.**
 
-187 checks across 18 categories. **8-source nightly CVE aggregator**
+226 checks across 18 categories. **8-source nightly CVE aggregator**
 (NVD + GHSA + Mitre + OSV + Wordfence + WPVulnerability + CIRCL +
 Patchstack). **SLSA L3 + Sigstore-signed releases**. **10-provider
 threat-intel federation** (CISA KEV, EPSS, Exploit-DB, Metasploit,
@@ -802,7 +808,31 @@ Ships as two standalone Windows binaries — no Python required on the machine y
 
 ## Quick install
 
-### Option A — use the pre-built binaries (recommended)
+### Option A — `pip install wpsecscan` (any platform)
+
+The simplest path on Linux, macOS, or Windows-with-Python:
+
+```bash
+pip install wpsecscan
+wpsecscan --version
+wpsecscan https://example.com --json-only
+```
+
+PyPI: <https://pypi.org/project/wpsecscan/>
+
+For the optional GUI minimize-to-tray feature, install with the
+`[ui]` extra (pulls in Pillow + pystray):
+
+```bash
+pip install "wpsecscan[ui]"
+```
+
+Other optional extras: `[pdf]` (reportlab for true PDF exec reports),
+`[browser]` (playwright for headless DOM-XSS), `[yaml]` (pyyaml for
+daemon config), `[ops]` (redis + bcrypt for enterprise mode), or
+`[all]` to install everything.
+
+### Option B — pre-built Windows binaries
 
 1. Open `dist\` in this folder.
 2. Copy `wpsecscan.exe` and `wpsecscan-gui.exe` somewhere on your PATH
@@ -812,7 +842,7 @@ Ships as two standalone Windows binaries — no Python required on the machine y
 The first time you run them, Windows SmartScreen may warn that the publisher is unknown
 (the binaries aren't code-signed). Click **More info → Run anyway**.
 
-### Option B — build from source
+### Option C — build from source
 
 Requires Python 3.10+ and PyInstaller. Open PowerShell in the project root:
 
@@ -830,15 +860,15 @@ dist\wpsecscan-gui.exe       # GUI (~17 MB)
 
 Both are single-file executables — copy them anywhere and they run on their own.
 
-### Option C — run from source directly (development)
+### Option D — run from source directly (development)
 
 ```powershell
 python -m venv .venv
 .\.venv\Scripts\Activate.ps1
-pip install -r requirements.txt
+pip install .
 python run.py https://example.com         # CLI
 python run_gui.py                          # GUI
-pytest                                     # 598 tests
+pytest                                     # 780 tests
 ```
 
 ---
@@ -883,7 +913,7 @@ wpsecscan.exe https://your-wp-site.com --wpscan-token <KEY>
 
 ---
 
-## What it checks (187 checks)
+## What it checks (226 checks)
 
 Passive checks always run; aggressive checks need `--aggressive`.
 
@@ -1166,12 +1196,12 @@ to see errors).
 
 | Category                  | Count |
 |---------------------------|-------|
-| Checks                    | **187** |
+| Checks                    | **226** |
 | Payloads                  | **224** |
 | Exploit signatures        | **307** |
 | Plugin CVE database       | ~7,000 (Wordfence) + 7 other sources via the nightly aggregator |
 | Exploit-playbook entries  | **25** |
-| Tests                     | **598** |
+| Tests                     | **667** |
 
 ---
 

{wpsecscan-2.4.0 → wpsecscan-2.6.0}/README.md

@@ -6,9 +6,10 @@
 [![release](https://img.shields.io/github/v/release/bryanflowers/wpsecscan)](https://github.com/bryanflowers/wpsecscan/releases/latest)
 [![downloads](https://img.shields.io/github/downloads/bryanflowers/wpsecscan/total)](https://github.com/bryanflowers/wpsecscan/releases)
 [![python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
-[![checks](https://img.shields.io/badge/checks-200%2B-brightgreen)](FEATURES.md)
+[![checks](https://img.shields.io/badge/checks-268-brightgreen)](FEATURES.md)
 [![CVE sources](https://img.shields.io/badge/CVE%20sources-8-blue)](docs/data-sources.md)
-[![tests passing](https://img.shields.io/badge/tests-664%20passing-brightgreen)](tests/)
+[![tests passing](https://img.shields.io/badge/tests-780%20passing-brightgreen)](tests/)
+[![PyPI](https://img.shields.io/pypi/v/wpsecscan)](https://pypi.org/project/wpsecscan/)
 [![SLSA Level 3](https://img.shields.io/badge/SLSA-Level%203-success)](docs/verify-release.md)
 [![Sigstore signed](https://img.shields.io/badge/Sigstore-signed-blueviolet)](docs/verify-release.md)
 [![threat-intel](https://img.shields.io/badge/threat--intel-10%20providers-orange)](FEATURES.md)
@@ -25,7 +26,7 @@
 
