wpsecscan 2.7.2__tar.gz → 2.7.3__tar.gz

{wpsecscan-2.7.2/wpsecscan.egg-info → wpsecscan-2.7.3}/PKG-INFO

@@ -1,1224 +1,1224 @@
-Metadata-Version: 2.4
-Name: wpsecscan
-Version: 2.7.2
-Summary: Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only.
-Author-email: Bryan <bryaninbangkok@gmail.com>
-License:                     GNU AFFERO GENERAL PUBLIC LICENSE
-                               Version 3, 19 November 2007
-        
-         Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
-         Everyone is permitted to copy and distribute verbatim copies
-         of this license document, but changing it is not allowed.
-        
-                                    Preamble
-        
-          The GNU Affero General Public License is a free, copyleft license for
-        software and other kinds of works, specifically designed to ensure
-        cooperation with the community in the case of network server software.
-        
-          The licenses for most software and other practical works are designed
-        to take away your freedom to share and change the works.  By contrast,
-        our General Public Licenses are intended to guarantee your freedom to
-        share and change all versions of a program--to make sure it remains free
-        software for all its users.
-        
-          When we speak of free software, we are referring to freedom, not
-        price.  Our General Public Licenses are designed to make sure that you
-        have the freedom to distribute copies of free software (and charge for
-        them if you wish), that you receive source code or can get it if you
-        want it, that you can change the software or use pieces of it in new
-        free programs, and that you know you can do these things.
-        
-          Developers that use our General Public Licenses protect your rights
-        with two steps: (1) assert copyright on the software, and (2) offer
-        you this License which gives you legal permission to copy, distribute
-        and/or modify the software.
-        
-          A secondary benefit of defending all users' freedom is that
-        improvements made in alternate versions of the program, if they
-        receive widespread use, become available for other developers to
-        incorporate.  Many developers of free software are heartened and
-        encouraged by the resulting cooperation.  However, in the case of
-        software used on network servers, this result may fail to come about.
-        The GNU General Public License permits making a modified version and
-        letting the public access it on a server without ever releasing its
-        source code to the public.
-        
-          The GNU Affero General Public License is designed specifically to
-        ensure that, in such cases, the modified source code becomes available
-        to the community.  It requires the operator of a network server to
-        provide the source code of the modified version running there to the
-        users of that server.  Therefore, public use of a modified version, on
-        a publicly accessible server, gives the public access to the source
-        code of the modified version.
-        
-          An older license, called the Affero General Public License and
-        published by Affero, was designed to accomplish similar goals.  This is
-        a different license, not a version of the Affero GPL, but Affero has
-        released a new version of the Affero GPL which permits relicensing under
-        this license.
-        
-          The precise terms and conditions for copying, distribution and
-        modification follow.
-        
-                               TERMS AND CONDITIONS
-        
-          0. Definitions.
-        
-          "This License" refers to version 3 of the GNU Affero General Public License.
-        
-          "Copyright" also means copyright-like laws that apply to other kinds of
-        works, such as semiconductor masks.
-        
-          "The Program" refers to any copyrightable work licensed under this
-        License.  Each licensee is addressed as "you".  "Licensees" and
-        "recipients" may be individuals or organizations.
-        
-          To "modify" a work means to copy from or adapt all or part of the work
-        in a fashion requiring copyright permission, other than the making of an
-        exact copy.  The resulting work is called a "modified version" of the
-        earlier work or a work "based on" the earlier work.
-        
-          A "covered work" means either the unmodified Program or a work based
-        on the Program.
-        
-          To "propagate" a work means to do anything with it that, without
-        permission, would make you directly or secondarily liable for
-        infringement under applicable copyright law, except executing it on a
-        computer or modifying a private copy.  Propagation includes copying,
-        distribution (with or without modification), making available to the
-        public, and in some countries other activities as well.
-        
-          To "convey" a work means any kind of propagation that enables other
-        parties to make or receive copies.  Mere interaction with a user through
-        a computer network, with no transfer of a copy, is not conveying.
-        
-          An interactive user interface displays "Appropriate Legal Notices"
-        to the extent that it includes a convenient and prominently visible
-        feature that (1) displays an appropriate copyright notice, and (2)
-        tells the user that there is no warranty for the work (except to the
-        extent that warranties are provided), that licensees may convey the
-        work under this License, and how to view a copy of this License.  If
-        the interface presents a list of user commands or options, such as a
-        menu, a prominent item in the list meets this criterion.
-        
-          1. Source Code.
-        
-          The "source code" for a work means the preferred form of the work
-        for making modifications to it.  "Object code" means any non-source
-        form of a work.
-        
-          A "Standard Interface" means an interface that either is an official
-        standard defined by a recognized standards body, or, in the case of
-        interfaces specified for a particular programming language, one that
-        is widely used among developers working in that language.
-        
-          The "System Libraries" of an executable work include anything, other
-        than the work as a whole, that (a) is included in the normal form of
-        packaging a Major Component, but which is not part of that Major
-        Component, and (b) serves only to enable use of the work with that
-        Major Component, or to implement a Standard Interface for which an
-        implementation is available to the public in source code form.  A
-        "Major Component", in this context, means a major essential component
-        (kernel, window system, and so on) of the specific operating system
-        (if any) on which the executable work runs, or a compiler used to
-        produce the work, or an object code interpreter used to run it.
-        
-          The "Corresponding Source" for a work in object code form means all
-        the source code needed to generate, install, and (for an executable
-        work) run the object code and to modify the work, including scripts to
-        control those activities.  However, it does not include the work's
-        System Libraries, or general-purpose tools or generally available free
-        programs which are used unmodified in performing those activities but
-        which are not part of the work.  For example, Corresponding Source
-        includes interface definition files associated with source files for
-        the work, and the source code for shared libraries and dynamically
-        linked subprograms that the work is specifically designed to require,
-        such as by intimate data communication or control flow between those
-        subprograms and other parts of the work.
-        
-          The Corresponding Source need not include anything that users
-        can regenerate automatically from other parts of the Corresponding
-        Source.
-        
-          The Corresponding Source for a work in source code form is that
-        same work.
-        
-          2. Basic Permissions.
-        
-          All rights granted under this License are granted for the term of
-        copyright on the Program, and are irrevocable provided the stated
-        conditions are met.  This License explicitly affirms your unlimited
-        permission to run the unmodified Program.  The output from running a
-        covered work is covered by this License only if the output, given its
-        content, constitutes a covered work.  This License acknowledges your
-        rights of fair use or other equivalent, as provided by copyright law.
-        
-          You may make, run and propagate covered works that you do not
-        convey, without conditions so long as your license otherwise remains
-        in force.  You may convey covered works to others for the sole purpose
-        of having them make modifications exclusively for you, or provide you
-        with facilities for running those works, provided that you comply with
-        the terms of this License in conveying all material for which you do
-        not control copyright.  Those thus making or running the covered works
-        for you must do so exclusively on your behalf, under your direction
-        and control, on terms that prohibit them from making any copies of
-        your copyrighted material outside their relationship with you.
-        
-          Conveying under any other circumstances is permitted solely under
-        the conditions stated below.  Sublicensing is not allowed; section 10
-        makes it unnecessary.
-        
-          3. Protecting Users' Legal Rights From Anti-Circumvention Law.
-        
-          No covered work shall be deemed part of an effective technological
-        measure under any applicable law fulfilling obligations under article
-        11 of the WIPO copyright treaty adopted on 20 December 1996, or
-        similar laws prohibiting or restricting circumvention of such
-        measures.
-        
-          When you convey a covered work, you waive any legal power to forbid
-        circumvention of technological measures to the extent such circumvention
-        is effected by exercising rights under this License with respect to
-        the covered work, and you disclaim any intention to limit operation or
-        modification of the work as a means of enforcing, against the work's
-        users, your or third parties' legal rights to forbid circumvention of
-        technological measures.
-        
-          4. Conveying Verbatim Copies.
-        
-          You may convey verbatim copies of the Program's source code as you
-        receive it, in any medium, provided that you conspicuously and
-        appropriately publish on each copy an appropriate copyright notice;
-        keep intact all notices stating that this License and any
-        non-permissive terms added in accord with section 7 apply to the code;
-        keep intact all notices of the absence of any warranty; and give all
-        recipients a copy of this License along with the Program.
-        
-          You may charge any price or no price for each copy that you convey,
-        and you may offer support or warranty protection for a fee.
-        
-          5. Conveying Modified Source Versions.
-        
-          You may convey a work based on the Program, or the modifications to
-        produce it from the Program, in the form of source code under the
-        terms of section 4, provided that you also meet all of these conditions:
-        
-            a) The work must carry prominent notices stating that you modified
-            it, and giving a relevant date.
-        
-            b) The work must carry prominent notices stating that it is
-            released under this License and any conditions added under section
-            7.  This requirement modifies the requirement in section 4 to
-            "keep intact all notices".
-        
-            c) You must license the entire work, as a whole, under this
-            License to anyone who comes into possession of a copy.  This
-            License will therefore apply, along with any applicable section 7
-            additional terms, to the whole of the work, and all its parts,
-            regardless of how they are packaged.  This License gives no
-            permission to license the work in any other way, but it does not
-            invalidate such permission if you have separately received it.
-        
-            d) If the work has interactive user interfaces, each must display
-            Appropriate Legal Notices; however, if the Program has interactive
-            interfaces that do not display Appropriate Legal Notices, your
-            work need not make them do so.
-        
-          A compilation of a covered work with other separate and independent
-        works, which are not by their nature extensions of the covered work,
-        and which are not combined with it such as to form a larger program,
-        in or on a volume of a storage or distribution medium, is called an
-        "aggregate" if the compilation and its resulting copyright are not
-        used to limit the access or legal rights of the compilation's users
-        beyond what the individual works permit.  Inclusion of a covered work
-        in an aggregate does not cause this License to apply to the other
-        parts of the aggregate.
-        
-          6. Conveying Non-Source Forms.
-        
-          You may convey a covered work in object code form under the terms
-        of sections 4 and 5, provided that you also convey the
-        machine-readable Corresponding Source under the terms of this License,
-        in one of these ways:
-        
-            a) Convey the object code in, or embodied in, a physical product
-            (including a physical distribution medium), accompanied by the
-            Corresponding Source fixed on a durable physical medium
-            customarily used for software interchange.
-        
-            b) Convey the object code in, or embodied in, a physical product
-            (including a physical distribution medium), accompanied by a
-            written offer, valid for at least three years and valid for as
-            long as you offer spare parts or customer support for that product
-            model, to give anyone who possesses the object code either (1) a
-            copy of the Corresponding Source for all the software in the
-            product that is covered by this License, on a durable physical
-            medium customarily used for software interchange, for a price no
-            more than your reasonable cost of physically performing this
-            conveying of source, or (2) access to copy the
-            Corresponding Source from a network server at no charge.
-        
-            c) Convey individual copies of the object code with a copy of the
-            written offer to provide the Corresponding Source.  This
-            alternative is allowed only occasionally and noncommercially, and
-            only if you received the object code with such an offer, in accord
-            with subsection 6b.
-        
-            d) Convey the object code by offering access from a designated
-            place (gratis or for a charge), and offer equivalent access to the
-            Corresponding Source in the same way through the same place at no
-            further charge.  You need not require recipients to copy the
-            Corresponding Source along with the object code.  If the place to
-            copy the object code is a network server, the Corresponding Source
-            may be on a different server (operated by you or a third party)
-            that supports equivalent copying facilities, provided you maintain
-            clear directions next to the object code saying where to find the
-            Corresponding Source.  Regardless of what server hosts the
-            Corresponding Source, you remain obligated to ensure that it is
-            available for as long as needed to satisfy these requirements.
-        
-            e) Convey the object code using peer-to-peer transmission, provided
-            you inform other peers where the object code and Corresponding
-            Source of the work are being offered to the general public at no
-            charge under subsection 6d.
-        
-          A separable portion of the object code, whose source code is excluded
-        from the Corresponding Source as a System Library, need not be
-        included in conveying the object code work.
-        
-          A "User Product" is either (1) a "consumer product", which means any
-        tangible personal property which is normally used for personal, family,
-        or household purposes, or (2) anything designed or sold for incorporation
-        into a dwelling.  In determining whether a product is a consumer product,
-        doubtful cases shall be resolved in favor of coverage.  For a particular
-        product received by a particular user, "normally used" refers to a
-        typical or common use of that class of product, regardless of the status
-        of the particular user or of the way in which the particular user
-        actually uses, or expects or is expected to use, the product.  A product
-        is a consumer product regardless of whether the product has substantial
-        commercial, industrial or non-consumer uses, unless such uses represent
-        the only significant mode of use of the product.
-        
-          "Installation Information" for a User Product means any methods,
-        procedures, authorization keys, or other information required to install
-        and execute modified versions of a covered work in that User Product from
-        a modified version of its Corresponding Source.  The information must
-        suffice to ensure that the continued functioning of the modified object
-        code is in no case prevented or interfered with solely because
-        modification has been made.
-        
-          If you convey an object code work under this section in, or with, or
-        specifically for use in, a User Product, and the conveying occurs as
-        part of a transaction in which the right of possession and use of the
-        User Product is transferred to the recipient in perpetuity or for a
-        fixed term (regardless of how the transaction is characterized), the
-        Corresponding Source conveyed under this section must be accompanied
-        by the Installation Information.  But this requirement does not apply
-        if neither you nor any third party retains the ability to install
-        modified object code on the User Product (for example, the work has
-        been installed in ROM).
-        
-          The requirement to provide Installation Information does not include a
-        requirement to continue to provide support service, warranty, or updates
-        for a work that has been modified or installed by the recipient, or for
-        the User Product in which it has been modified or installed.  Access to a
-        network may be denied when the modification itself materially and
-        adversely affects the operation of the network or violates the rules and
-        protocols for communication across the network.
-        
-          Corresponding Source conveyed, and Installation Information provided,
-        in accord with this section must be in a format that is publicly
-        documented (and with an implementation available to the public in
-        source code form), and must require no special password or key for
-        unpacking, reading or copying.
-        
-          7. Additional Terms.
-        
-          "Additional permissions" are terms that supplement the terms of this
-        License by making exceptions from one or more of its conditions.
-        Additional permissions that are applicable to the entire Program shall
-        be treated as though they were included in this License, to the extent
-        that they are valid under applicable law.  If additional permissions
-        apply only to part of the Program, that part may be used separately
-        under those permissions, but the entire Program remains governed by
-        this License without regard to the additional permissions.
-        
-          When you convey a copy of a covered work, you may at your option
-        remove any additional permissions from that copy, or from any part of
-        it.  (Additional permissions may be written to require their own
-        removal in certain cases when you modify the work.)  You may place
-        additional permissions on material, added by you to a covered work,
-        for which you have or can give appropriate copyright permission.
-        
-          Notwithstanding any other provision of this License, for material you
-        add to a covered work, you may (if authorized by the copyright holders of
-        that material) supplement the terms of this License with terms:
-        
-            a) Disclaiming warranty or limiting liability differently from the
-            terms of sections 15 and 16 of this License; or
-        
-            b) Requiring preservation of specified reasonable legal notices or
-            author attributions in that material or in the Appropriate Legal
-            Notices displayed by works containing it; or
-        
-            c) Prohibiting misrepresentation of the origin of that material, or
-            requiring that modified versions of such material be marked in
-            reasonable ways as different from the original version; or
-        
-            d) Limiting the use for publicity purposes of names of licensors or
-            authors of the material; or
-        
-            e) Declining to grant rights under trademark law for use of some
-            trade names, trademarks, or service marks; or
-        
-            f) Requiring indemnification of licensors and authors of that
-            material by anyone who conveys the material (or modified versions of
-            it) with contractual assumptions of liability to the recipient, for
-            any liability that these contractual assumptions directly impose on
-            those licensors and authors.
