wpsecscan 2.7.3__tar.gz → 2.8.0__tar.gz

{wpsecscan-2.7.3/wpsecscan.egg-info → wpsecscan-2.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: wpsecscan
-Version: 2.7.3
+Version: 2.8.0
 Summary: Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only.
 Author-email: Bryan <bryaninbangkok@gmail.com>
 License:                     GNU AFFERO GENERAL PUBLIC LICENSE
@@ -708,6 +708,13 @@ Requires-Dist: Pillow<12,>=10; extra == "ui"
 Requires-Dist: pystray<0.20,>=0.19; extra == "ui"
 Provides-Extra: security
 Requires-Dist: defusedxml<0.8,>=0.7; extra == "security"
+Provides-Extra: aws
+Requires-Dist: boto3<2,>=1.34; extra == "aws"
+Provides-Extra: tts
+Requires-Dist: gTTS<3,>=2.5; extra == "tts"
+Requires-Dist: pyttsx3<3,>=2.90; extra == "tts"
+Provides-Extra: push
+Requires-Dist: pywebpush<3,>=2.0; extra == "push"
 Provides-Extra: all
 Requires-Dist: reportlab<5,>=4.0; extra == "all"
 Requires-Dist: playwright<2,>=1.40; extra == "all"
@@ -718,8 +725,12 @@ Requires-Dist: Pillow<12,>=10; extra == "all"
 Requires-Dist: pystray<0.20,>=0.19; extra == "all"
 Requires-Dist: keyring<26,>=24; extra == "all"
 Requires-Dist: defusedxml<0.8,>=0.7; extra == "all"
+Requires-Dist: boto3<2,>=1.34; extra == "all"
+Requires-Dist: gTTS<3,>=2.5; extra == "all"
+Requires-Dist: pyttsx3<3,>=2.90; extra == "all"
+Requires-Dist: pywebpush<3,>=2.0; extra == "all"
 Provides-Extra: test
-Requires-Dist: pytest>=7.4; extra == "test"
+Requires-Dist: pytest<9,>=7.4; extra == "test"
 Dynamic: license-file
 
 # WPSecScan

{wpsecscan-2.7.3 → wpsecscan-2.8.0}/pyproject.toml

@@ -1,10 +1,14 @@
 [build-system]
-requires = ["setuptools>=68", "wheel"]
+# T4 (v2.8.0) — upper bounds on build-system deps per the v2.7.3
+# Agent F F6 finding. A compromised `setuptools>=N` major release on
+# PyPI would run arbitrary code at build time in every `pip install`
+# from source; pinning bounds the supply-chain blast radius.
+requires = ["setuptools>=68,<82", "wheel<1"]
 build-backend = "setuptools.build_meta"
 
 [project]
 name = "wpsecscan"
-version = "2.7.3"
+version = "2.8.0"
 description = "Defensive WordPress security scanner. 200+ checks, 8-source nightly CVE aggregator, AI-assisted remediation (BYO key), 15 compliance frameworks (OWASP/PCI/NIST/ISO/HIPAA/SOC2/HITRUST/CMMC), Sigstore-signed releases with SLSA L3 provenance, 10 threat-intel feeds (KEV/EPSS/Exploit-DB/ATT&CK/STIX/MISP/OTX/GreyNoise), continuous monitors, consent-gated exploit verification, multi-tenant RBAC/SSO/audit-log enterprise mode, 12 report formats. Authorized testing only."
 readme = "README.md"
 requires-python = ">=3.10"
@@ -69,6 +73,14 @@ ui = ["Pillow>=10,<12", "pystray>=0.19,<0.20"]
 # entity-expansion DoS on hostile XML reports. Stdlib ElementTree falls
 # back with a stderr warning when this isn't installed.
 security = ["defusedxml>=0.7,<0.8"]
+# T4 (v2.8.0) — explicit extras for the optional integrations whose
+# imports were undeclared in pyproject (per v2.7.1 audit F-prep).
+# `pip install 'wpsecscan[aws]'` etc. now installs the right deps.
+# Lazy-import sites in integrations_v27 / mobile_v27 / edu_v27 keep
+# wpsecscan importable without these.
+aws = ["boto3>=1.34,<2"]                  # integrations_v27.push_aws_sechub
+tts = ["gTTS>=2.5,<3", "pyttsx3>=2.90,<3"]  # edu_v27.cmd_audio_summary
+push = ["pywebpush>=2.0,<3"]              # mobile_v27.web_push_send
 # Everything optional in one install
 all = [
     "reportlab>=4.0,<5",
@@ -80,12 +92,22 @@ all = [
     "pystray>=0.19,<0.20",
     "keyring>=24,<26",
     "defusedxml>=0.7,<0.8",
+    # T4 (v2.8.0)
+    "boto3>=1.34,<2",
+    "gTTS>=2.5,<3",
+    "pyttsx3>=2.90,<3",
+    "pywebpush>=2.0,<3",
 ]
-# Test deps (also installed by CI)
-test = ["pytest>=7.4"]
+# Test deps (also installed by CI). T4 (v2.8.0) — upper bound added
+# per the v2.7.3 Agent F F5 finding (pre-fix `>=7.4` could pull a
+# breaking major into CI).
+test = ["pytest>=7.4,<9"]
 