 **The most thoroughly-sourced WordPress vulnerability scanner — open source, AGPLv3, runs locally.**
 
-187 checks across 18 categories. **8-source nightly CVE aggregator**
+226 checks across 18 categories. **8-source nightly CVE aggregator**
 (NVD + GHSA + Mitre + OSV + Wordfence + WPVulnerability + CIRCL +
 Patchstack). **SLSA L3 + Sigstore-signed releases**. **10-provider
 threat-intel federation** (CISA KEV, EPSS, Exploit-DB, Metasploit,
@@ -83,7 +84,31 @@ Ships as two standalone Windows binaries — no Python required on the machine y
 
 ## Quick install
 
-### Option A — use the pre-built binaries (recommended)
+### Option A — `pip install wpsecscan` (any platform)
+
+The simplest path on Linux, macOS, or Windows-with-Python:
+
+```bash
+pip install wpsecscan
+wpsecscan --version
+wpsecscan https://example.com --json-only
+```
+
+PyPI: <https://pypi.org/project/wpsecscan/>
+
+For the optional GUI minimize-to-tray feature, install with the
+`[ui]` extra (pulls in Pillow + pystray):
+
+```bash
+pip install "wpsecscan[ui]"
+```
+
+Other optional extras: `[pdf]` (reportlab for true PDF exec reports),
+`[browser]` (playwright for headless DOM-XSS), `[yaml]` (pyyaml for
+daemon config), `[ops]` (redis + bcrypt for enterprise mode), or
+`[all]` to install everything.
+
+### Option B — pre-built Windows binaries
 
 1. Open `dist\` in this folder.
 2. Copy `wpsecscan.exe` and `wpsecscan-gui.exe` somewhere on your PATH
@@ -93,7 +118,7 @@ Ships as two standalone Windows binaries — no Python required on the machine y
 The first time you run them, Windows SmartScreen may warn that the publisher is unknown
 (the binaries aren't code-signed). Click **More info → Run anyway**.
 
-### Option B — build from source
+### Option C — build from source
 
 Requires Python 3.10+ and PyInstaller. Open PowerShell in the project root:
 
@@ -111,15 +136,15 @@ dist\wpsecscan-gui.exe       # GUI (~17 MB)
 
 Both are single-file executables — copy them anywhere and they run on their own.
 
-### Option C — run from source directly (development)
+### Option D — run from source directly (development)
 
 ```powershell
 python -m venv .venv
 .\.venv\Scripts\Activate.ps1
-pip install -r requirements.txt
+pip install .
 python run.py https://example.com         # CLI
 python run_gui.py                          # GUI
-pytest                                     # 598 tests
+pytest                                     # 780 tests
 ```
 
 ---
@@ -164,7 +189,7 @@ wpsecscan.exe https://your-wp-site.com --wpscan-token <KEY>
 
 ---
 
-## What it checks (187 checks)
+## What it checks (226 checks)
 
 Passive checks always run; aggressive checks need `--aggressive`.
 
@@ -447,12 +472,12 @@ to see errors).
 
 | Category                  | Count |
 |---------------------------|-------|
-| Checks                    | **187** |
+| Checks                    | **226** |
 | Payloads                  | **224** |
 | Exploit signatures        | **307** |
 | Plugin CVE database       | ~7,000 (Wordfence) + 7 other sources via the nightly aggregator |
 | Exploit-playbook entries  | **25** |
-| Tests                     | **598** |
+| Tests                     | **667** |
 