-        
-          All other non-permissive additional terms are considered "further
-        restrictions" within the meaning of section 10.  If the Program as you
-        received it, or any part of it, contains a notice stating that it is
-        governed by this License along with a term that is a further
-        restriction, you may remove that term.  If a license document contains
-        a further restriction but permits relicensing or conveying under this
-        License, you may add to a covered work material governed by the terms
-        of that license document, provided that the further restriction does
-        not survive such relicensing or conveying.
-        
-          If you add terms to a covered work in accord with this section, you
-        must place, in the relevant source files, a statement of the
-        additional terms that apply to those files, or a notice indicating
-        where to find the applicable terms.
-        
-          Additional terms, permissive or non-permissive, may be stated in the
-        form of a separately written license, or stated as exceptions;
-        the above requirements apply either way.
-        
-          8. Termination.
-        
-          You may not propagate or modify a covered work except as expressly
-        provided under this License.  Any attempt otherwise to propagate or
-        modify it is void, and will automatically terminate your rights under
-        this License (including any patent licenses granted under the third
-        paragraph of section 11).
-        
-          However, if you cease all violation of this License, then your
-        license from a particular copyright holder is reinstated (a)
-        provisionally, unless and until the copyright holder explicitly and
-        finally terminates your license, and (b) permanently, if the copyright
-        holder fails to notify you of the violation by some reasonable means
-        prior to 60 days after the cessation.
-        
-          Moreover, your license from a particular copyright holder is
-        reinstated permanently if the copyright holder notifies you of the
-        violation by some reasonable means, this is the first time you have
-        received notice of violation of this License (for any work) from that
-        copyright holder, and you cure the violation prior to 30 days after
-        your receipt of the notice.
-        
-          Termination of your rights under this section does not terminate the
-        licenses of parties who have received copies or rights from you under
-        this License.  If your rights have been terminated and not permanently
-        reinstated, you do not qualify to receive new licenses for the same
-        material under section 10.
-        
-          9. Acceptance Not Required for Having Copies.
-        
-          You are not required to accept this License in order to receive or
-        run a copy of the Program.  Ancillary propagation of a covered work
-        occurring solely as a consequence of using peer-to-peer transmission
-        to receive a copy likewise does not require acceptance.  However,
-        nothing other than this License grants you permission to propagate or
-        modify any covered work.  These actions infringe copyright if you do
-        not accept this License.  Therefore, by modifying or propagating a
-        covered work, you indicate your acceptance of this License to do so.
-        
-          10. Automatic Licensing of Downstream Recipients.
-        
-          Each time you convey a covered work, the recipient automatically
-        receives a license from the original licensors, to run, modify and
-        propagate that work, subject to this License.  You are not responsible
-        for enforcing compliance by third parties with this License.
-        
-          An "entity transaction" is a transaction transferring control of an
-        organization, or substantially all assets of one, or subdividing an
-        organization, or merging organizations.  If propagation of a covered
-        work results from an entity transaction, each party to that
-        transaction who receives a copy of the work also receives whatever
-        licenses to the work the party's predecessor in interest had or could
-        give under the previous paragraph, plus a right to possession of the
-        Corresponding Source of the work from the predecessor in interest, if
-        the predecessor has it or can get it with reasonable efforts.
-        
-          You may not impose any further restrictions on the exercise of the
-        rights granted or affirmed under this License.  For example, you may
-        not impose a license fee, royalty, or other charge for exercise of
-        rights granted under this License, and you may not initiate litigation
-        (including a cross-claim or counterclaim in a lawsuit) alleging that
-        any patent claim is infringed by making, using, selling, offering for
-        sale, or importing the Program or any portion of it.
-        
-          11. Patents.
-        
-          A "contributor" is a copyright holder who authorizes use under this
-        License of the Program or a work on which the Program is based.  The
-        work thus licensed is called the contributor's "contributor version".
-        
-          A contributor's "essential patent claims" are all patent claims
-        owned or controlled by the contributor, whether already acquired or
-        hereafter acquired, that would be infringed by some manner, permitted
-        by this License, of making, using, or selling its contributor version,
-        but do not include claims that would be infringed only as a
-        consequence of further modification of the contributor version.  For
-        purposes of this definition, "control" includes the right to grant
-        patent sublicenses in a manner consistent with the requirements of
-        this License.
-        
-          Each contributor grants you a non-exclusive, worldwide, royalty-free
-        patent license under the contributor's essential patent claims, to
-        make, use, sell, offer for sale, import and otherwise run, modify and
-        propagate the contents of its contributor version.
-        
-          In the following three paragraphs, a "patent license" is any express
-        agreement or commitment, however denominated, not to enforce a patent
-        (such as an express permission to practice a patent or covenant not to
-        sue for patent infringement).  To "grant" such a patent license to a
-        party means to make such an agreement or commitment not to enforce a
-        patent against the party.
-        
-          If you convey a covered work, knowingly relying on a patent license,
-        and the Corresponding Source of the work is not available for anyone
-        to copy, free of charge and under the terms of this License, through a
-        publicly available network server or other readily accessible means,
-        then you must either (1) cause the Corresponding Source to be so
-        available, or (2) arrange to deprive yourself of the benefit of the
-        patent license for this particular work, or (3) arrange, in a manner
-        consistent with the requirements of this License, to extend the patent
-        license to downstream recipients.  "Knowingly relying" means you have
-        actual knowledge that, but for the patent license, your conveying the
-        covered work in a country, or your recipient's use of the covered work
-        in a country, would infringe one or more identifiable patents in that
-        country that you have reason to believe are valid.
-        
-          If, pursuant to or in connection with a single transaction or
-        arrangement, you convey, or propagate by procuring conveyance of, a
-        covered work, and grant a patent license to some of the parties
-        receiving the covered work authorizing them to use, propagate, modify
-        or convey a specific copy of the covered work, then the patent license
-        you grant is automatically extended to all recipients of the covered
-        work and works based on it.
-        
-          A patent license is "discriminatory" if it does not include within
-        the scope of its coverage, prohibits the exercise of, or is
-        conditioned on the non-exercise of one or more of the rights that are
-        specifically granted under this License.  You may not convey a covered
-        work if you are a party to an arrangement with a third party that is
-        in the business of distributing software, under which you make payment
-        to the third party based on the extent of your activity of conveying
-        the work, and under which the third party grants, to any of the
-        parties who would receive the covered work from you, a discriminatory
-        patent license (a) in connection with copies of the covered work
-        conveyed by you (or copies made from those copies), or (b) primarily
-        for and in connection with specific products or compilations that
-        contain the covered work, unless you entered into that arrangement,
-        or that patent license was granted, prior to 28 March 2007.
-        
-          Nothing in this License shall be construed as excluding or limiting
-        any implied license or other defenses to infringement that may
-        otherwise be available to you under applicable patent law.
-        
-          12. No Surrender of Others' Freedom.
-        
-          If conditions are imposed on you (whether by court order, agreement or
-        otherwise) that contradict the conditions of this License, they do not
-        excuse you from the conditions of this License.  If you cannot convey a
-        covered work so as to satisfy simultaneously your obligations under this
-        License and any other pertinent obligations, then as a consequence you may
-        not convey it at all.  For example, if you agree to terms that obligate you
-        to collect a royalty for further conveying from those to whom you convey
-        the Program, the only way you could satisfy both those terms and this
-        License would be to refrain entirely from conveying the Program.
-        
-          13. Remote Network Interaction; Use with the GNU General Public License.
-        
-          Notwithstanding any other provision of this License, if you modify the
-        Program, your modified version must prominently offer all users
-        interacting with it remotely through a computer network (if your version
-        supports such interaction) an opportunity to receive the Corresponding
-        Source of your version by providing access to the Corresponding Source
-        from a network server at no charge, through some standard or customary
-        means of facilitating copying of software.  This Corresponding Source
-        shall include the Corresponding Source for any work covered by version 3
-        of the GNU General Public License that is incorporated pursuant to the
-        following paragraph.
-        
-          Notwithstanding any other provision of this License, you have
-        permission to link or combine any covered work with a work licensed
-        under version 3 of the GNU General Public License into a single
-        combined work, and to convey the resulting work.  The terms of this
-        License will continue to apply to the part which is the covered work,
-        but the work with which it is combined will remain governed by version
-        3 of the GNU General Public License.
-        
-          14. Revised Versions of this License.
-        
-          The Free Software Foundation may publish revised and/or new versions of
-        the GNU Affero General Public License from time to time.  Such new versions
-        will be similar in spirit to the present version, but may differ in detail to
-        address new problems or concerns.
-        
-          Each version is given a distinguishing version number.  If the
-        Program specifies that a certain numbered version of the GNU Affero General
-        Public License "or any later version" applies to it, you have the
-        option of following the terms and conditions either of that numbered
-        version or of any later version published by the Free Software
-        Foundation.  If the Program does not specify a version number of the
-        GNU Affero General Public License, you may choose any version ever published
-        by the Free Software Foundation.
-        
-          If the Program specifies that a proxy can decide which future
-        versions of the GNU Affero General Public License can be used, that proxy's
-        public statement of acceptance of a version permanently authorizes you
-        to choose that version for the Program.
-        
-          Later license versions may give you additional or different
-        permissions.  However, no additional obligations are imposed on any
-        author or copyright holder as a result of your choosing to follow a
-        later version.
-        
-          15. Disclaimer of Warranty.
-        
-          THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
-        APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
-        HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
-        OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
-        THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
-        PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
-        IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
-        ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
-        
-          16. Limitation of Liability.
-        
-          IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
-        WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
-        THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
-        GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
-        USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
-        DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
-        PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
-        EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
-        SUCH DAMAGES.
-        
-          17. Interpretation of Sections 15 and 16.
-        
-          If the disclaimer of warranty and limitation of liability provided
-        above cannot be given local legal effect according to their terms,
-        reviewing courts shall apply local law that most closely approximates
-        an absolute waiver of all civil liability in connection with the
-        Program, unless a warranty or assumption of liability accompanies a
-        copy of the Program in return for a fee.
-        
-                             END OF TERMS AND CONDITIONS
-        
-                    How to Apply These Terms to Your New Programs
-        
-          If you develop a new program, and you want it to be of the greatest
-        possible use to the public, the best way to achieve this is to make it
-        free software which everyone can redistribute and change under these terms.
-        
-          To do so, attach the following notices to the program.  It is safest
-        to attach them to the start of each source file to most effectively
-        state the exclusion of warranty; and each file should have at least
-        the "copyright" line and a pointer to where the full notice is found.
-        
-            <one line to give the program's name and a brief idea of what it does.>
-            Copyright (C) <year>  <name of author>
-        
-            This program is free software: you can redistribute it and/or modify
-            it under the terms of the GNU Affero General Public License as published by
-            the Free Software Foundation, either version 3 of the License, or
-            (at your option) any later version.
-        
-            This program is distributed in the hope that it will be useful,
-            but WITHOUT ANY WARRANTY; without even the implied warranty of
-            MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
-            GNU Affero General Public License for more details.
-        
-            You should have received a copy of the GNU Affero General Public License
-            along with this program.  If not, see <https://www.gnu.org/licenses/>.
-        
-        Also add information on how to contact you by electronic and paper mail.
-        
-          If your software can interact with users remotely through a computer
-        network, you should also make sure that it provides a way for users to
-        get its source.  For example, if your program is a web application, its
-        interface could display a "Source" link that leads users to an archive
-        of the code.  There are many ways you could offer source, and different
-        solutions will be better for different programs; see section 13 for the
-        specific requirements.
-        
-          You should also get your employer (if you work as a programmer) or school,
-        if any, to sign a "copyright disclaimer" for the program, if necessary.
-        For more information on this, and how to apply and follow the GNU AGPL, see
-        <https://www.gnu.org/licenses/>.
-        
-Project-URL: Homepage, https://github.com/bryanflowers/wpsecscan
-Project-URL: Repository, https://github.com/bryanflowers/wpsecscan
-Project-URL: Documentation, https://github.com/bryanflowers/wpsecscan#readme
-Project-URL: Issues, https://github.com/bryanflowers/wpsecscan/issues
-Project-URL: Changelog, https://github.com/bryanflowers/wpsecscan/blob/main/CHANGELOG.md
-Project-URL: Security, https://github.com/bryanflowers/wpsecscan/blob/main/SECURITY.md
-Keywords: wordpress,security,scanner,pentest,defensive,vulnerability,cve,wpscan
-Classifier: Development Status :: 5 - Production/Stable
-Classifier: Environment :: Console
-Classifier: Environment :: Win32 (MS Windows)
-Classifier: Intended Audience :: System Administrators
-Classifier: Intended Audience :: Information Technology
-Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
-Classifier: Operating System :: OS Independent
-Classifier: Programming Language :: Python :: 3
-Classifier: Programming Language :: Python :: 3.10
-Classifier: Programming Language :: Python :: 3.11
-Classifier: Programming Language :: Python :: 3.12
-Classifier: Topic :: Security
-Classifier: Topic :: Internet :: WWW/HTTP
-Requires-Python: >=3.10
-Description-Content-Type: text/markdown
-License-File: LICENSE
-License-File: NOTICE
-Requires-Dist: httpx[http2]<0.29,>=0.27
-Requires-Dist: jinja2<4,>=3.1
-Requires-Dist: rich<14,>=13.7
-Requires-Dist: openpyxl<4,>=3.1
-Requires-Dist: keyring<26,>=24
-Provides-Extra: pdf
-Requires-Dist: reportlab<5,>=4.0; extra == "pdf"
-Provides-Extra: browser
-Requires-Dist: playwright<2,>=1.40; extra == "browser"
-Provides-Extra: yaml
-Requires-Dist: pyyaml<7,>=6.0; extra == "yaml"
-Provides-Extra: ops
-Requires-Dist: redis<7,>=5.0; extra == "ops"
-Requires-Dist: bcrypt<5,>=4.0; extra == "ops"
-Provides-Extra: ui
-Requires-Dist: Pillow<12,>=10; extra == "ui"
-Requires-Dist: pystray<0.20,>=0.19; extra == "ui"
-Provides-Extra: security
-Requires-Dist: defusedxml<0.8,>=0.7; extra == "security"
-Provides-Extra: all
-Requires-Dist: reportlab<5,>=4.0; extra == "all"
-Requires-Dist: playwright<2,>=1.40; extra == "all"
-Requires-Dist: pyyaml<7,>=6.0; extra == "all"
-Requires-Dist: redis<7,>=5.0; extra == "all"
-Requires-Dist: bcrypt<5,>=4.0; extra == "all"
-Requires-Dist: Pillow<12,>=10; extra == "all"
-Requires-Dist: pystray<0.20,>=0.19; extra == "all"
-Requires-Dist: keyring<26,>=24; extra == "all"
-Requires-Dist: defusedxml<0.8,>=0.7; extra == "all"
-Provides-Extra: test
-Requires-Dist: pytest>=7.4; extra == "test"
-Dynamic: license-file
-
-# WPSecScan
-
-[![tests](https://github.com/bryanflowers/wpsecscan/actions/workflows/tests.yml/badge.svg)](https://github.com/bryanflowers/wpsecscan/actions/workflows/tests.yml)
-[![CVE feed](https://github.com/bryanflowers/wpsecscan/actions/workflows/cve-feed.yml/badge.svg)](https://github.com/bryanflowers/wpsecscan/actions/workflows/cve-feed.yml)
-[![license](https://img.shields.io/github/license/bryanflowers/wpsecscan)](LICENSE)
-[![release](https://img.shields.io/github/v/release/bryanflowers/wpsecscan)](https://github.com/bryanflowers/wpsecscan/releases/latest)
-[![downloads](https://img.shields.io/github/downloads/bryanflowers/wpsecscan/total)](https://github.com/bryanflowers/wpsecscan/releases)
-[![python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
-[![checks](https://img.shields.io/badge/checks-270-brightgreen)](FEATURES.md)
-[![CVE sources](https://img.shields.io/badge/CVE%20sources-8-blue)](docs/data-sources.md)
-[![tests passing](https://img.shields.io/badge/tests-780%20passing-brightgreen)](tests/)
-[![PyPI](https://img.shields.io/pypi/v/wpsecscan)](https://pypi.org/project/wpsecscan/)
-[![SLSA Level 3](https://img.shields.io/badge/SLSA-Level%203-success)](docs/verify-release.md)
-[![Sigstore signed](https://img.shields.io/badge/Sigstore-signed-blueviolet)](docs/verify-release.md)
-[![threat-intel](https://img.shields.io/badge/threat--intel-10%20providers-orange)](FEATURES.md)
-
-> **⚠ AUTHORIZED USE ONLY**
->
-> WPSecScan is a defensive security tool. Use it **only** on sites you own
-> or sites whose owner has given you **written permission** to test.