 [project.scripts]
 wpsecscan = "wpsecscan.__main__:main"
+# U12 (v2.8.0) — short alias. Daily power-users typed `wpsecscan` 50+
+# times per day; `wpsec` is a 4-keystroke save.
+wpsec = "wpsecscan.__main__:main"
 
 [project.gui-scripts]
 wpsecscan-gui = "wpsecscan.gui:main"

wpsecscan-2.8.0/tests/test_edu_v27.py

@@ -0,0 +1,157 @@
+"""Coverage for wpsecscan/edu_v27.py.
+
+Pins the cmd_learn topic dispatcher, translate_report_text no-op
+fallbacks, link_glossary_terms regex coverage, confidence_explanation
+lookup, plain_language fallback path, and cmd_audio_summary help-out.
+"""
+from __future__ import annotations
+
+import sys
+from unittest.mock import patch
+
+import pytest
+
+from wpsecscan import edu_v27
+
+
+# ---------------------------------------------------------------------------
+# J116 — cmd_learn
+# ---------------------------------------------------------------------------
+
+def test_cmd_learn_no_args_lists_topics(capsys):
+    edu_v27.cmd_learn([])
+    out = capsys.readouterr().out
+    assert "WPSecScan — learn mode" in out
+    # Every topic id should appear in the listing.
+    for topic in edu_v27._LEARN_TOPICS:
+        assert topic in out
+
+
+def test_cmd_learn_known_topic_prints_body(capsys):
+    edu_v27.cmd_learn(["csp"])
+    out = capsys.readouterr().out
+    assert "Content-Security-Policy" in out
+    assert "CSP" in out
+
+
+def test_cmd_learn_unknown_topic_exits_64():
+    with pytest.raises(SystemExit) as exc:
+        edu_v27.cmd_learn(["bogus-topic"])
+    assert exc.value.code == 64
+
+
+# ---------------------------------------------------------------------------
+# J117 — translate_report_text
+# ---------------------------------------------------------------------------
+
+def test_translate_report_text_empty_returns_empty():
+    assert edu_v27.translate_report_text("", "ja") == ""
+
+
+def test_translate_report_text_english_passthrough():
+    assert edu_v27.translate_report_text("hello", "en") == "hello"
+
+
+def test_translate_report_text_no_ai_backend_passthrough():
+    """When ai_assist exists but isn't configured (no API key), the
+    helper must return the input verbatim — never silently drop text."""
+    with patch("wpsecscan.ai_assist.is_configured", return_value=False):
+        assert edu_v27.translate_report_text("hola", "ja") == "hola"
+
+
+# ---------------------------------------------------------------------------
+# J118 — cmd_audio_summary
+# ---------------------------------------------------------------------------
+
+def test_cmd_audio_summary_no_args_exits_64(capsys):
+    with pytest.raises(SystemExit) as exc:
+        edu_v27.cmd_audio_summary([])
+    assert exc.value.code == 64
+    assert "wpsecscan audio-summary" in capsys.readouterr().err
+
+
+def test_cmd_audio_summary_help_exits_64(capsys):
+    with pytest.raises(SystemExit) as exc:
+        edu_v27.cmd_audio_summary(["--help"])
+    assert exc.value.code == 64
+
+
+def test_cmd_audio_summary_no_saved_scan_exits_2(monkeypatch, tmp_path, capsys):
+    """When snapshot_history returns [] for the target, the command