 ---
 

{wpsecscan-2.4.0 → wpsecscan-2.6.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "wpsecscan"
-version = "2.4.0"
+version = "2.6.0"
 description = "Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -36,6 +36,12 @@ dependencies = [
     "jinja2>=3.1,<4",
     "rich>=13.7,<14",
     "openpyxl>=3.1,<4",
+    # Q8: keyring is needed by the `wpsecscan creds` default-CLI surface
+    # (post-v2.5.0). Previously in [ui] extra; default install silently
+    # fell back to plain JSON. creds_vault still gracefully handles the
+    # missing-keyring case so headless installs without a backend keep
+    # working (the FailBackend check in creds_vault._have_keyring).
+    "keyring>=24",
 ]
 
 [project.optional-dependencies]
@@ -47,8 +53,14 @@ browser = ["playwright>=1.40"]
 yaml = ["pyyaml>=6.0"]
 # Distributed CVE-DB cache + RBAC bcrypt hashing
 ops = ["redis>=5.0", "bcrypt>=4.0"]
-# Optional Pillow for GUI image rendering + pystray for minimize-to-tray (#56)
+# Optional Pillow for GUI image rendering + pystray for minimize-to-tray (#56).
+# (keyring moved to default `dependencies` in v2.5.1 because the `wpsecscan
+# creds` CLI surface is no longer GUI-only.)
 ui = ["Pillow>=10", "pystray>=0.19"]
+# S5 — defusedxml protects the burp/zap importer against billion-laughs
+# entity-expansion DoS on hostile XML reports. Stdlib ElementTree falls
+# back with a stderr warning when this isn't installed.
+security = ["defusedxml>=0.7"]
 # Everything optional in one install
 all = [
     "reportlab>=4.0",
@@ -58,6 +70,8 @@ all = [
     "bcrypt>=4.0",
     "Pillow>=10",
     "pystray>=0.19",
+    "keyring>=24",
+    "defusedxml>=0.7",
 ]
 # Test deps (also installed by CI)
 test = ["pytest>=7.4"]

wpsecscan-2.6.0/tests/test_board_one_pager.py

@@ -0,0 +1,69 @@
+"""Wave 3 — tests for wpsecscan/reporters/board_one_pager.py."""
+from wpsecscan.models import CheckResult, Finding, ScanReport
+from wpsecscan.reporters import board_one_pager
+
+
+def _make(*sevs):
+    return ScanReport(
+        target="https://example.com", scanned_at="2026-05-27T00:00:00",
+        duration_ms=0,
+        results=[CheckResult(check_id="x", check_name="X",
+                              findings=[Finding(severity=s, title=f"{s} finding")
+                                         for s in sevs])],
+    )
+
+
+def test_render_returns_html():
+    rep = _make("high", "high", "medium")
+    html = board_one_pager.render(rep)
+    assert html.startswith("<!doctype html>")
+    assert "</html>" in html.rstrip()
+
+
+def test_render_includes_three_big_numbers():
+    rep = _make("critical", "high")
+    html = board_one_pager.render(rep)
+    # The risk-score, delta, and open-crit+high blocks all appear
+    assert "Risk score / 100" in html
+    assert "vs prior scan" in html
+    assert "Critical &amp; High open" in html
+
+
+def test_render_includes_target_and_timestamp():
+    rep = _make("low")
+    html = board_one_pager.render(rep)
+    assert "https://example.com" in html
+    assert "2026-05-27T00:00:00" in html
+
+
+def test_bucket_message_score_brackets():
+    """The headline text changes per score band."""
+    _, h_90, _ = board_one_pager._bucket_message(95)
+    _, h_70, _ = board_one_pager._bucket_message(80)
+    _, h_50, _ = board_one_pager._bucket_message(60)
+    _, h_low, _ = board_one_pager._bucket_message(20)
+    assert "strong" in h_90.lower()
+    assert "acceptable" in h_70.lower()
+    assert "material" in h_50.lower()
+    assert "significant" in h_low.lower()
+
+
+def test_render_three_action_bullets_present():
+    rep = _make("critical")
+    html = board_one_pager.render(rep)
+    # The render emits <li> per action; bucketed message ships three actions.
+    assert html.count("<li>") == 3
+
+
+def test_render_handles_empty_report():
+    rep = ScanReport(target="https://x", scanned_at="t", duration_ms=0, results=[])
+    html = board_one_pager.render(rep)
+    assert "0</div><div class=\"lab\">Critical &amp; High open" in html
+
+
+def test_write_creates_file(tmp_path):
+    rep = _make("high")
+    p = tmp_path / "board.html"
+    board_one_pager.write(rep, p)
+    assert p.exists()
+    assert "Board summary" in p.read_text(encoding="utf-8") or "board" in p.read_text(encoding="utf-8").lower()