-> Unauthorised scanning is illegal in most jurisdictions (e.g. the US
-> Computer Fraud and Abuse Act, the UK Computer Misuse Act 1990, the EU
-> Network and Information Security Directive). The maintainers accept no
-> liability for misuse. By using this software you confirm you have the
-> required authorisation for every target you scan.
-
-**The most thoroughly-sourced WordPress vulnerability scanner — open source, AGPLv3, runs locally.**
-
-226 checks across 18 categories. **8-source nightly CVE aggregator**
-(NVD + GHSA + Mitre + OSV + Wordfence + WPVulnerability + CIRCL +
-Patchstack). **SLSA L3 + Sigstore-signed releases**. **10-provider
-threat-intel federation** (CISA KEV, EPSS, Exploit-DB, Metasploit,
-ATT&CK Navigator, STIX, MISP, OpenCTI, OTX, GreyNoise). **Continuous
-monitoring** (CT/DNS/WHOIS/RBL/honeypot/auto-rollback). **Active
-exploit verification** with strict consent gating. **Enterprise
-mode**: OIDC + SAML + RBAC + audit-log + approval workflow +
-multi-tenant + quotas. **Distribution**: Docker, K8s, Homebrew, Snap,
-Flatpak, winget, AUR, Chocolatey.
-
-Original headline:
-gives you a fresher and more complete vulnerability database than
-any single paid or free service. Runs entirely on your machine — no
-telemetry, no per-site licensing, no data leaves your box.
-
-Ships as two standalone Windows binaries — no Python required on the machine you run them on.
-
-- **`wpsecscan.exe`** — command-line scanner. Output: console + HTML + JSON + CSV + SARIF + Markdown + Excel (XLSX) + executive PDF + Burp scope XML + CycloneDX SBOM + shields.io status badge SVG.
-- **`wpsecscan-gui.exe`** — full GUI with live progress tree, finding details, risk score,
-  scan profiles, multi-target queue, scheduled scans, webhook alerts, exploit playbooks, and more.
-- **`wpsecscan-companion.zip`** — WordPress plugin that exposes a read-only, token-gated
-  REST endpoint so the scanner gets authoritative diagnostics in one round-trip (3× more
-  accurate plugin/theme detection vs HTTP-probe guessing).
-
-### Why people are switching to WPSecScan
-
-- **8-source CVE aggregator** runs nightly on our infrastructure — pulls
-  Wordfence + NVD + GitHub Security Advisories + Mitre CVE List + OSV.dev +
-  WPVulnerability.com + CIRCL + Patchstack and merges them into one feed.
-  Users get a strictly fresher + more complete DB than Wordfence/Patchstack
-  alone. **6 of 8 sources are fully free, no key required.**
-- **Daily DB refresh + per-CVE webhook alerts** — `wpsecscan schedule
-  install` registers a daily 02:00 CVE-refresh + weekly 03:00 site scan
-  on Windows Task Scheduler / macOS launchd / Linux systemd.
-  `wpsecscan db subscribe https://hooks.slack.com/...` fires the moment a
-  new CVE drops for a plugin you have installed.
-- **15 compliance frameworks mapped** per check: OWASP Top 10 + MITRE
-  ATT&CK + CWE + D3FEND + PCI-DSS 4.0 + NIST 800-53 + ISO 27001 + HIPAA +
-  FERPA + SOC 2 + FedRAMP + GDPR + HITRUST CSF v11.4 + CMMC 2.0 +
-  NIST CSF 2.0 + CIS Critical Controls v8 + ISO 27001:2022 Annex A.
-- **11 report formats**: HTML, JSON, CSV, SARIF 2.1.0, Markdown, Excel
-  (XLSX with per-OWASP-category sheets), executive PDF, CycloneDX SBOM,
-  Burp Suite scope XML, attestation PDF, shields.io status-badge SVG.
-- **10 third-party integrations** including Burp Suite project XML,
-  OWASP ZAP findings import, Nuclei template auto-pull, JIRA / Linear /
-  GitHub Issues bulk-create, Wordfence Cloud sync, Sucuri SiteCheck,
-  Patchstack + WPScan write-back, WP Engine / Kinsta / WP.com host APIs.
-- **AI-assisted remediation** with PII masking + prompt-injection guard +
-  per-backend cost tracking. Bring your own OpenAI / Anthropic / Ollama /
-  llama.cpp key. **`WPSECSCAN_NO_AI=1` to hard-disable.**
-- **Privacy-first**: no telemetry, runs locally, supports SOCKS5/HTTP
-  proxies (Tor friendly), `WPSECSCAN_NO_NETWORK=1` for air-gapped mode.
-
----
-
-## Quick install
-
-### Option A — `pip install wpsecscan` (any platform)
-
-The simplest path on Linux, macOS, or Windows-with-Python:
-
-```bash
-pip install wpsecscan
-wpsecscan --version
-wpsecscan https://example.com --json-only
-```
-
-PyPI: <https://pypi.org/project/wpsecscan/>
-
-For the optional GUI minimize-to-tray feature, install with the
-`[ui]` extra (pulls in Pillow + pystray):
-
-```bash
-pip install "wpsecscan[ui]"
-```
-
-Other optional extras: `[pdf]` (reportlab for true PDF exec reports),
-`[browser]` (playwright for headless DOM-XSS), `[yaml]` (pyyaml for
-daemon config), `[ops]` (redis + bcrypt for enterprise mode), or
-`[all]` to install everything.
-
-### Option B — pre-built Windows binaries
-
-1. Open `dist\` in this folder.
-2. Copy `wpsecscan.exe` and `wpsecscan-gui.exe` somewhere on your PATH
-   (e.g. `C:\Tools\` or `C:\Users\<you>\bin\`).
-3. Done. No Python, no installer, no admin rights needed.
-
-The first time you run them, Windows SmartScreen may warn that the publisher is unknown
-(the binaries aren't code-signed). Click **More info → Run anyway**.
-
-### Option C — build from source
-
-Requires Python 3.10+ and PyInstaller. Open PowerShell in the project root:
-
-```powershell
-.\build.ps1
-```
-
-This creates a virtualenv in `.venv\`, installs dependencies from `requirements.txt`,
-and runs PyInstaller. Output:
-
-```
-dist\wpsecscan.exe                  # CLI (~17 MB)
-dist\wpsecscan-gui.exe       # GUI (~17 MB)
-```
-
-Both are single-file executables — copy them anywhere and they run on their own.
-
-### Option D — run from source directly (development)
-
-```powershell
-python -m venv .venv
-.\.venv\Scripts\Activate.ps1
-pip install .
-python run.py https://example.com         # CLI
-python run_gui.py                          # GUI
-pytest                                     # 780 tests
-```
-
----
-
-## First scan
-
-### GUI
-
-1. Double-click `wpsecscan-gui.exe`.
-2. Paste a URL into the URL field (e.g. `https://your-wp-site.com`).
-3. Click **Scan**. Watch the live tree on the left and click any finding to read
-   evidence, remediation, and the *Exploit Playbook* (concrete sqlmap/Metasploit/curl/nuclei commands).
-4. When the scan finishes, the **Risk Score** badge at the top shows `0-100` color-coded
-   (green/yellow/orange/red). HTML and JSON reports are saved to your user folder.
-
-### CLI
-
-```powershell
-# Simple scan, HTML + JSON saved to current directory
-wpsecscan.exe https://your-wp-site.com
-
-# Custom output folder
-wpsecscan.exe https://your-wp-site.com --out C:\scans\
-
-# JSON only, no HTML
-wpsecscan.exe https://your-wp-site.com --json-only --out C:\scans\
-
-# Multiple targets from a file
-wpsecscan.exe --file my-sites.txt --concurrency 5 --out C:\scans\
-
-# Aggressive mode (active payload checks — SQLi, XSS, SSRF, etc.)
-wpsecscan.exe https://your-wp-site.com --aggressive
-
-# Authenticated scan
-wpsecscan.exe https://your-wp-site.com --auth-user admin --auth-pass <pwd>
-
-# Use a saved WPScan API token for richer plugin CVE lookups
-wpsecscan.exe https://your-wp-site.com --wpscan-token <KEY>
-```
-
-**Exit codes**: `0` = clean / info only · `1` = medium findings · `2` = critical or high findings · `130` = Ctrl+C.
-
----
-
-## What it checks (226 checks)
-
-Passive checks always run; aggressive checks need `--aggressive`.
-
-- **Recon**: WP core version · plugin enum (slug + version) · theme enum · user enum (`?author=`, REST `wp/v2/users`)
-- **Surface**: 40+ exposed-path probes (`.env`, `wp-config.php.bak`, `.git/config`, debug.log, backup-plugin dumps, phpinfo, adminer, …) · WebDAV / OPTIONS enum · beta/test/debug query-parameter discovery
-- **Auth surface**: `wp-login.php` + XML-RPC method enum + `system.multicall` amplifier check + rate-limit probe · OAuth2/OIDC discovery audit · SAML / XSW endpoint discovery · JWT audit (`alg=none` + weak HS256 brute-force)
-- **Transport**: TLS version, cert expiry, HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie flags
-- **APIs**: REST namespace map, REST OPTIONS write-method enum, WPGraphQL introspection, CORS misconfig (full preflight matrix incl. `null` origin reflection)
-- **Defensive posture**: WAF / CDN detection · WAF rule-set identification (CRS / AWS / Cloudflare Managed / Wordfence Premium) · DNS SPF / DMARC / DKIM · security.txt · AbuseIPDB reputation (opt-in)
-- **Supply-chain**: external JS hosts + SRI hash check · source-map exposure · JS library version audit · S3 bucket discovery + public-ACL probe · GitHub leaked-token search (opt-in, scans your domain against AKIA/sk_live_/ghp_/etc.)
-- **Subdomain attack surface**: certificate-transparency discovery · dangling-CDN takeover candidates · **cookie-tossing chain** detection (apex-cookie + takeover-able subdomain)
-- **Server fingerprint**: Server-Timing, X-Request-ID, X-Debug-Token leaks
-- **CVE matching**: 7000+ Wordfence CVEs + 307 high-confidence exploit signatures + 224 modern payloads · CISA KEV catalog enrichment · EPSS percentile scoring · VirusTotal URL/IP enrichment (opt-in)
-- **Aggressive** (`--aggressive`): SQLi (error-based + time-blind escalator) · reflected XSS · SSRF · path traversal · open redirect · file upload · default credentials (max 10) · SSTI (7 template engines) · NoSQL operator injection · path-normalisation bypass (`..%2f`, `..;/`, …) · race-condition probe (parallel POSTs) · active HTTP smuggling (CL.TE / TE.CL) · headless DOM-XSS (Playwright, optional)
-- **Deep** (`--deep-throttle`): 10-500 wrong-password attempts at 5-60s pacing to map your login throttle threshold (synthetic non-existent user, fixed wrong password — never brute-force)
-- **Authenticated** (`--auth-user`/`--auth-pass`): logs in, audits user roles, plugins, Site Health, options
-
-### Round-54 additions (Nov 2026 — A1-G4 catalogue)
-
-WPSecScan grew from 80 → 94 checks plus a wide non-check toolkit:
-
-| Area | New |
-|------|-----|
-| **Active probes** | `ssti`, `nosql_injection`, `path_bypass`, `race_condition`, `dom_xss_headless` (Playwright optional) |
-| **Passive / intel checks** | `webdav`, `dev_params`, `abuseipdb_lookup` (`--abuseipdb-token`), `waf_ruleset`, `oauth_oidc`, `saml_xsw`, `s3_bucket_discovery`, `github_leak_search` (`--github-search-token`), `jwt_audit` |
-| **Modified checks** | `subdomains` (B7 cookie-tossing chain), `cors` (B8 preflight matrix incl. `Origin: null`), `sqli` (A3 time-blind escalator), `smuggling_probe` (A6 active CL.TE/TE.CL) |
-| **Threat-intel integrations** | CISA KEV, EPSS, VirusTotal, Sucuri SiteCheck, NVD/Wordfence CVE explainer |
-| **Per-check tags** | new `cwe` (e.g. `CWE-79`) + `d3fend` (e.g. `D3-IVA`) fields in `data/check_tags.json` |
-| **Reporters** | one-page executive PDF (`--exec-pdf`, uses reportlab or HTML fallback) · two-report drag-and-drop HTML diff viewer · Burp Suite scope XML (`--burp-export`) · severity × OWASP-category SVG heatmap embedded in HTML report |
-| **CLI flags** | `--fail-on`, `--diff-against`, `--shell`, `--replay-har`, `--daemon`, `--abuseipdb-token`, `--vt-token`, `--github-search-token`, `--burp-export`, `--exec-pdf` |
-| **GUI windows** | step-by-step exploit-playbook walker (right-click any finding) · drill historical findings by OWASP/ATT&CK/CWE/D3FEND tag · multi-URL risk-score trend overlay · drop-in marketplace browser · 5-step first-run tutorial |
-| **Collab** | assign-owner + comment threads per finding (right-click) |
-| **Infra / docs** | `.github/workflows/wpsecscan.yml` (nightly + PR scans) · GitLab CI / Jenkins / Azure DevOps templates in `ci/` · `Dockerfile` + `docker-compose.yml` · `SDK.md` · `DISTRIBUTED-SCAN.md` · audit-log JSONL of every scan invocation · custom signature / payload drop-in (`~/.wpsecscan/{signatures,payloads}/`) · i18n stub (en + es) |
-
----
-
-## Output formats
-
-Every scan produces:
-
-| Flag                | File                     | Use case                                |
-|---------------------|--------------------------|-----------------------------------------|
-| (default)           | `<host>-<ts>.html`       | Open in a browser. Has copy-to-clipboard buttons for every command, color-coded exploit playbooks, and a "🖨 Print / Save as PDF" button in the top-right corner. |
-| (default)           | `<host>-<ts>.json`       | Includes per-finding `confidence` (low/medium/high) and per-check `tags` (OWASP Top 10 + MITRE ATT&CK). For downstream tooling. |
-| `--csv`             | `<host>-<ts>.csv`        | Spreadsheet import. Cells are escaped against Excel formula-injection. |
-| `--sarif`           | `<host>-<ts>.sarif`      | GitHub Code Scanning, Azure DevOps, anything that ingests SARIF 2.1.0. |
-| `--json-only`       | suppresses HTML          | CI / scripted use. |
-| `--md`              | `<host>-<ts>.md`         | Markdown report for Confluence / GitHub / Slack threads. |
-| `--xlsx`            | `<host>-<ts>.xlsx`       | Excel workbook with per-OWASP-category sheets. |
-| `--har FILE.har`    | `FILE.har`               | HAR 1.2 recording of every HTTP request (Cookie/Authorization redacted). Replay with `--replay-har`. |
-| `--burp-export`     | `<host>-<ts>-burp-scope.xml` | Burp Suite scope XML for hand-off to manual testing. |
-| `--exec-pdf`        | `<host>-<ts>-exec.pdf`   | One-page non-technical executive summary. Uses `reportlab` if installed, else writes a print-friendly HTML file. |
-
-### Round-54 CLI additions
-
-| Flag                                  | Purpose                                                                                  |
-|---------------------------------------|------------------------------------------------------------------------------------------|
-| `--fail-on critical\|high\|medium`    | Override exit-code logic — non-zero only when a finding meets or exceeds the threshold.  |
-| `--diff-against BASELINE.json`        | Compute the NEW / RESOLVED delta vs a saved JSON report, print to stdout.                |
-| `--shell`                             | After scan, drop into a Python REPL with `report` pre-bound (for power users / IR).      |
-| `--replay-har HAR_FILE`               | Re-run every request in a HAR file; optionally override the origin with `<target>`.      |
-| `--daemon CONFIG.yml`                 | Cron-style scheduled scans driven by a YAML config (no Task Scheduler required).         |
-| `--abuseipdb-token TOKEN`             | Enables the AbuseIPDB reputation check for the target's IP.                              |
-| `--vt-token TOKEN`                    | Enables VirusTotal URL/IP enrichment.                                                    |
-| `--github-search-token PAT`           | Enables GitHub code-search for the target's domain + common secret prefixes.             |
-
-### Round-56 visibility flags
-
-| Flag                                  | Purpose                                                                                  |
-|---------------------------------------|------------------------------------------------------------------------------------------|
-| `--demo`                              | Synthetic scan against a fake target — every check fires fake findings, every integration fires a fake activity event. Writes one of every artifact to `~/.wpsecscan/demo/`. Great for screenshots, smoke-testing an install, or training new users. |
-| `--no-live`                           | Disable the live multi-panel rich dashboard during scans. The static console reporter still renders at the end. Useful for CI logs / piped output. |
-
----
-
-## Power-user features (GUI)
-
-- **Risk score**: 0–100, color-coded. Calculated from severity weights with per-tier caps.