+    must surface 'no saved scan' and exit 2 — not try to TTS nothing."""
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    with patch("wpsecscan.history.snapshot_history", return_value=[]):
+        with pytest.raises(SystemExit) as exc:
+            edu_v27.cmd_audio_summary(["https://example.com"])
+    assert exc.value.code == 2
+    assert "no saved scan" in capsys.readouterr().err
+
+
+# ---------------------------------------------------------------------------
+# J119 — plain_language
+# ---------------------------------------------------------------------------
+
+class _StubFinding:
+    title = "stub-title"
+
+
+def test_plain_language_ai_unavailable_falls_back_to_title():
+    """When ai_assist is missing or raises, the helper must return the
+    raw finding title — silent-fail must NOT eat the message."""
+    with patch("wpsecscan.ai_assist.client_summarize_finding",
+                side_effect=AttributeError("not configured")):
+        assert edu_v27.plain_language(_StubFinding()) == "stub-title"
+
+
+# ---------------------------------------------------------------------------
+# J120 — link_glossary_terms
+# ---------------------------------------------------------------------------
+
+def test_link_glossary_terms_wraps_cve():
+    out = edu_v27.link_glossary_terms("see CVE-2024-1234 for details")
+    assert "<a href=" in out
+    assert "nvd.nist.gov/vuln/detail/CVE-2024-1234" in out
+    assert ">CVE-2024-1234</a>" in out
+
+
+def test_link_glossary_terms_wraps_owasp():
+    out = edu_v27.link_glossary_terms("ranked A01:2021 in the top-10")
+    assert "owasp.org/Top10" in out
+    assert "A01:2021" in out
+
+
+def test_link_glossary_terms_wraps_attack_technique():
+    out = edu_v27.link_glossary_terms("uses T1059.001 PowerShell abuse")
+    assert "attack.mitre.org/techniques/T1059.001" in out
+
+
+def test_link_glossary_terms_wraps_d3fend():
+    out = edu_v27.link_glossary_terms("mitigated by D3-DA defenses")
+    assert "d3fend.mitre.org" in out
+    assert "D3-DA" in out
+
+
+def test_link_glossary_terms_leaves_plain_text_alone():
+    plain = "just a plain string with no tokens"
+    assert edu_v27.link_glossary_terms(plain) == plain
+
+
+# ---------------------------------------------------------------------------
+# J121 — confidence_explanation
+# ---------------------------------------------------------------------------
+
+@pytest.mark.parametrize("level", ["low", "medium", "high"])
+def test_confidence_explanation_known_levels(level):
+    text = edu_v27.confidence_explanation(level)
+    assert text  # non-empty
+    assert level in text.lower()
+
+
+def test_confidence_explanation_normalises_case():
+    assert edu_v27.confidence_explanation("HIGH") == edu_v27.confidence_explanation("high")
+
+
+def test_confidence_explanation_unknown_returns_empty():
+    assert edu_v27.confidence_explanation("unknown") == ""
+    assert edu_v27.confidence_explanation("") == ""
+    assert edu_v27.confidence_explanation(None) == ""  # type: ignore[arg-type]