wpsecscan-2.6.0/tests/test_burp_zap_import.py

@@ -0,0 +1,117 @@
+"""Wave 3 — tests for wpsecscan/importers/burp_zap.py."""
+from pathlib import Path
+
+import pytest
+
+from wpsecscan.importers import burp_zap
+
+
+_BURP_XML = """<?xml version="1.0"?>
+<issues>
+  <issue>
+    <name>SQL injection</name>
+    <severity>High</severity>
+    <host>https://target.example/</host>
+    <path>/?id=</path>
+    <issueDetail>POST id=1' AND 1=1-- returned 500</issueDetail>
+    <issueBackground>Classic time-based blind</issueBackground>
+    <remediationBackground>Use prepared statements</remediationBackground>
+  </issue>
+  <issue>
+    <name>Mixed content</name>
+    <severity>Information</severity>
+    <host>https://target.example/</host>
+    <path>/about</path>
+    <issueDetail>http:// image referenced</issueDetail>
+  </issue>
+</issues>
+"""
+
+_ZAP_XML = """<?xml version="1.0"?>
+<OWASPZAPReport version="2.14">
+  <site name="https://target.example">
+    <alerts>
+      <alertitem>
+        <alert>X-Frame-Options Header Not Set</alert>
+        <riskcode>2</riskcode>
+        <desc>Header missing</desc>
+        <solution>Add X-Frame-Options: DENY</solution>
+        <instances><instance><uri>https://target.example/</uri></instance></instances>
+      </alertitem>
+      <alertitem>
+        <alert>SQL Injection</alert>
+        <riskcode>3</riskcode>
+        <desc>Param 'id' is vulnerable</desc>
+        <solution>Prepared statements</solution>
+        <instances><instance><uri>https://target.example/?id=</uri></instance></instances>
+      </alertitem>
+    </alerts>
+  </site>
+</OWASPZAPReport>
+"""
+
+
+def test_burp_import_basic(tmp_path):
+    p = tmp_path / "burp.xml"
+    p.write_text(_BURP_XML, encoding="utf-8")
+    rep = burp_zap.import_burp(p)
+    # 2 findings, one synthetic check_id
+    findings = rep.all_findings
+    assert len(findings) == 2
+    assert {f.severity for f in findings} == {"high", "info"}
+    assert any(f.title == "SQL injection" for f in findings)
+    assert all(f.extra.get("source") == "burp" for f in findings)
+    assert rep.target == "https://target.example/"
+
+
+def test_zap_import_basic(tmp_path):
+    p = tmp_path / "zap.xml"
+    p.write_text(_ZAP_XML, encoding="utf-8")
+    rep = burp_zap.import_zap(p)
+    findings = rep.all_findings
+    assert len(findings) == 2
+    assert {f.severity for f in findings} == {"medium", "high"}
+    assert all(f.extra.get("source") == "zap" for f in findings)
+    assert "target.example" in rep.target
+
+
+def test_autoimport_sniffs_zap(tmp_path):
+    p = tmp_path / "z.xml"
+    p.write_text(_ZAP_XML, encoding="utf-8")
+    rep = burp_zap.autoimport(p)
+    assert rep.results[0].check_id == "imported_zap"
+
+
+def test_autoimport_falls_back_to_burp(tmp_path):
+    p = tmp_path / "b.xml"
+    p.write_text(_BURP_XML, encoding="utf-8")
+    rep = burp_zap.autoimport(p)
+    assert rep.results[0].check_id == "imported_burp"
+
+
+def test_target_override(tmp_path):
+    p = tmp_path / "b.xml"
+    p.write_text(_BURP_XML, encoding="utf-8")
+    rep = burp_zap.import_burp(p, target_override="https://override.example")
+    assert rep.target == "https://override.example"
+
+
+def test_burp_severity_mapping(tmp_path):
+    """Burp 'Information' must map to wpsecscan 'info'."""
+    xml = _BURP_XML.replace("<severity>High</severity>",
+                             "<severity>Information</severity>")
+    p = tmp_path / "b.xml"
+    p.write_text(xml, encoding="utf-8")
+    rep = burp_zap.import_burp(p)
+    sevs = [f.severity for f in rep.all_findings]
+    assert sevs.count("info") == 2  # both findings now map to info
+
+
+def test_zap_unknown_riskcode_defaults_medium(tmp_path):
+    """An unknown ZAP riskcode falls back to medium per _SEV_MAP default."""
+    xml = _ZAP_XML.replace("<riskcode>2</riskcode>", "<riskcode>99</riskcode>")
+    p = tmp_path / "z.xml"
+    p.write_text(xml, encoding="utf-8")
+    rep = burp_zap.import_zap(p)
+    sevs = [f.severity for f in rep.all_findings]
+    assert "medium" in sevs  # the fallback severity