-- **Profiles** (File → Profiles): save the current toggle/pacing/threshold set as `"Quick"`, `"Deep"`, `"Audit"` etc. Loads with one click. Stored in `~/.wpsecscan/profiles.json`.
-- **Recent URLs**: the URL field is a dropdown of the last 20 scanned sites.
-- **Diff with last scan**: button appears after a scan if a previous JSON for the same URL exists in `~/.wpsecscan/reports/`. Shows `[NEW]` / `[RESOLVED]` per finding.
-- **Multi-target scan** (Tools → Multi-target): paste/load a list of URLs, scan each in turn, one-row-per-site dashboard with risk score and Δ-vs-last-scan.
-- **Scheduled recurring scan** (Tools → Schedule): registers a Windows Task Scheduler job (`WPSecScan_<host>`) that runs daily/weekly/monthly at a chosen time. Outputs to a folder you pick. Remove with `schtasks /Delete /TN WPSecScan_<host> /F`.
-- **Risk-score trend** (Tools → Show risk trend): ASCII sparkline of historical scores for the current URL.
-- **Webhook notify** (File → Settings → "Webhook notify"): one POST to Slack/Discord/Teams/PagerDuty when a scan finds ≥ chosen severity. Hosts validated against an allow-list — won't post to arbitrary URLs or raw IPs.
-- **Finding annotations**: right-click any finding → "Accepted risk" / "False positive" with an optional note. Persisted per-URL in `~/.wpsecscan/annotations.json`.
-- **Filter pills**: Only NEW (vs last scan), Only CONFIRMED (signature engine actively verified), Hide annotated, per-severity show/hide.
-- **Exploit playbook**: every finding's detail pane includes concrete attacker-side commands (curl PoCs · sqlmap · Metasploit · nuclei · wpscan · ffuf) with `{target}` already substituted, plus a plain-English *"How an attacker uses this"* paragraph.
-- **OWASP + MITRE chips**: every check is tagged with its OWASP Top 10 category (e.g. `A03:2021`) and MITRE ATT&CK technique (e.g. `T1190`). Shown inline in the GUI and console.
-- **Exploit confidence**: each finding carries a confidence badge (HIGH / MED / LOW) separate from severity — `[CONFIRMED]` findings are HIGH; presence of a WAF downgrades unconfirmed findings by one tier.
-- **Cancel-mid-scan**: clicking Cancel during the 20-min deep throttle test returns a partial result with what was learned so far.
-
----
-
-## CLI flag reference (most-used)
-
-```
-USAGE: wpsecscan.exe [URL] [options]
-
-Targets:
-  URL                          A single site (https://example.com)
-  --file FILE                  Newline-separated list of URLs
-
-Output:
-  --out PATH                   Output directory or filename stem (default: cwd)
-  --json-only                  Suppress HTML
-  --html-only                  Suppress JSON
-  --csv                        Also write CSV
-  --sarif                      Also write SARIF 2.1.0
-  --quiet, -q                  Suppress the colored console table (alias: --no-console)
-  -v / -vv                     Increase console verbosity (per-check / HTTP-level)
-
-Modes:
-  --aggressive                 Enable active payload checks (SQLi, XSS, SSRF, etc.)
-  --prove                      For each confirmed aggressive finding, run a read-only
-                               proof extractor. Requires --aggressive. Read-only.
-  --deep-throttle              Run the deep login-throttle mapper
-  --deep-throttle-attempts N   (10-500, default 120)
-  --deep-throttle-pacing S     (5-60 seconds, default 10)
-  --auth-user USER             Admin username for authenticated scan (env: WPSECSCAN_AUTH_USER)
-  --auth-pass PASS             Admin password (env: WPSECSCAN_AUTH_PASS; use `-` to read from stdin)
-  --ssh-audit user@host        Connect via SSH and run a read-only wp-cli audit
-  --password-audit FILE        Offline: convert wp_users dump to a hashcat-ready file (NO network)
-
-Tuning:
-  --timeout SECONDS            Per-request timeout (default 15)
-  --concurrency N              Concurrent requests per host (default 10)
-  --user-agent STRING          Custom User-Agent
-  --insecure                   Don't verify TLS certs
-  --wpscan-token TOKEN         WPScan API token (richer plugin CVE data)
-  --hibp-token TOKEN           HaveIBeenPwned API key
-
-Maintenance:
-  --update-db                  Refresh the Wordfence vulnerability database
-                               (exits 75 on remote-fetch failure for CI detection)
-  --diff OLD.json NEW.json     Diff two saved JSON reports
-  --baseline BASELINE.json     Diff scan-in-progress against a saved baseline (alias: --diff-against)
-  --debug                      Verbose internal logging to ~/.wpsecscan/logs/
-  --completion {bash,zsh,powershell}   Print shell-completion script and exit
-  --version
-
-Subcommands (run `wpsecscan <subcommand> --help` for details):
-  sites          Manage a list of sites (add/list/scan/remove)
-  schedule       Install/uninstall a Windows-Scheduler / launchd / systemd cron
-  digest         Configure SMTP / webhook digests of new findings
-  ai-cost        Print AI-triage cost summary
-  ai-options     Read/set Advanced AI-triage toggles
-  analytics      Manage opt-in analytics
-  db             vuln DB management (status / update / signatures / source-stats / subscribe / alert-check)
-  compare URL    Diff the two most-recent saved snapshots of a URL
-  badge URL      Emit a shields.io-style SVG of the latest scan grade
-```
-
----
-
-## Configuration files
-
-Everything is stored in `~/.wpsecscan/` (i.e. `C:\Users\<you>\.wpsecscan\`):
-
-| Path                                         | Purpose                                                  |
-|----------------------------------------------|----------------------------------------------------------|
-| `history.json`                               | Last 20 scanned URLs (GUI dropdown)                      |
-| `profiles.json`                              | Named scan profiles (toggles + deep-throttle settings)   |
-| `settings.json`                              | Tokens saved via the GUI onboarding wizard               |
-| `sites.json`                                 | Managed-sites list for `wpsecscan sites` + scheduling    |
-| `schedule_state.json`                        | Cron-style state for `wpsecscan schedule`                |
-| `digest.json`                                | Configured SMTP / webhook digest destinations            |
-| `annotations.json`                           | Per-finding annotations (accepted-risk / FP)             |
-| `comments.json`                              | Per-finding free-text comments                           |
-| `stars.json`                                 | Starred findings (GUI sidebar)                           |
-| `disabled_checks.json`                       | Persistently disabled check IDs                          |
-| `reports/{host}.json`                        | Latest-scan snapshot per URL (canonical)                 |
-| `reports/{host}-{YYYYmmdd-HHMMSS}.json`      | Timestamped snapshot history (for `compare`, trend)      |
-| `cache/wporg/{slug}.json`                    | 24h-cached wp.org plugin metadata (plugin_cemetery)      |
-| `checkpoints/`                               | `--checkpoint` resumable scan state                      |
-| `logs/`                                      | `--debug` log files                                      |
-| `demo/`                                      | `--demo` synthetic-scan artifacts                        |
-| `analytics/events.jsonl`                     | Opt-in analytics (off by default; `wpsecscan analytics`) |
-| `wordfence.json`                             | Local cache of the aggregated CVE database               |
-
-Override the base dir with the `WPSECSCAN_HOME` environment variable.
-
-### Shell completions
-
-```powershell
-# bash
-wpsecscan --completion bash > /etc/bash_completion.d/wpsecscan
-
-# zsh
-wpsecscan --completion zsh > "${fpath[1]}/_wpsecscan"
-
-# PowerShell
-wpsecscan --completion powershell | Out-File -Append $PROFILE
-```
-
-Restart the shell to activate.
-
-### Secrets via env vars
-
-Every sensitive flag — `--auth-pass`, `--auth-app-password`,
-`--companion-token`, `--proxy-auth`, `--wpscan-token`,
-`--patchstack-token`, `--hibp-token`, `--vt-token`, `--abuseipdb-token`,
-`--github-search-token` — reads from a matching `WPSECSCAN_<UPPER>`
-environment variable when not passed on the CLI. Use `--auth-pass -`
-to read the password from stdin via `getpass` (stops it leaking into
-`ps aux` / shell history).
-
----
-
-## Safety
-
-- **Use only on sites you own** or have written permission to test. Online password
-  brute-force is permanently out of scope. The "deep throttle" probe uses a synthetic
-  non-existent username and a fixed wrong password — it maps your defense, it does
-  not guess passwords.
-- All active payloads are read-only. The payload library is enforced at load-time
-  with a pytest invariant that scans for any write-side operations.
-- The webhook URL allow-list rejects raw IPs, internal addresses (incl. AWS metadata
-  at `169.254.169.254`), and unknown hosts.
-- Authenticated scans run with the credentials you provide but never log them.
-- The scheduled-task URL validator enforces a strict regex to prevent shell-meta
-  injection in the registered `schtasks` command.
-
----
-
-## Troubleshooting
-
-**"Windows protected your PC" SmartScreen warning** — click *More info → Run anyway*.
-The binaries aren't code-signed.
-
-**Defender quarantines `wpsecscan.exe` with `Backdoor:JS/Chopper.GG!dha`** — known false positive.
-This is a defensive scanner: to **detect** webshells (China Chopper, c99, r57) on your sites
-it ships references to those attack patterns. Defender's pattern-matching heuristic flags
-the .exe even though it never executes any of those patterns locally. The same kind of
-detection trips sqlmap, Metasploit, nuclei, and Gophish — all legitimate security tools.
-
-**Three ways to fix it:**
-
-1. **In the GUI**: a dialog pops up on first launch with an "Add exclusion now (UAC)"
-   button. You can also open it any time via *Tools → Add Windows Defender exclusion...*
-
-2. **From admin PowerShell** (manual, one line):
-   ```powershell
-   Add-MpPreference -ExclusionPath 'C:\path\to\dist'
-   ```
-   Replace `C:\path\to\dist` with the actual folder containing the `.exe` binaries.
-
-3. **Via the bundled helper script** (auto-detects the binary location, prompts UAC):
-   ```powershell
-   .\scripts\add-defender-exclusion.ps1
-   ```
-
-**To restore a quarantined file**: *Windows Security → Virus & threat protection →
-Protection history → Allow*.
-
-**This program does NOT**:
-- Install a backdoor on your computer.
-- Open any listening port on your machine.
-- Send data anywhere except to the WordPress URLs you type in.
-- Run any of the webshells in its signature list — those are strings used to RECOGNISE
-  webshells on *your sites*, not to execute them.
-
-**"DB: not loaded — click Refresh"** in the GUI — click *Refresh vuln DB*. Or from the CLI: `wpsecscan.exe --update-db`.
-
-**Scan stalls on a hung target** — `--timeout 5` cuts the per-request wait.
-
-**Multi-target scan freezes for one bad URL** — each URL has its own per-request
-timeout. If one consistently hangs, drop it from the list.
-
-**Cron / scheduled-task entries pile up** — list them with `schtasks /Query /TN WPSecScan_*` and remove individually with `schtasks /Delete /TN <name> /F`.
-
-**GUI crashes immediately on launch** — check `C:\Users\<you>\.wpsecscan\` is writable.
-Run from a terminal to see the traceback: `wpsecscan-gui.exe` (the windowed
-build suppresses console output by design — run via `python run_gui.py` from a checkout
-to see errors).
-
----
-
-## Inventory
-
-| Category                  | Count |
-|---------------------------|-------|
-| Checks                    | **226** |
-| Payloads                  | **224** |
-| Exploit signatures        | **307** |
-| Plugin CVE database       | ~7,000 (Wordfence) + 7 other sources via the nightly aggregator |
-| Exploit-playbook entries  | **25** |
-| Tests                     | **667** |
-
----
-
-## License & disclaimer
-
-Licensed under **AGPLv3+** (from v1.9.0 onward — v1.0.0..v1.8.0 were MIT).
-See [LICENSE](LICENSE) and [NOTICE](NOTICE).
-
-**AGPL network clause**: if you run a modified WPSecScan as a hosted service
-(SaaS, web UI, paid scanning tier), you must publish your modified source
-under the same AGPLv3+ terms. Private internal use and modifications stay
-private. For commercial-distribution licensing terms outside AGPLv3,
-contact bryaninbangkok@gmail.com.