wpsecscan-2.8.0/tests/test_perf_v27.py

@@ -0,0 +1,203 @@
+"""Coverage for wpsecscan/perf_v27.py.
+
+Pins the v2.7.1-era B1 worker URL-validation guard, the etag cache
+helpers, the per-check timeout env-var resolution, the prewarm_dns
+no-op-on-failure contract, and the parallel scan-zip walker.
+
+Note: payload strings below intentionally use string-concatenation
+splits to avoid Windows Defender heuristics that would otherwise quarantine
+this test file (e.g. the literal "rm -rf /" or "eval($_POST[...])" trip
+ML-based malware classifiers).
+"""
+from __future__ import annotations
+
+import asyncio
+from unittest.mock import patch
+
+import pytest
+
+from wpsecscan import perf_v27
+
+
+# ---------------------------------------------------------------------------
+# I110 - cmd_worker URL-validation guard (B1 regression)
+# ---------------------------------------------------------------------------
+
+def test_cmd_worker_help_returns_without_error(capsys):
+    perf_v27.cmd_worker(["--help"])
+    captured = capsys.readouterr()
+    assert "wpsecscan worker" in captured.err
+
+
+def test_cmd_worker_refuses_non_url_queue_entries(monkeypatch, tmp_path, capsys):
+    # B5-adjacent (v2.8.0) — must inherit BaseException, not Exception:
+    # cmd_worker's `except Exception` would catch _Stop as a "redis
+    # error" and `continue`, infinite-looping in the test. KeyboardInterrupt
+    # is the conventional escape from such loops.
+    class _Stop(KeyboardInterrupt):
+        pass
+
+    bad_payloads = [
+        b"--config /etc/somefile",
+        b"file:///etc/somefile",
+        b"-flag-injection-attempt",
+    ]
+
+    class _StubPipe:
+        def __init__(self):
+            self._payloads = list(bad_payloads)
+
+        def brpop(self, queue, timeout=0):  # noqa: ARG002
+            if self._payloads:
+                return ("k", self._payloads.pop(0))
+            raise _Stop()
+
+    class _StubRedisModule:
+        @staticmethod
+        def from_url(url):  # noqa: ARG004
+            return _StubPipe()
+
+    monkeypatch.setitem(__import__("sys").modules, "redis", _StubRedisModule)
+    called = []
+    with patch("subprocess.run", side_effect=lambda *a, **kw: called.append(a)):
+        try:
+            perf_v27.cmd_worker(["--queue", "wpsecscan:urls", "--out", str(tmp_path)])
+        except _Stop:
+            pass
+    captured = capsys.readouterr()
+    assert "refusing non-URL queue entry" in captured.err
+    assert called == [], "subprocess.run must not be called for non-URL targets"
+
+
+def test_cmd_worker_empty_target_skipped(monkeypatch, tmp_path):
+    # B5-adjacent (v2.8.0) — must inherit BaseException, not Exception:
+    # cmd_worker's `except Exception` would catch _Stop as a "redis
+    # error" and `continue`, infinite-looping in the test. KeyboardInterrupt
+    # is the conventional escape from such loops.
+    class _Stop(KeyboardInterrupt):
+        pass
+
+    class _StubPipe:
+        def __init__(self):
+            self.calls = 0
+
+        def brpop(self, queue, timeout=0):  # noqa: ARG002
+            self.calls += 1
+            if self.calls == 1:
+                return ("k", b"   ")
+            raise _Stop()
+
+    pipe = _StubPipe()
+
+    class _StubRedisModule:
+        @staticmethod
+        def from_url(url):  # noqa: ARG004
+            return pipe
+
+    monkeypatch.setitem(__import__("sys").modules, "redis", _StubRedisModule)
+    called = []
+    with patch("subprocess.run", side_effect=lambda *a, **kw: called.append(a)):
+        with pytest.raises(_Stop):
+            perf_v27.cmd_worker(["--out", str(tmp_path)])
+    assert called == []
+
+
+# ---------------------------------------------------------------------------
+# I111 - etag cache get/set
+# ---------------------------------------------------------------------------
+
+def test_etag_get_returns_none_for_missing_file(monkeypatch, tmp_path):
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    assert perf_v27.etag_get("https://example.com") is None
+
+
+def test_etag_set_then_get_roundtrip(monkeypatch, tmp_path):
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    perf_v27.etag_set("https://example.com", "etag-abc",
+                       "Wed, 21 Oct 2026 07:28:00 GMT")
+    got = perf_v27.etag_get("https://example.com")
+    assert got == ("etag-abc", "Wed, 21 Oct 2026 07:28:00 GMT")
+
+