wpsecscan-2.6.0/tests/test_creds_vault_cli.py

@@ -0,0 +1,87 @@
+"""Wave 3 — tests for the creds_vault module's public API.
+
+The fallback storage path runs whenever keyring is unavailable or its
+backend is FailBackend. We monkeypatch `_have_keyring` to force the
+fallback path so the test is hermetic on any host.
+"""
+import json
+from pathlib import Path
+
+import pytest
+
+from wpsecscan import creds_vault
+
+
+@pytest.fixture(autouse=True)
+def force_fallback(monkeypatch, tmp_path):
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    monkeypatch.setattr(creds_vault, "_have_keyring", lambda: False)
+    yield
+
+
+def test_set_get_round_trip():
+    creds_vault.set_secret("https://example.com", "username", "admin")
+    creds_vault.set_secret("https://example.com", "password", "s3cret!")
+    assert creds_vault.get_secret("https://example.com", "username") == "admin"
+    assert creds_vault.get_secret("https://example.com", "password") == "s3cret!"
+
+
+def test_missing_secret_returns_none():
+    assert creds_vault.get_secret("https://nope", "username") is None
+
+
+def test_delete_secret():
+    creds_vault.set_secret("https://x", "field", "value")
+    assert creds_vault.delete_secret("https://x", "field") is True
+    assert creds_vault.get_secret("https://x", "field") is None
+
+
+def test_list_sites_after_set():
+    creds_vault.set_secret("https://a", "username", "u")
+    creds_vault.set_secret("https://b", "password", "p")
+    sites = dict(creds_vault.list_sites())
+    assert sites["https://a"] == ["username"]
+    assert sites["https://b"] == ["password"]
+
+
+def test_list_fields_for():
+    creds_vault.set_secret("https://x", "username", "u")
+    creds_vault.set_secret("https://x", "password", "p")
+    fields = creds_vault.list_fields_for("https://x")
+    assert set(fields) == {"username", "password"}
+
+
+def test_rotate_overwrites():
+    creds_vault.set_secret("https://x", "password", "old")
+    creds_vault.rotate_secret("https://x", "password", "new")
+    assert creds_vault.get_secret("https://x", "password") == "new"
+
+
+def test_backend_in_use_reports_fallback():
+    assert creds_vault.backend_in_use() == "fallback"
+
+
+def test_fallback_file_mode_posix(tmp_path):
+    """On POSIX, the fallback vault file should be 0600 from creation."""
+    import os
+    creds_vault.set_secret("https://x", "username", "u")
+    p = tmp_path / "creds-vault.json"
+    assert p.exists()
+    if os.name != "nt":
+        mode = p.stat().st_mode & 0o777
+        assert mode == 0o600, f"expected 0600, got {oct(mode)}"
+
+
+def test_multi_account_via_field_suffix():
+    """The CLI encodes multi-account as field@account; vault stores it as-is."""
+    creds_vault.set_secret("https://x", "username@admin1", "alice")
+    creds_vault.set_secret("https://x", "username@admin2", "bob")
+    assert creds_vault.get_secret("https://x", "username@admin1") == "alice"
+    assert creds_vault.get_secret("https://x", "username@admin2") == "bob"
+
+
+def test_delete_removes_from_index():
+    creds_vault.set_secret("https://x", "f", "v")
+    creds_vault.delete_secret("https://x", "f")
+    sites = dict(creds_vault.list_sites())
+    assert "https://x" not in sites