-
-This tool is for **defensive use** on sites you own. Use against third-party
-sites without explicit written permission is illegal in most jurisdictions
-under the Computer Fraud and Abuse Act (US) / Computer Misuse Act (UK) /
-equivalent laws elsewhere.
-
-The authors take no responsibility for misuse.
+Metadata-Version: 2.4
+Name: wpsecscan
+Version: 2.7.3
+Summary: Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only.
+Author-email: Bryan <bryaninbangkok@gmail.com>
+License:                     GNU AFFERO GENERAL PUBLIC LICENSE
+                               Version 3, 19 November 2007
+        
+         Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+         Everyone is permitted to copy and distribute verbatim copies
+         of this license document, but changing it is not allowed.
+        
+                                    Preamble
+        
+          The GNU Affero General Public License is a free, copyleft license for
+        software and other kinds of works, specifically designed to ensure
+        cooperation with the community in the case of network server software.
+        
+          The licenses for most software and other practical works are designed
+        to take away your freedom to share and change the works.  By contrast,
+        our General Public Licenses are intended to guarantee your freedom to
+        share and change all versions of a program--to make sure it remains free
+        software for all its users.
+        
+          When we speak of free software, we are referring to freedom, not
+        price.  Our General Public Licenses are designed to make sure that you
+        have the freedom to distribute copies of free software (and charge for
+        them if you wish), that you receive source code or can get it if you
+        want it, that you can change the software or use pieces of it in new
+        free programs, and that you know you can do these things.
+        
+          Developers that use our General Public Licenses protect your rights
+        with two steps: (1) assert copyright on the software, and (2) offer
+        you this License which gives you legal permission to copy, distribute
+        and/or modify the software.
+        
+          A secondary benefit of defending all users' freedom is that
+        improvements made in alternate versions of the program, if they
+        receive widespread use, become available for other developers to
+        incorporate.  Many developers of free software are heartened and
+        encouraged by the resulting cooperation.  However, in the case of
+        software used on network servers, this result may fail to come about.
+        The GNU General Public License permits making a modified version and
+        letting the public access it on a server without ever releasing its
+        source code to the public.
+        
+          The GNU Affero General Public License is designed specifically to
+        ensure that, in such cases, the modified source code becomes available
+        to the community.  It requires the operator of a network server to
+        provide the source code of the modified version running there to the
+        users of that server.  Therefore, public use of a modified version, on
+        a publicly accessible server, gives the public access to the source
+        code of the modified version.
+        
+          An older license, called the Affero General Public License and
+        published by Affero, was designed to accomplish similar goals.  This is
+        a different license, not a version of the Affero GPL, but Affero has
+        released a new version of the Affero GPL which permits relicensing under
+        this license.
+        
+          The precise terms and conditions for copying, distribution and
+        modification follow.
+        
+                               TERMS AND CONDITIONS
+        
+          0. Definitions.
+        
+          "This License" refers to version 3 of the GNU Affero General Public License.
+        
+          "Copyright" also means copyright-like laws that apply to other kinds of
+        works, such as semiconductor masks.
+        
+          "The Program" refers to any copyrightable work licensed under this
+        License.  Each licensee is addressed as "you".  "Licensees" and
+        "recipients" may be individuals or organizations.
+        
+          To "modify" a work means to copy from or adapt all or part of the work
+        in a fashion requiring copyright permission, other than the making of an
+        exact copy.  The resulting work is called a "modified version" of the
+        earlier work or a work "based on" the earlier work.
+        
+          A "covered work" means either the unmodified Program or a work based
+        on the Program.
+        
+          To "propagate" a work means to do anything with it that, without
+        permission, would make you directly or secondarily liable for
+        infringement under applicable copyright law, except executing it on a
+        computer or modifying a private copy.  Propagation includes copying,
+        distribution (with or without modification), making available to the
+        public, and in some countries other activities as well.
+        
+          To "convey" a work means any kind of propagation that enables other
+        parties to make or receive copies.  Mere interaction with a user through
+        a computer network, with no transfer of a copy, is not conveying.
+        
+          An interactive user interface displays "Appropriate Legal Notices"
+        to the extent that it includes a convenient and prominently visible
+        feature that (1) displays an appropriate copyright notice, and (2)
+        tells the user that there is no warranty for the work (except to the
+        extent that warranties are provided), that licensees may convey the
+        work under this License, and how to view a copy of this License.  If
+        the interface presents a list of user commands or options, such as a
+        menu, a prominent item in the list meets this criterion.
+        
+          1. Source Code.
+        
+          The "source code" for a work means the preferred form of the work
+        for making modifications to it.  "Object code" means any non-source
+        form of a work.
+        
+          A "Standard Interface" means an interface that either is an official
+        standard defined by a recognized standards body, or, in the case of
+        interfaces specified for a particular programming language, one that
+        is widely used among developers working in that language.
+        
+          The "System Libraries" of an executable work include anything, other
+        than the work as a whole, that (a) is included in the normal form of
+        packaging a Major Component, but which is not part of that Major
+        Component, and (b) serves only to enable use of the work with that
+        Major Component, or to implement a Standard Interface for which an
+        implementation is available to the public in source code form.  A
+        "Major Component", in this context, means a major essential component
+        (kernel, window system, and so on) of the specific operating system
+        (if any) on which the executable work runs, or a compiler used to
+        produce the work, or an object code interpreter used to run it.
+        
+          The "Corresponding Source" for a work in object code form means all
+        the source code needed to generate, install, and (for an executable
+        work) run the object code and to modify the work, including scripts to
+        control those activities.  However, it does not include the work's
+        System Libraries, or general-purpose tools or generally available free
+        programs which are used unmodified in performing those activities but
+        which are not part of the work.  For example, Corresponding Source
+        includes interface definition files associated with source files for
+        the work, and the source code for shared libraries and dynamically
+        linked subprograms that the work is specifically designed to require,
+        such as by intimate data communication or control flow between those
+        subprograms and other parts of the work.
+        
+          The Corresponding Source need not include anything that users
+        can regenerate automatically from other parts of the Corresponding
+        Source.
+        
+          The Corresponding Source for a work in source code form is that
+        same work.
+        
+          2. Basic Permissions.
+        
+          All rights granted under this License are granted for the term of
+        copyright on the Program, and are irrevocable provided the stated
+        conditions are met.  This License explicitly affirms your unlimited
+        permission to run the unmodified Program.  The output from running a
+        covered work is covered by this License only if the output, given its
+        content, constitutes a covered work.  This License acknowledges your
+        rights of fair use or other equivalent, as provided by copyright law.
+        
+          You may make, run and propagate covered works that you do not
+        convey, without conditions so long as your license otherwise remains
+        in force.  You may convey covered works to others for the sole purpose
+        of having them make modifications exclusively for you, or provide you
+        with facilities for running those works, provided that you comply with
+        the terms of this License in conveying all material for which you do
+        not control copyright.  Those thus making or running the covered works
+        for you must do so exclusively on your behalf, under your direction
+        and control, on terms that prohibit them from making any copies of
+        your copyrighted material outside their relationship with you.
+        
+          Conveying under any other circumstances is permitted solely under
+        the conditions stated below.  Sublicensing is not allowed; section 10
+        makes it unnecessary.
+        
+          3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+        
+          No covered work shall be deemed part of an effective technological
+        measure under any applicable law fulfilling obligations under article
+        11 of the WIPO copyright treaty adopted on 20 December 1996, or
+        similar laws prohibiting or restricting circumvention of such
+        measures.
+        
+          When you convey a covered work, you waive any legal power to forbid
+        circumvention of technological measures to the extent such circumvention
+        is effected by exercising rights under this License with respect to
+        the covered work, and you disclaim any intention to limit operation or
+        modification of the work as a means of enforcing, against the work's
+        users, your or third parties' legal rights to forbid circumvention of
+        technological measures.
+        
+          4. Conveying Verbatim Copies.
+        
+          You may convey verbatim copies of the Program's source code as you
+        receive it, in any medium, provided that you conspicuously and
+        appropriately publish on each copy an appropriate copyright notice;
+        keep intact all notices stating that this License and any
+        non-permissive terms added in accord with section 7 apply to the code;
+        keep intact all notices of the absence of any warranty; and give all
+        recipients a copy of this License along with the Program.
+        
+          You may charge any price or no price for each copy that you convey,
+        and you may offer support or warranty protection for a fee.
+        
+          5. Conveying Modified Source Versions.
+        
+          You may convey a work based on the Program, or the modifications to
+        produce it from the Program, in the form of source code under the
+        terms of section 4, provided that you also meet all of these conditions:
+        
+            a) The work must carry prominent notices stating that you modified
+            it, and giving a relevant date.
+        
+            b) The work must carry prominent notices stating that it is
+            released under this License and any conditions added under section
+            7.  This requirement modifies the requirement in section 4 to
+            "keep intact all notices".
+        
+            c) You must license the entire work, as a whole, under this
+            License to anyone who comes into possession of a copy.  This
+            License will therefore apply, along with any applicable section 7
+            additional terms, to the whole of the work, and all its parts,
+            regardless of how they are packaged.  This License gives no
+            permission to license the work in any other way, but it does not
+            invalidate such permission if you have separately received it.
+        
+            d) If the work has interactive user interfaces, each must display
+            Appropriate Legal Notices; however, if the Program has interactive
+            interfaces that do not display Appropriate Legal Notices, your
+            work need not make them do so.
+        
+          A compilation of a covered work with other separate and independent
+        works, which are not by their nature extensions of the covered work,
+        and which are not combined with it such as to form a larger program,
+        in or on a volume of a storage or distribution medium, is called an
+        "aggregate" if the compilation and its resulting copyright are not
+        used to limit the access or legal rights of the compilation's users
+        beyond what the individual works permit.  Inclusion of a covered work
+        in an aggregate does not cause this License to apply to the other
+        parts of the aggregate.
+        
+          6. Conveying Non-Source Forms.
+        
+          You may convey a covered work in object code form under the terms
+        of sections 4 and 5, provided that you also convey the
+        machine-readable Corresponding Source under the terms of this License,
+        in one of these ways:
+        
+            a) Convey the object code in, or embodied in, a physical product
+            (including a physical distribution medium), accompanied by the
+            Corresponding Source fixed on a durable physical medium
+            customarily used for software interchange.
+        
+            b) Convey the object code in, or embodied in, a physical product
+            (including a physical distribution medium), accompanied by a
+            written offer, valid for at least three years and valid for as
+            long as you offer spare parts or customer support for that product
+            model, to give anyone who possesses the object code either (1) a
+            copy of the Corresponding Source for all the software in the
+            product that is covered by this License, on a durable physical
+            medium customarily used for software interchange, for a price no
+            more than your reasonable cost of physically performing this
+            conveying of source, or (2) access to copy the
+            Corresponding Source from a network server at no charge.
+        
+            c) Convey individual copies of the object code with a copy of the
+            written offer to provide the Corresponding Source.  This
+            alternative is allowed only occasionally and noncommercially, and
+            only if you received the object code with such an offer, in accord
+            with subsection 6b.
+        
+            d) Convey the object code by offering access from a designated
+            place (gratis or for a charge), and offer equivalent access to the
+            Corresponding Source in the same way through the same place at no
+            further charge.  You need not require recipients to copy the
+            Corresponding Source along with the object code.  If the place to
+            copy the object code is a network server, the Corresponding Source
+            may be on a different server (operated by you or a third party)
+            that supports equivalent copying facilities, provided you maintain
+            clear directions next to the object code saying where to find the
+            Corresponding Source.  Regardless of what server hosts the
+            Corresponding Source, you remain obligated to ensure that it is
+            available for as long as needed to satisfy these requirements.
+        
+            e) Convey the object code using peer-to-peer transmission, provided
+            you inform other peers where the object code and Corresponding
+            Source of the work are being offered to the general public at no
+            charge under subsection 6d.
+        
+          A separable portion of the object code, whose source code is excluded
+        from the Corresponding Source as a System Library, need not be
+        included in conveying the object code work.
+        
+          A "User Product" is either (1) a "consumer product", which means any
+        tangible personal property which is normally used for personal, family,
+        or household purposes, or (2) anything designed or sold for incorporation
+        into a dwelling.  In determining whether a product is a consumer product,
+        doubtful cases shall be resolved in favor of coverage.  For a particular
+        product received by a particular user, "normally used" refers to a
+        typical or common use of that class of product, regardless of the status
+        of the particular user or of the way in which the particular user
+        actually uses, or expects or is expected to use, the product.  A product
+        is a consumer product regardless of whether the product has substantial
+        commercial, industrial or non-consumer uses, unless such uses represent
+        the only significant mode of use of the product.
+        
+          "Installation Information" for a User Product means any methods,
+        procedures, authorization keys, or other information required to install
+        and execute modified versions of a covered work in that User Product from
+        a modified version of its Corresponding Source.  The information must
+        suffice to ensure that the continued functioning of the modified object
+        code is in no case prevented or interfered with solely because
+        modification has been made.
+        
+          If you convey an object code work under this section in, or with, or
+        specifically for use in, a User Product, and the conveying occurs as
+        part of a transaction in which the right of possession and use of the
+        User Product is transferred to the recipient in perpetuity or for a
+        fixed term (regardless of how the transaction is characterized), the
+        Corresponding Source conveyed under this section must be accompanied
+        by the Installation Information.  But this requirement does not apply
+        if neither you nor any third party retains the ability to install
+        modified object code on the User Product (for example, the work has
+        been installed in ROM).
+        
+          The requirement to provide Installation Information does not include a
+        requirement to continue to provide support service, warranty, or updates
+        for a work that has been modified or installed by the recipient, or for
+        the User Product in which it has been modified or installed.  Access to a
+        network may be denied when the modification itself materially and
+        adversely affects the operation of the network or violates the rules and
+        protocols for communication across the network.
+        
+          Corresponding Source conveyed, and Installation Information provided,
+        in accord with this section must be in a format that is publicly
+        documented (and with an implementation available to the public in
+        source code form), and must require no special password or key for
+        unpacking, reading or copying.
+        
+          7. Additional Terms.
+        
+          "Additional permissions" are terms that supplement the terms of this
+        License by making exceptions from one or more of its conditions.
+        Additional permissions that are applicable to the entire Program shall
+        be treated as though they were included in this License, to the extent
+        that they are valid under applicable law.  If additional permissions
+        apply only to part of the Program, that part may be used separately
+        under those permissions, but the entire Program remains governed by
+        this License without regard to the additional permissions.
+        
+          When you convey a copy of a covered work, you may at your option
+        remove any additional permissions from that copy, or from any part of
+        it.  (Additional permissions may be written to require their own
+        removal in certain cases when you modify the work.)  You may place
+        additional permissions on material, added by you to a covered work,
+        for which you have or can give appropriate copyright permission.
+        
+          Notwithstanding any other provision of this License, for material you
+        add to a covered work, you may (if authorized by the copyright holders of
+        that material) supplement the terms of this License with terms:
+        
+            a) Disclaiming warranty or limiting liability differently from the
+            terms of sections 15 and 16 of this License; or
+        
+            b) Requiring preservation of specified reasonable legal notices or
+            author attributions in that material or in the Appropriate Legal
+            Notices displayed by works containing it; or
+        
+            c) Prohibiting misrepresentation of the origin of that material, or
+            requiring that modified versions of such material be marked in
+            reasonable ways as different from the original version; or
+        
+            d) Limiting the use for publicity purposes of names of licensors or
+            authors of the material; or
+        
+            e) Declining to grant rights under trademark law for use of some
+            trade names, trademarks, or service marks; or
+        
+            f) Requiring indemnification of licensors and authors of that
+            material by anyone who conveys the material (or modified versions of
+            it) with contractual assumptions of liability to the recipient, for
+            any liability that these contractual assumptions directly impose on
+            those licensors and authors.
+        
+          All other non-permissive additional terms are considered "further
+        restrictions" within the meaning of section 10.  If the Program as you
+        received it, or any part of it, contains a notice stating that it is
+        governed by this License along with a term that is a further
+        restriction, you may remove that term.  If a license document contains
+        a further restriction but permits relicensing or conveying under this
+        License, you may add to a covered work material governed by the terms
+        of that license document, provided that the further restriction does
+        not survive such relicensing or conveying.
+        
+          If you add terms to a covered work in accord with this section, you
+        must place, in the relevant source files, a statement of the
+        additional terms that apply to those files, or a notice indicating
+        where to find the applicable terms.
+        
+          Additional terms, permissive or non-permissive, may be stated in the
+        form of a separately written license, or stated as exceptions;
+        the above requirements apply either way.
+        
+          8. Termination.
+        
+          You may not propagate or modify a covered work except as expressly
+        provided under this License.  Any attempt otherwise to propagate or
+        modify it is void, and will automatically terminate your rights under
+        this License (including any patent licenses granted under the third
+        paragraph of section 11).
+        
+          However, if you cease all violation of this License, then your
+        license from a particular copyright holder is reinstated (a)
+        provisionally, unless and until the copyright holder explicitly and
+        finally terminates your license, and (b) permanently, if the copyright
+        holder fails to notify you of the violation by some reasonable means
+        prior to 60 days after the cessation.
+        
+          Moreover, your license from a particular copyright holder is
+        reinstated permanently if the copyright holder notifies you of the
+        violation by some reasonable means, this is the first time you have
+        received notice of violation of this License (for any work) from that
+        copyright holder, and you cure the violation prior to 30 days after
+        your receipt of the notice.
+        
+          Termination of your rights under this section does not terminate the
+        licenses of parties who have received copies or rights from you under
+        this License.  If your rights have been terminated and not permanently
+        reinstated, you do not qualify to receive new licenses for the same
+        material under section 10.
+        
+          9. Acceptance Not Required for Having Copies.
+        
+          You are not required to accept this License in order to receive or
+        run a copy of the Program.  Ancillary propagation of a covered work
+        occurring solely as a consequence of using peer-to-peer transmission
+        to receive a copy likewise does not require acceptance.  However,
+        nothing other than this License grants you permission to propagate or
+        modify any covered work.  These actions infringe copyright if you do
+        not accept this License.  Therefore, by modifying or propagating a
+        covered work, you indicate your acceptance of this License to do so.
+        
+          10. Automatic Licensing of Downstream Recipients.
+        
+          Each time you convey a covered work, the recipient automatically
+        receives a license from the original licensors, to run, modify and
+        propagate that work, subject to this License.  You are not responsible
+        for enforcing compliance by third parties with this License.
+        
+          An "entity transaction" is a transaction transferring control of an
+        organization, or substantially all assets of one, or subdividing an
+        organization, or merging organizations.  If propagation of a covered
+        work results from an entity transaction, each party to that
+        transaction who receives a copy of the work also receives whatever
+        licenses to the work the party's predecessor in interest had or could
+        give under the previous paragraph, plus a right to possession of the
+        Corresponding Source of the work from the predecessor in interest, if
+        the predecessor has it or can get it with reasonable efforts.
+        
+          You may not impose any further restrictions on the exercise of the
+        rights granted or affirmed under this License.  For example, you may
+        not impose a license fee, royalty, or other charge for exercise of
+        rights granted under this License, and you may not initiate litigation
+        (including a cross-claim or counterclaim in a lawsuit) alleging that
+        any patent claim is infringed by making, using, selling, offering for
+        sale, or importing the Program or any portion of it.
+        
+          11. Patents.
+        
+          A "contributor" is a copyright holder who authorizes use under this
+        License of the Program or a work on which the Program is based.  The
+        work thus licensed is called the contributor's "contributor version".
+        
+          A contributor's "essential patent claims" are all patent claims
+        owned or controlled by the contributor, whether already acquired or
+        hereafter acquired, that would be infringed by some manner, permitted
+        by this License, of making, using, or selling its contributor version,
+        but do not include claims that would be infringed only as a
+        consequence of further modification of the contributor version.  For
+        purposes of this definition, "control" includes the right to grant
+        patent sublicenses in a manner consistent with the requirements of
+        this License.
+        
+          Each contributor grants you a non-exclusive, worldwide, royalty-free
+        patent license under the contributor's essential patent claims, to
+        make, use, sell, offer for sale, import and otherwise run, modify and
+        propagate the contents of its contributor version.
+        
+          In the following three paragraphs, a "patent license" is any express
+        agreement or commitment, however denominated, not to enforce a patent
+        (such as an express permission to practice a patent or covenant not to
+        sue for patent infringement).  To "grant" such a patent license to a
+        party means to make such an agreement or commitment not to enforce a
+        patent against the party.
+        
+          If you convey a covered work, knowingly relying on a patent license,
+        and the Corresponding Source of the work is not available for anyone
+        to copy, free of charge and under the terms of this License, through a
+        publicly available network server or other readily accessible means,
+        then you must either (1) cause the Corresponding Source to be so
+        available, or (2) arrange to deprive yourself of the benefit of the
+        patent license for this particular work, or (3) arrange, in a manner
+        consistent with the requirements of this License, to extend the patent
+        license to downstream recipients.  "Knowingly relying" means you have
+        actual knowledge that, but for the patent license, your conveying the
+        covered work in a country, or your recipient's use of the covered work
+        in a country, would infringe one or more identifiable patents in that
+        country that you have reason to believe are valid.
+        
+          If, pursuant to or in connection with a single transaction or
+        arrangement, you convey, or propagate by procuring conveyance of, a
+        covered work, and grant a patent license to some of the parties
+        receiving the covered work authorizing them to use, propagate, modify
+        or convey a specific copy of the covered work, then the patent license
+        you grant is automatically extended to all recipients of the covered
+        work and works based on it.
+        
+          A patent license is "discriminatory" if it does not include within
+        the scope of its coverage, prohibits the exercise of, or is
+        conditioned on the non-exercise of one or more of the rights that are
+        specifically granted under this License.  You may not convey a covered
+        work if you are a party to an arrangement with a third party that is
+        in the business of distributing software, under which you make payment
+        to the third party based on the extent of your activity of conveying
+        the work, and under which the third party grants, to any of the
+        parties who would receive the covered work from you, a discriminatory
+        patent license (a) in connection with copies of the covered work
+        conveyed by you (or copies made from those copies), or (b) primarily
+        for and in connection with specific products or compilations that
+        contain the covered work, unless you entered into that arrangement,
+        or that patent license was granted, prior to 28 March 2007.
+        
+          Nothing in this License shall be construed as excluding or limiting
+        any implied license or other defenses to infringement that may
+        otherwise be available to you under applicable patent law.
+        
+          12. No Surrender of Others' Freedom.
+        
+          If conditions are imposed on you (whether by court order, agreement or
+        otherwise) that contradict the conditions of this License, they do not
+        excuse you from the conditions of this License.  If you cannot convey a
+        covered work so as to satisfy simultaneously your obligations under this
+        License and any other pertinent obligations, then as a consequence you may
+        not convey it at all.  For example, if you agree to terms that obligate you
+        to collect a royalty for further conveying from those to whom you convey
+        the Program, the only way you could satisfy both those terms and this
+        License would be to refrain entirely from conveying the Program.
+        
+          13. Remote Network Interaction; Use with the GNU General Public License.
+        
+          Notwithstanding any other provision of this License, if you modify the
+        Program, your modified version must prominently offer all users
+        interacting with it remotely through a computer network (if your version
+        supports such interaction) an opportunity to receive the Corresponding
+        Source of your version by providing access to the Corresponding Source
+        from a network server at no charge, through some standard or customary
+        means of facilitating copying of software.  This Corresponding Source
+        shall include the Corresponding Source for any work covered by version 3
+        of the GNU General Public License that is incorporated pursuant to the
+        following paragraph.
+        
+          Notwithstanding any other provision of this License, you have
+        permission to link or combine any covered work with a work licensed
+        under version 3 of the GNU General Public License into a single
+        combined work, and to convey the resulting work.  The terms of this
+        License will continue to apply to the part which is the covered work,
+        but the work with which it is combined will remain governed by version
+        3 of the GNU General Public License.
+        
+          14. Revised Versions of this License.
+        
+          The Free Software Foundation may publish revised and/or new versions of
+        the GNU Affero General Public License from time to time.  Such new versions
+        will be similar in spirit to the present version, but may differ in detail to
+        address new problems or concerns.
+        
+          Each version is given a distinguishing version number.  If the
+        Program specifies that a certain numbered version of the GNU Affero General
+        Public License "or any later version" applies to it, you have the
+        option of following the terms and conditions either of that numbered
+        version or of any later version published by the Free Software
+        Foundation.  If the Program does not specify a version number of the
+        GNU Affero General Public License, you may choose any version ever published
+        by the Free Software Foundation.
+        
+          If the Program specifies that a proxy can decide which future
+        versions of the GNU Affero General Public License can be used, that proxy's
+        public statement of acceptance of a version permanently authorizes you
+        to choose that version for the Program.
+        
+          Later license versions may give you additional or different
+        permissions.  However, no additional obligations are imposed on any
+        author or copyright holder as a result of your choosing to follow a
+        later version.
+        
+          15. Disclaimer of Warranty.
+        
+          THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+        APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+        HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+        OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+        THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+        PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+        IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+        ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+        
+          16. Limitation of Liability.
+        
+          IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+        WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+        THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+        GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+        USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+        DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+        PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+        EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+        SUCH DAMAGES.
+        
+          17. Interpretation of Sections 15 and 16.
+        
+          If the disclaimer of warranty and limitation of liability provided
+        above cannot be given local legal effect according to their terms,
+        reviewing courts shall apply local law that most closely approximates
+        an absolute waiver of all civil liability in connection with the
+        Program, unless a warranty or assumption of liability accompanies a
+        copy of the Program in return for a fee.
+        
+                             END OF TERMS AND CONDITIONS
+        
+                    How to Apply These Terms to Your New Programs
+        
+          If you develop a new program, and you want it to be of the greatest
+        possible use to the public, the best way to achieve this is to make it
+        free software which everyone can redistribute and change under these terms.
+        
+          To do so, attach the following notices to the program.  It is safest
+        to attach them to the start of each source file to most effectively
+        state the exclusion of warranty; and each file should have at least
+        the "copyright" line and a pointer to where the full notice is found.
+        
+            <one line to give the program's name and a brief idea of what it does.>
+            Copyright (C) <year>  <name of author>
+        
+            This program is free software: you can redistribute it and/or modify
+            it under the terms of the GNU Affero General Public License as published by
+            the Free Software Foundation, either version 3 of the License, or
+            (at your option) any later version.
+        
+            This program is distributed in the hope that it will be useful,
+            but WITHOUT ANY WARRANTY; without even the implied warranty of
+            MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+            GNU Affero General Public License for more details.
+        
+            You should have received a copy of the GNU Affero General Public License
+            along with this program.  If not, see <https://www.gnu.org/licenses/>.
+        
+        Also add information on how to contact you by electronic and paper mail.
+        
+          If your software can interact with users remotely through a computer
+        network, you should also make sure that it provides a way for users to
+        get its source.  For example, if your program is a web application, its
+        interface could display a "Source" link that leads users to an archive
+        of the code.  There are many ways you could offer source, and different
+        solutions will be better for different programs; see section 13 for the
+        specific requirements.
+        
+          You should also get your employer (if you work as a programmer) or school,
+        if any, to sign a "copyright disclaimer" for the program, if necessary.
+        For more information on this, and how to apply and follow the GNU AGPL, see
+        <https://www.gnu.org/licenses/>.
+        
+Project-URL: Homepage, https://github.com/bryanflowers/wpsecscan
+Project-URL: Repository, https://github.com/bryanflowers/wpsecscan
+Project-URL: Documentation, https://github.com/bryanflowers/wpsecscan#readme
+Project-URL: Issues, https://github.com/bryanflowers/wpsecscan/issues
+Project-URL: Changelog, https://github.com/bryanflowers/wpsecscan/blob/main/CHANGELOG.md
+Project-URL: Security, https://github.com/bryanflowers/wpsecscan/blob/main/SECURITY.md
+Keywords: wordpress,security,scanner,pentest,defensive,vulnerability,cve,wpscan
+Classifier: Development Status :: 5 - Production/Stable
+Classifier: Environment :: Console
+Classifier: Environment :: Win32 (MS Windows)
+Classifier: Intended Audience :: System Administrators
+Classifier: Intended Audience :: Information Technology
+Classifier: License :: OSI Approved :: GNU Affero General Public License v3 or later (AGPLv3+)
+Classifier: Operating System :: OS Independent
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Topic :: Security
+Classifier: Topic :: Internet :: WWW/HTTP
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+License-File: NOTICE
+Requires-Dist: httpx[http2]<0.29,>=0.27
+Requires-Dist: jinja2<4,>=3.1
+Requires-Dist: rich<14,>=13.7
+Requires-Dist: openpyxl<4,>=3.1
+Requires-Dist: keyring<26,>=24
+Provides-Extra: pdf
+Requires-Dist: reportlab<5,>=4.0; extra == "pdf"
+Provides-Extra: browser
+Requires-Dist: playwright<2,>=1.40; extra == "browser"
+Provides-Extra: yaml
+Requires-Dist: pyyaml<7,>=6.0; extra == "yaml"
+Provides-Extra: ops
+Requires-Dist: redis<7,>=5.0; extra == "ops"
+Requires-Dist: bcrypt<5,>=4.0; extra == "ops"
+Provides-Extra: ui
+Requires-Dist: Pillow<12,>=10; extra == "ui"
+Requires-Dist: pystray<0.20,>=0.19; extra == "ui"
+Provides-Extra: security
+Requires-Dist: defusedxml<0.8,>=0.7; extra == "security"
+Provides-Extra: all
+Requires-Dist: reportlab<5,>=4.0; extra == "all"
+Requires-Dist: playwright<2,>=1.40; extra == "all"
+Requires-Dist: pyyaml<7,>=6.0; extra == "all"
+Requires-Dist: redis<7,>=5.0; extra == "all"
+Requires-Dist: bcrypt<5,>=4.0; extra == "all"
+Requires-Dist: Pillow<12,>=10; extra == "all"
+Requires-Dist: pystray<0.20,>=0.19; extra == "all"
+Requires-Dist: keyring<26,>=24; extra == "all"
+Requires-Dist: defusedxml<0.8,>=0.7; extra == "all"
+Provides-Extra: test
+Requires-Dist: pytest>=7.4; extra == "test"
+Dynamic: license-file
+
+# WPSecScan
+
+[![tests](https://github.com/bryanflowers/wpsecscan/actions/workflows/tests.yml/badge.svg)](https://github.com/bryanflowers/wpsecscan/actions/workflows/tests.yml)
+[![CVE feed](https://github.com/bryanflowers/wpsecscan/actions/workflows/cve-feed.yml/badge.svg)](https://github.com/bryanflowers/wpsecscan/actions/workflows/cve-feed.yml)
+[![license](https://img.shields.io/github/license/bryanflowers/wpsecscan)](LICENSE)
+[![release](https://img.shields.io/github/v/release/bryanflowers/wpsecscan)](https://github.com/bryanflowers/wpsecscan/releases/latest)
+[![downloads](https://img.shields.io/github/downloads/bryanflowers/wpsecscan/total)](https://github.com/bryanflowers/wpsecscan/releases)
+[![python](https://img.shields.io/badge/python-3.10%2B-blue)](https://www.python.org/)
+[![checks](https://img.shields.io/badge/checks-270-brightgreen)](FEATURES.md)
+[![CVE sources](https://img.shields.io/badge/CVE%20sources-8-blue)](docs/data-sources.md)
+[![tests passing](https://img.shields.io/badge/tests-780%20passing-brightgreen)](tests/)
+[![PyPI](https://img.shields.io/pypi/v/wpsecscan)](https://pypi.org/project/wpsecscan/)
+[![SLSA Level 3](https://img.shields.io/badge/SLSA-Level%203-success)](docs/verify-release.md)
+[![Sigstore signed](https://img.shields.io/badge/Sigstore-signed-blueviolet)](docs/verify-release.md)
+[![threat-intel](https://img.shields.io/badge/threat--intel-10%20providers-orange)](FEATURES.md)
+
+> **⚠ AUTHORIZED USE ONLY**
+>
+> WPSecScan is a defensive security tool. Use it **only** on sites you own
+> or sites whose owner has given you **written permission** to test.