wpsecscan-2.6.0/tests/test_diff_agency.py

@@ -0,0 +1,104 @@
+"""Wave 3 — tests for wpsecscan/reporters/diff_agency.py."""
+import json
+from pathlib import Path
+
+import pytest
+
+from wpsecscan.reporters import diff_agency
+
+
+def _dashboard_html(manifest: dict) -> str:
+    """Synthesize the minimum dashboard HTML diff_agency reads from."""
+    return (
+        '<html><body><table>...</table>'
+        f'<script type="application/json" id="wpsecscan-dashboard-data">'
+        f'{json.dumps(manifest)}</script></body></html>'
+    )
+
+
+def test_extract_manifest_from_script(tmp_path):
+    p = tmp_path / "d.html"
+    p.write_text(_dashboard_html({"generated_at": "t", "totals": {},
+                                    "sites": [{"target": "https://x",
+                                                "risk_score": 90,
+                                                "worst": "low",
+                                                "summary": {}}]}),
+                  encoding="utf-8")
+    out = diff_agency._extract_manifest(p.read_text(encoding="utf-8"))
+    assert out["sites"][0]["target"] == "https://x"
+
+
+def test_extract_manifest_fallback_html_scrape(tmp_path):
+    """Pre-v2.5.0 dashboards have no embedded manifest — table-scrape works."""
+    html = (
+        "<html><body><table>"
+        "<tr><td>https://a.example</td><td>x</td><td>87/100</td></tr>"
+        "<tr><td>https://b.example</td><td>x</td><td>42/100</td></tr>"
+        "</table></body></html>"
+    )
+    out = diff_agency._extract_manifest(html)
+    assert len(out["sites"]) == 2
+    assert out["sites"][0]["target"] == "https://a.example"
+    assert out["sites"][0]["risk_score"] == 87
+
+
+def test_diff_added_removed_changed():
+    old = {"sites": [
+        {"target": "https://a", "risk_score": 90, "worst": "low", "summary": {}},
+        {"target": "https://b", "risk_score": 70, "worst": "high", "summary": {}},
+    ], "totals": {"critical": 0, "high": 1, "medium": 0, "low": 0, "info": 0}}
+    new = {"sites": [
+        {"target": "https://a", "risk_score": 95, "worst": "low", "summary": {}},  # improved
+        {"target": "https://c", "risk_score": 100, "worst": None, "summary": {}},  # new
+    ], "totals": {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0}}
+    d = diff_agency.diff(old, new)
+    assert [s["target"] for s in d["added"]] == ["https://c"]
+    assert [s["target"] for s in d["removed"]] == ["https://b"]
+    assert len(d["changed"]) == 1
+    assert d["changed"][0]["target"] == "https://a"
+    assert d["changed"][0]["delta"] == 5
+    assert d["totals_delta"]["high"] == -1
+
+
+def test_diff_empty_inputs():
+    d = diff_agency.diff({"sites": [], "totals": {}}, {"sites": [], "totals": {}})
+    assert d["added"] == []
+    assert d["removed"] == []
+    assert d["changed"] == []
+
+
+def test_render_html_contains_section_headings():
+    d = {
+        "old_at": "t1", "new_at": "t2",
+        "site_count_old": 1, "site_count_new": 1,
+        "totals_delta": {"critical": 0, "high": 0, "medium": 0, "low": 0, "info": 0},
+        "added": [],
+        "removed": [],
+        "changed": [{"target": "https://x", "old_score": 80, "new_score": 85,
+                      "delta": 5, "old_worst": "high", "new_worst": "medium"}],
+    }
+    html = diff_agency.render_html(d)
+    assert "Score / severity changes (1)" in html
+    assert "https://x" in html
+    assert "+5" in html
+
+
+def test_write_round_trip(tmp_path):
+    old = tmp_path / "old.html"
+    new = tmp_path / "new.html"
+    old.write_text(_dashboard_html({"generated_at": "t1", "totals": {},
+                                      "sites": [{"target": "https://x",
+                                                  "risk_score": 80,
+                                                  "worst": "high",
+                                                  "summary": {}}]}),
+                    encoding="utf-8")
+    new.write_text(_dashboard_html({"generated_at": "t2", "totals": {},
+                                      "sites": [{"target": "https://x",
+                                                  "risk_score": 90,
+                                                  "worst": "medium",
+                                                  "summary": {}}]}),
+                    encoding="utf-8")
+    out = tmp_path / "diff.html"
+    d = diff_agency.write(old, new, out)
+    assert out.exists()
+    assert d["changed"][0]["delta"] == 10