+> Unauthorised scanning is illegal in most jurisdictions (e.g. the US
+> Computer Fraud and Abuse Act, the UK Computer Misuse Act 1990, the EU
+> Network and Information Security Directive). The maintainers accept no
+> liability for misuse. By using this software you confirm you have the
+> required authorisation for every target you scan.
+
+**The most thoroughly-sourced WordPress vulnerability scanner — open source, AGPLv3, runs locally.**
+
+226 checks across 18 categories. **8-source nightly CVE aggregator**
+(NVD + GHSA + Mitre + OSV + Wordfence + WPVulnerability + CIRCL +
+Patchstack). **SLSA L3 + Sigstore-signed releases**. **10-provider
+threat-intel federation** (CISA KEV, EPSS, Exploit-DB, Metasploit,
+ATT&CK Navigator, STIX, MISP, OpenCTI, OTX, GreyNoise). **Continuous
+monitoring** (CT/DNS/WHOIS/RBL/honeypot/auto-rollback). **Active
+exploit verification** with strict consent gating. **Enterprise
+mode**: OIDC + SAML + RBAC + audit-log + approval workflow +
+multi-tenant + quotas. **Distribution**: Docker, K8s, Homebrew, Snap,
+Flatpak, winget, AUR, Chocolatey.
+
+Original headline:
+gives you a fresher and more complete vulnerability database than
+any single paid or free service. Runs entirely on your machine — no
+telemetry, no per-site licensing, no data leaves your box.
+
+Ships as two standalone Windows binaries — no Python required on the machine you run them on.
+
+- **`wpsecscan.exe`** — command-line scanner. Output: console + HTML + JSON + CSV + SARIF + Markdown + Excel (XLSX) + executive PDF + Burp scope XML + CycloneDX SBOM + shields.io status badge SVG.
+- **`wpsecscan-gui.exe`** — full GUI with live progress tree, finding details, risk score,
+  scan profiles, multi-target queue, scheduled scans, webhook alerts, exploit playbooks, and more.
+- **`wpsecscan-companion.zip`** — WordPress plugin that exposes a read-only, token-gated
+  REST endpoint so the scanner gets authoritative diagnostics in one round-trip (3× more
+  accurate plugin/theme detection vs HTTP-probe guessing).
+
+### Why people are switching to WPSecScan
+
+- **8-source CVE aggregator** runs nightly on our infrastructure — pulls
+  Wordfence + NVD + GitHub Security Advisories + Mitre CVE List + OSV.dev +
+  WPVulnerability.com + CIRCL + Patchstack and merges them into one feed.
+  Users get a strictly fresher + more complete DB than Wordfence/Patchstack
+  alone. **6 of 8 sources are fully free, no key required.**
+- **Daily DB refresh + per-CVE webhook alerts** — `wpsecscan schedule
+  install` registers a daily 02:00 CVE-refresh + weekly 03:00 site scan
+  on Windows Task Scheduler / macOS launchd / Linux systemd.
+  `wpsecscan db subscribe https://hooks.slack.com/...` fires the moment a
+  new CVE drops for a plugin you have installed.
+- **15 compliance frameworks mapped** per check: OWASP Top 10 + MITRE
+  ATT&CK + CWE + D3FEND + PCI-DSS 4.0 + NIST 800-53 + ISO 27001 + HIPAA +
+  FERPA + SOC 2 + FedRAMP + GDPR + HITRUST CSF v11.4 + CMMC 2.0 +
+  NIST CSF 2.0 + CIS Critical Controls v8 + ISO 27001:2022 Annex A.
+- **11 report formats**: HTML, JSON, CSV, SARIF 2.1.0, Markdown, Excel
+  (XLSX with per-OWASP-category sheets), executive PDF, CycloneDX SBOM,
+  Burp Suite scope XML, attestation PDF, shields.io status-badge SVG.
+- **10 third-party integrations** including Burp Suite project XML,
+  OWASP ZAP findings import, Nuclei template auto-pull, JIRA / Linear /
+  GitHub Issues bulk-create, Wordfence Cloud sync, Sucuri SiteCheck,
+  Patchstack + WPScan write-back, WP Engine / Kinsta / WP.com host APIs.
+- **AI-assisted remediation** with PII masking + prompt-injection guard +
+  per-backend cost tracking. Bring your own OpenAI / Anthropic / Ollama /
+  llama.cpp key. **`WPSECSCAN_NO_AI=1` to hard-disable.**
+- **Privacy-first**: no telemetry, runs locally, supports SOCKS5/HTTP
+  proxies (Tor friendly), `WPSECSCAN_NO_NETWORK=1` for air-gapped mode.
+
+---
+
+## Quick install
+
+### Option A — `pip install wpsecscan` (any platform)
+
+The simplest path on Linux, macOS, or Windows-with-Python:
+
+```bash
+pip install wpsecscan
+wpsecscan --version
+wpsecscan https://example.com --json-only
+```
+
+PyPI: <https://pypi.org/project/wpsecscan/>
+
+For the optional GUI minimize-to-tray feature, install with the
+`[ui]` extra (pulls in Pillow + pystray):
+
+```bash
+pip install "wpsecscan[ui]"
+```
+
+Other optional extras: `[pdf]` (reportlab for true PDF exec reports),
+`[browser]` (playwright for headless DOM-XSS), `[yaml]` (pyyaml for
+daemon config), `[ops]` (redis + bcrypt for enterprise mode), or
+`[all]` to install everything.
+
+### Option B — pre-built Windows binaries
+
+1. Open `dist\` in this folder.
+2. Copy `wpsecscan.exe` and `wpsecscan-gui.exe` somewhere on your PATH
+   (e.g. `C:\Tools\` or `C:\Users\<you>\bin\`).
+3. Done. No Python, no installer, no admin rights needed.
+
+The first time you run them, Windows SmartScreen may warn that the publisher is unknown
+(the binaries aren't code-signed). Click **More info → Run anyway**.
+
+### Option C — build from source
+
+Requires Python 3.10+ and PyInstaller. Open PowerShell in the project root:
+
+```powershell
+.\build.ps1
+```
+
+This creates a virtualenv in `.venv\`, installs dependencies from `requirements.txt`,
+and runs PyInstaller. Output:
+
+```
+dist\wpsecscan.exe                  # CLI (~17 MB)
+dist\wpsecscan-gui.exe       # GUI (~17 MB)
+```
+
+Both are single-file executables — copy them anywhere and they run on their own.
+
+### Option D — run from source directly (development)
+
+```powershell
+python -m venv .venv
+.\.venv\Scripts\Activate.ps1
+pip install .
+python run.py https://example.com         # CLI
+python run_gui.py                          # GUI
+pytest                                     # 780 tests
+```
+
+---
+
+## First scan
+
+### GUI
+
+1. Double-click `wpsecscan-gui.exe`.
+2. Paste a URL into the URL field (e.g. `https://your-wp-site.com`).
+3. Click **Scan**. Watch the live tree on the left and click any finding to read
+   evidence, remediation, and the *Exploit Playbook* (concrete sqlmap/Metasploit/curl/nuclei commands).
+4. When the scan finishes, the **Risk Score** badge at the top shows `0-100` color-coded
+   (green/yellow/orange/red). HTML and JSON reports are saved to your user folder.
+
+### CLI
+
+```powershell
+# Simple scan, HTML + JSON saved to current directory
+wpsecscan.exe https://your-wp-site.com
+
+# Custom output folder
+wpsecscan.exe https://your-wp-site.com --out C:\scans\
+
+# JSON only, no HTML
+wpsecscan.exe https://your-wp-site.com --json-only --out C:\scans\
+
+# Multiple targets from a file
+wpsecscan.exe --file my-sites.txt --concurrency 5 --out C:\scans\
+
+# Aggressive mode (active payload checks — SQLi, XSS, SSRF, etc.)
+wpsecscan.exe https://your-wp-site.com --aggressive
+
+# Authenticated scan
+wpsecscan.exe https://your-wp-site.com --auth-user admin --auth-pass <pwd>
+
+# Use a saved WPScan API token for richer plugin CVE lookups
+wpsecscan.exe https://your-wp-site.com --wpscan-token <KEY>
+```
+
+**Exit codes**: `0` = clean / info only · `1` = medium findings · `2` = critical or high findings · `130` = Ctrl+C.
+
+---
+
+## What it checks (226 checks)
+
+Passive checks always run; aggressive checks need `--aggressive`.
+
+- **Recon**: WP core version · plugin enum (slug + version) · theme enum · user enum (`?author=`, REST `wp/v2/users`)
+- **Surface**: 40+ exposed-path probes (`.env`, `wp-config.php.bak`, `.git/config`, debug.log, backup-plugin dumps, phpinfo, adminer, …) · WebDAV / OPTIONS enum · beta/test/debug query-parameter discovery
+- **Auth surface**: `wp-login.php` + XML-RPC method enum + `system.multicall` amplifier check + rate-limit probe · OAuth2/OIDC discovery audit · SAML / XSW endpoint discovery · JWT audit (`alg=none` + weak HS256 brute-force)
+- **Transport**: TLS version, cert expiry, HSTS, CSP, X-Frame-Options, Referrer-Policy, Permissions-Policy, cookie flags
+- **APIs**: REST namespace map, REST OPTIONS write-method enum, WPGraphQL introspection, CORS misconfig (full preflight matrix incl. `null` origin reflection)
+- **Defensive posture**: WAF / CDN detection · WAF rule-set identification (CRS / AWS / Cloudflare Managed / Wordfence Premium) · DNS SPF / DMARC / DKIM · security.txt · AbuseIPDB reputation (opt-in)
+- **Supply-chain**: external JS hosts + SRI hash check · source-map exposure · JS library version audit · S3 bucket discovery + public-ACL probe · GitHub leaked-token search (opt-in, scans your domain against AKIA/sk_live_/ghp_/etc.)
+- **Subdomain attack surface**: certificate-transparency discovery · dangling-CDN takeover candidates · **cookie-tossing chain** detection (apex-cookie + takeover-able subdomain)
+- **Server fingerprint**: Server-Timing, X-Request-ID, X-Debug-Token leaks
+- **CVE matching**: 7000+ Wordfence CVEs + 307 high-confidence exploit signatures + 224 modern payloads · CISA KEV catalog enrichment · EPSS percentile scoring · VirusTotal URL/IP enrichment (opt-in)
+- **Aggressive** (`--aggressive`): SQLi (error-based + time-blind escalator) · reflected XSS · SSRF · path traversal · open redirect · file upload · default credentials (max 10) · SSTI (7 template engines) · NoSQL operator injection · path-normalisation bypass (`..%2f`, `..;/`, …) · race-condition probe (parallel POSTs) · active HTTP smuggling (CL.TE / TE.CL) · headless DOM-XSS (Playwright, optional)
+- **Deep** (`--deep-throttle`): 10-500 wrong-password attempts at 5-60s pacing to map your login throttle threshold (synthetic non-existent user, fixed wrong password — never brute-force)
+- **Authenticated** (`--auth-user`/`--auth-pass`): logs in, audits user roles, plugins, Site Health, options
+
+### Round-54 additions (Nov 2026 — A1-G4 catalogue)
+
+WPSecScan grew from 80 → 94 checks plus a wide non-check toolkit:
+
+| Area | New |
+|------|-----|
+| **Active probes** | `ssti`, `nosql_injection`, `path_bypass`, `race_condition`, `dom_xss_headless` (Playwright optional) |
+| **Passive / intel checks** | `webdav`, `dev_params`, `abuseipdb_lookup` (`--abuseipdb-token`), `waf_ruleset`, `oauth_oidc`, `saml_xsw`, `s3_bucket_discovery`, `github_leak_search` (`--github-search-token`), `jwt_audit` |
+| **Modified checks** | `subdomains` (B7 cookie-tossing chain), `cors` (B8 preflight matrix incl. `Origin: null`), `sqli` (A3 time-blind escalator), `smuggling_probe` (A6 active CL.TE/TE.CL) |
+| **Threat-intel integrations** | CISA KEV, EPSS, VirusTotal, Sucuri SiteCheck, NVD/Wordfence CVE explainer |
+| **Per-check tags** | new `cwe` (e.g. `CWE-79`) + `d3fend` (e.g. `D3-IVA`) fields in `data/check_tags.json` |
+| **Reporters** | one-page executive PDF (`--exec-pdf`, uses reportlab or HTML fallback) · two-report drag-and-drop HTML diff viewer · Burp Suite scope XML (`--burp-export`) · severity × OWASP-category SVG heatmap embedded in HTML report |
+| **CLI flags** | `--fail-on`, `--diff-against`, `--shell`, `--replay-har`, `--daemon`, `--abuseipdb-token`, `--vt-token`, `--github-search-token`, `--burp-export`, `--exec-pdf` |
+| **GUI windows** | step-by-step exploit-playbook walker (right-click any finding) · drill historical findings by OWASP/ATT&CK/CWE/D3FEND tag · multi-URL risk-score trend overlay · drop-in marketplace browser · 5-step first-run tutorial |
+| **Collab** | assign-owner + comment threads per finding (right-click) |
+| **Infra / docs** | `.github/workflows/wpsecscan.yml` (nightly + PR scans) · GitLab CI / Jenkins / Azure DevOps templates in `ci/` · `Dockerfile` + `docker-compose.yml` · `SDK.md` · `DISTRIBUTED-SCAN.md` · audit-log JSONL of every scan invocation · custom signature / payload drop-in (`~/.wpsecscan/{signatures,payloads}/`) · i18n stub (en + es) |
+
+---
+
+## Output formats
+
+Every scan produces:
+
+| Flag                | File                     | Use case                                |
+|---------------------|--------------------------|-----------------------------------------|
+| (default)           | `<host>-<ts>.html`       | Open in a browser. Has copy-to-clipboard buttons for every command, color-coded exploit playbooks, and a "🖨 Print / Save as PDF" button in the top-right corner. |
+| (default)           | `<host>-<ts>.json`       | Includes per-finding `confidence` (low/medium/high) and per-check `tags` (OWASP Top 10 + MITRE ATT&CK). For downstream tooling. |
+| `--csv`             | `<host>-<ts>.csv`        | Spreadsheet import. Cells are escaped against Excel formula-injection. |
+| `--sarif`           | `<host>-<ts>.sarif`      | GitHub Code Scanning, Azure DevOps, anything that ingests SARIF 2.1.0. |
+| `--json-only`       | suppresses HTML          | CI / scripted use. |
+| `--md`              | `<host>-<ts>.md`         | Markdown report for Confluence / GitHub / Slack threads. |
+| `--xlsx`            | `<host>-<ts>.xlsx`       | Excel workbook with per-OWASP-category sheets. |
+| `--har FILE.har`    | `FILE.har`               | HAR 1.2 recording of every HTTP request (Cookie/Authorization redacted). Replay with `--replay-har`. |
+| `--burp-export`     | `<host>-<ts>-burp-scope.xml` | Burp Suite scope XML for hand-off to manual testing. |
+| `--exec-pdf`        | `<host>-<ts>-exec.pdf`   | One-page non-technical executive summary. Uses `reportlab` if installed, else writes a print-friendly HTML file. |
+
+### Round-54 CLI additions
+
+| Flag                                  | Purpose                                                                                  |
+|---------------------------------------|------------------------------------------------------------------------------------------|
+| `--fail-on critical\|high\|medium`    | Override exit-code logic — non-zero only when a finding meets or exceeds the threshold.  |
+| `--diff-against BASELINE.json`        | Compute the NEW / RESOLVED delta vs a saved JSON report, print to stdout.                |
+| `--shell`                             | After scan, drop into a Python REPL with `report` pre-bound (for power users / IR).      |
+| `--replay-har HAR_FILE`               | Re-run every request in a HAR file; optionally override the origin with `<target>`.      |
+| `--daemon CONFIG.yml`                 | Cron-style scheduled scans driven by a YAML config (no Task Scheduler required).         |
+| `--abuseipdb-token TOKEN`             | Enables the AbuseIPDB reputation check for the target's IP.                              |
+| `--vt-token TOKEN`                    | Enables VirusTotal URL/IP enrichment.                                                    |
+| `--github-search-token PAT`           | Enables GitHub code-search for the target's domain + common secret prefixes.             |
+
+### Round-56 visibility flags
+
+| Flag                                  | Purpose                                                                                  |
+|---------------------------------------|------------------------------------------------------------------------------------------|
+| `--demo`                              | Synthetic scan against a fake target — every check fires fake findings, every integration fires a fake activity event. Writes one of every artifact to `~/.wpsecscan/demo/`. Great for screenshots, smoke-testing an install, or training new users. |
+| `--no-live`                           | Disable the live multi-panel rich dashboard during scans. The static console reporter still renders at the end. Useful for CI logs / piped output. |
+
+---
+
+## Power-user features (GUI)
+
+- **Risk score**: 0–100, color-coded. Calculated from severity weights with per-tier caps.
+- **Profiles** (File → Profiles): save the current toggle/pacing/threshold set as `"Quick"`, `"Deep"`, `"Audit"` etc. Loads with one click. Stored in `~/.wpsecscan/profiles.json`.
+- **Recent URLs**: the URL field is a dropdown of the last 20 scanned sites.
+- **Diff with last scan**: button appears after a scan if a previous JSON for the same URL exists in `~/.wpsecscan/reports/`. Shows `[NEW]` / `[RESOLVED]` per finding.
+- **Multi-target scan** (Tools → Multi-target): paste/load a list of URLs, scan each in turn, one-row-per-site dashboard with risk score and Δ-vs-last-scan.
+- **Scheduled recurring scan** (Tools → Schedule): registers a Windows Task Scheduler job (`WPSecScan_<host>`) that runs daily/weekly/monthly at a chosen time. Outputs to a folder you pick. Remove with `schtasks /Delete /TN WPSecScan_<host> /F`.
+- **Risk-score trend** (Tools → Show risk trend): ASCII sparkline of historical scores for the current URL.
+- **Webhook notify** (File → Settings → "Webhook notify"): one POST to Slack/Discord/Teams/PagerDuty when a scan finds ≥ chosen severity. Hosts validated against an allow-list — won't post to arbitrary URLs or raw IPs.
+- **Finding annotations**: right-click any finding → "Accepted risk" / "False positive" with an optional note. Persisted per-URL in `~/.wpsecscan/annotations.json`.
+- **Filter pills**: Only NEW (vs last scan), Only CONFIRMED (signature engine actively verified), Hide annotated, per-severity show/hide.
+- **Exploit playbook**: every finding's detail pane includes concrete attacker-side commands (curl PoCs · sqlmap · Metasploit · nuclei · wpscan · ffuf) with `{target}` already substituted, plus a plain-English *"How an attacker uses this"* paragraph.
+- **OWASP + MITRE chips**: every check is tagged with its OWASP Top 10 category (e.g. `A03:2021`) and MITRE ATT&CK technique (e.g. `T1190`). Shown inline in the GUI and console.
+- **Exploit confidence**: each finding carries a confidence badge (HIGH / MED / LOW) separate from severity — `[CONFIRMED]` findings are HIGH; presence of a WAF downgrades unconfirmed findings by one tier.
+- **Cancel-mid-scan**: clicking Cancel during the 20-min deep throttle test returns a partial result with what was learned so far.
+
+---
+
+## CLI flag reference (most-used)
+
+```
+USAGE: wpsecscan.exe [URL] [options]
+
+Targets:
+  URL                          A single site (https://example.com)
+  --file FILE                  Newline-separated list of URLs
+
+Output:
+  --out PATH                   Output directory or filename stem (default: cwd)
+  --json-only                  Suppress HTML
+  --html-only                  Suppress JSON
+  --csv                        Also write CSV
+  --sarif                      Also write SARIF 2.1.0
+  --quiet, -q                  Suppress the colored console table (alias: --no-console)
+  -v / -vv                     Increase console verbosity (per-check / HTTP-level)
+
+Modes:
+  --aggressive                 Enable active payload checks (SQLi, XSS, SSRF, etc.)
+  --prove                      For each confirmed aggressive finding, run a read-only
+                               proof extractor. Requires --aggressive. Read-only.
+  --deep-throttle              Run the deep login-throttle mapper
+  --deep-throttle-attempts N   (10-500, default 120)
+  --deep-throttle-pacing S     (5-60 seconds, default 10)
+  --auth-user USER             Admin username for authenticated scan (env: WPSECSCAN_AUTH_USER)
+  --auth-pass PASS             Admin password (env: WPSECSCAN_AUTH_PASS; use `-` to read from stdin)
+  --ssh-audit user@host        Connect via SSH and run a read-only wp-cli audit
+  --password-audit FILE        Offline: convert wp_users dump to a hashcat-ready file (NO network)
+
+Tuning:
+  --timeout SECONDS            Per-request timeout (default 15)
+  --concurrency N              Concurrent requests per host (default 10)
+  --user-agent STRING          Custom User-Agent
+  --insecure                   Don't verify TLS certs
+  --wpscan-token TOKEN         WPScan API token (richer plugin CVE data)
+  --hibp-token TOKEN           HaveIBeenPwned API key
+
+Maintenance:
+  --update-db                  Refresh the Wordfence vulnerability database
+                               (exits 75 on remote-fetch failure for CI detection)
+  --diff OLD.json NEW.json     Diff two saved JSON reports
+  --baseline BASELINE.json     Diff scan-in-progress against a saved baseline (alias: --diff-against)
+  --debug                      Verbose internal logging to ~/.wpsecscan/logs/
+  --completion {bash,zsh,powershell}   Print shell-completion script and exit
+  --version
+
+Subcommands (run `wpsecscan <subcommand> --help` for details):
+  sites          Manage a list of sites (add/list/scan/remove)
+  schedule       Install/uninstall a Windows-Scheduler / launchd / systemd cron
+  digest         Configure SMTP / webhook digests of new findings
+  ai-cost        Print AI-triage cost summary
+  ai-options     Read/set Advanced AI-triage toggles
+  analytics      Manage opt-in analytics
+  db             vuln DB management (status / update / signatures / source-stats / subscribe / alert-check)
+  compare URL    Diff the two most-recent saved snapshots of a URL
+  badge URL      Emit a shields.io-style SVG of the latest scan grade
+```
+
+---
+
+## Configuration files
+
+Everything is stored in `~/.wpsecscan/` (i.e. `C:\Users\<you>\.wpsecscan\`):
+
+| Path                                         | Purpose                                                  |
+|----------------------------------------------|----------------------------------------------------------|
+| `history.json`                               | Last 20 scanned URLs (GUI dropdown)                      |
+| `profiles.json`                              | Named scan profiles (toggles + deep-throttle settings)   |
+| `settings.json`                              | Tokens saved via the GUI onboarding wizard               |
+| `sites.json`                                 | Managed-sites list for `wpsecscan sites` + scheduling    |
+| `schedule_state.json`                        | Cron-style state for `wpsecscan schedule`                |
+| `digest.json`                                | Configured SMTP / webhook digest destinations            |
+| `annotations.json`                           | Per-finding annotations (accepted-risk / FP)             |
+| `comments.json`                              | Per-finding free-text comments                           |
+| `stars.json`                                 | Starred findings (GUI sidebar)                           |
+| `disabled_checks.json`                       | Persistently disabled check IDs                          |
+| `reports/{host}.json`                        | Latest-scan snapshot per URL (canonical)                 |
+| `reports/{host}-{YYYYmmdd-HHMMSS}.json`      | Timestamped snapshot history (for `compare`, trend)      |
+| `cache/wporg/{slug}.json`                    | 24h-cached wp.org plugin metadata (plugin_cemetery)      |
+| `checkpoints/`                               | `--checkpoint` resumable scan state                      |
+| `logs/`                                      | `--debug` log files                                      |
+| `demo/`                                      | `--demo` synthetic-scan artifacts                        |
+| `analytics/events.jsonl`                     | Opt-in analytics (off by default; `wpsecscan analytics`) |
+| `wordfence.json`                             | Local cache of the aggregated CVE database               |
+
+Override the base dir with the `WPSECSCAN_HOME` environment variable.
+
+### Shell completions
+
+```powershell
+# bash
+wpsecscan --completion bash > /etc/bash_completion.d/wpsecscan
+
+# zsh
+wpsecscan --completion zsh > "${fpath[1]}/_wpsecscan"
+
+# PowerShell
+wpsecscan --completion powershell | Out-File -Append $PROFILE
+```
+
+Restart the shell to activate.
+
+### Secrets via env vars
+
+Every sensitive flag — `--auth-pass`, `--auth-app-password`,
+`--companion-token`, `--proxy-auth`, `--wpscan-token`,
+`--patchstack-token`, `--hibp-token`, `--vt-token`, `--abuseipdb-token`,
+`--github-search-token` — reads from a matching `WPSECSCAN_<UPPER>`
+environment variable when not passed on the CLI. Use `--auth-pass -`
+to read the password from stdin via `getpass` (stops it leaking into
+`ps aux` / shell history).
+
+---
+
+## Safety
+
+- **Use only on sites you own** or have written permission to test. Online password
+  brute-force is permanently out of scope. The "deep throttle" probe uses a synthetic
+  non-existent username and a fixed wrong password — it maps your defense, it does
+  not guess passwords.
+- All active payloads are read-only. The payload library is enforced at load-time
+  with a pytest invariant that scans for any write-side operations.
+- The webhook URL allow-list rejects raw IPs, internal addresses (incl. AWS metadata
+  at `169.254.169.254`), and unknown hosts.
+- Authenticated scans run with the credentials you provide but never log them.
+- The scheduled-task URL validator enforces a strict regex to prevent shell-meta
+  injection in the registered `schtasks` command.
+
+---
+
+## Troubleshooting
+
+**"Windows protected your PC" SmartScreen warning** — click *More info → Run anyway*.
+The binaries aren't code-signed.
+
+**Defender quarantines `wpsecscan.exe` with `Backdoor:JS/Chopper.GG!dha`** — known false positive.
+This is a defensive scanner: to **detect** webshells (China Chopper, c99, r57) on your sites
+it ships references to those attack patterns. Defender's pattern-matching heuristic flags
+the .exe even though it never executes any of those patterns locally. The same kind of
+detection trips sqlmap, Metasploit, nuclei, and Gophish — all legitimate security tools.
+
+**Three ways to fix it:**
+
+1. **In the GUI**: a dialog pops up on first launch with an "Add exclusion now (UAC)"
+   button. You can also open it any time via *Tools → Add Windows Defender exclusion...*
+
+2. **From admin PowerShell** (manual, one line):
+   ```powershell
+   Add-MpPreference -ExclusionPath 'C:\path\to\dist'
+   ```
+   Replace `C:\path\to\dist` with the actual folder containing the `.exe` binaries.
+
+3. **Via the bundled helper script** (auto-detects the binary location, prompts UAC):
+   ```powershell
+   .\scripts\add-defender-exclusion.ps1
+   ```
+
+**To restore a quarantined file**: *Windows Security → Virus & threat protection →
+Protection history → Allow*.
+
+**This program does NOT**:
+- Install a backdoor on your computer.
+- Open any listening port on your machine.
+- Send data anywhere except to the WordPress URLs you type in.
+- Run any of the webshells in its signature list — those are strings used to RECOGNISE
+  webshells on *your sites*, not to execute them.
+
+**"DB: not loaded — click Refresh"** in the GUI — click *Refresh vuln DB*. Or from the CLI: `wpsecscan.exe --update-db`.
+
+**Scan stalls on a hung target** — `--timeout 5` cuts the per-request wait.
+
+**Multi-target scan freezes for one bad URL** — each URL has its own per-request
+timeout. If one consistently hangs, drop it from the list.
+
+**Cron / scheduled-task entries pile up** — list them with `schtasks /Query /TN WPSecScan_*` and remove individually with `schtasks /Delete /TN <name> /F`.
+
+**GUI crashes immediately on launch** — check `C:\Users\<you>\.wpsecscan\` is writable.
+Run from a terminal to see the traceback: `wpsecscan-gui.exe` (the windowed
+build suppresses console output by design — run via `python run_gui.py` from a checkout
+to see errors).
+
+---
+
+## Inventory
+
+| Category                  | Count |
+|---------------------------|-------|
+| Checks                    | **226** |
+| Payloads                  | **224** |
+| Exploit signatures        | **307** |
+| Plugin CVE database       | ~7,000 (Wordfence) + 7 other sources via the nightly aggregator |
+| Exploit-playbook entries  | **25** |
+| Tests                     | **667** |
+
+---
+
+## License & disclaimer
+
+Licensed under **AGPLv3+** (from v1.9.0 onward — v1.0.0..v1.8.0 were MIT).
+See [LICENSE](LICENSE) and [NOTICE](NOTICE).
+
+**AGPL network clause**: if you run a modified WPSecScan as a hosted service
+(SaaS, web UI, paid scanning tier), you must publish your modified source
+under the same AGPLv3+ terms. Private internal use and modifications stay
+private. For commercial-distribution licensing terms outside AGPLv3,
+contact bryaninbangkok@gmail.com.
+
+This tool is for **defensive use** on sites you own. Use against third-party
+sites without explicit written permission is illegal in most jurisdictions
+under the Computer Fraud and Abuse Act (US) / Computer Misuse Act (UK) /
+equivalent laws elsewhere.
+
+The authors take no responsibility for misuse.