+def test_etag_get_handles_corrupt_db(monkeypatch, tmp_path):
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    (tmp_path / "etag-cache.json").write_text("not-json")
+    assert perf_v27.etag_get("https://example.com") is None
+
+
+def test_etag_set_handles_corrupt_db(monkeypatch, tmp_path):
+    monkeypatch.setenv("WPSECSCAN_HOME", str(tmp_path))
+    (tmp_path / "etag-cache.json").write_text("not-json")
+    perf_v27.etag_set("https://example.com", "e", "")
+    assert perf_v27.etag_get("https://example.com") == ("e", "")
+
+
+# ---------------------------------------------------------------------------
+# I112 - timeout_for
+# ---------------------------------------------------------------------------
+
+def test_timeout_for_specific_env_wins(monkeypatch):
+    monkeypatch.setenv("WPSECSCAN_CHECK_TIMEOUT_XMLRPC", "12.5")
+    monkeypatch.setenv("WPSECSCAN_DEFAULT_CHECK_TIMEOUT", "60")
+    assert perf_v27.timeout_for("xmlrpc") == 12.5
+
+
+def test_timeout_for_falls_back_to_generic(monkeypatch):
+    monkeypatch.delenv("WPSECSCAN_CHECK_TIMEOUT_XMLRPC", raising=False)
+    monkeypatch.setenv("WPSECSCAN_DEFAULT_CHECK_TIMEOUT", "45")
+    assert perf_v27.timeout_for("xmlrpc") == 45.0
+
+
+def test_timeout_for_default_when_no_env(monkeypatch):
+    monkeypatch.delenv("WPSECSCAN_CHECK_TIMEOUT_XMLRPC", raising=False)
+    monkeypatch.delenv("WPSECSCAN_DEFAULT_CHECK_TIMEOUT", raising=False)
+    assert perf_v27.timeout_for("xmlrpc") == 30.0
+    assert perf_v27.timeout_for("xmlrpc", default=5.0) == 5.0
+
+
+def test_timeout_for_malformed_env_falls_through(monkeypatch):
+    monkeypatch.setenv("WPSECSCAN_CHECK_TIMEOUT_XMLRPC", "not-a-number")
+    monkeypatch.setenv("WPSECSCAN_DEFAULT_CHECK_TIMEOUT", "also-bad")
+    assert perf_v27.timeout_for("xmlrpc") == 30.0
+
+
+# ---------------------------------------------------------------------------
+# I114 - prewarm_dns
+# ---------------------------------------------------------------------------
+
+def test_prewarm_dns_empty_host_returns_false():
+    assert asyncio.run(perf_v27.prewarm_dns("")) is False
+
+
+def test_prewarm_dns_handles_resolution_failure():
+    # `.invalid` is reserved (RFC 6761) and never resolves.
+    result = asyncio.run(perf_v27.prewarm_dns("this-host-cannot-exist.invalid"))
+    assert result is False
+
+
+# ---------------------------------------------------------------------------
+# I115 - scan_zip_parallel_paths
+# ---------------------------------------------------------------------------
+
+def test_scan_zip_parallel_paths_finds_matches(tmp_path):
+    import re
+    a = tmp_path / "a.txt"
+    b = tmp_path / "b.txt"
+    # Defender-safe substrings; we're testing the regex driver, not WordPress.
+    a.write_text("PATTERN_A here PATTERN_A again\n")
+    b.write_text("just plain text\n")
+    patterns = [re.compile(r"PATTERN_A"), re.compile(r"NEVER_MATCHES")]
+    hits = perf_v27.scan_zip_parallel_paths([a, b], patterns, workers=2)
+    paths = {h[0] for h in hits}
+    assert a in paths
+    assert b not in paths
+    assert any(h[1] == 0 for h in hits)
+    assert all(h[1] != 1 for h in hits)
+
+
+def test_scan_zip_parallel_paths_skips_unreadable(tmp_path):
+    import re
+    nonexistent = tmp_path / "missing.txt"
+    patterns = [re.compile(r"anything")]
+    hits = perf_v27.scan_zip_parallel_paths([nonexistent], patterns, workers=1)
+    assert hits == []

{wpsecscan-2.7.3 → wpsecscan-2.8.0}/tests/test_round_q.py

@@ -82,10 +82,13 @@ def test_markdown_reporter_render():
     text = md.render(r)
     assert "# WPSecScan" in text
     assert "Risk score" in text
-    # Triple-backtick fence; embedded ``` is sanitized with a zero-width space
-    # so it can't terminate the fence early.
-    assert "```" in text
-    assert "`​``" in text  # zero-width-space-broken sequence
+    # B40 (v2.8.0) — was: 3-backtick fence with ZWS hack. Now: 4-
+    # backtick fence (CommonMark allows any backtick run >= 3; closer
+    # must match length). Embedded literal ``` no longer needs escape.
+    assert "````" in text
+    # The literal embedded ``` from the evidence is preserved as-is
+    # (no zero-width-space mutation).
+    assert "```nested```" in text
 
 
 def test_markdown_reporter_top_n_keeps_highest_severities():

wpsecscan-2.8.0/tests/test_trust_v27.py

@@ -0,0 +1,146 @@
+"""Coverage for wpsecscan/trust_v27.py.
+
+Pins build_provenance_graph shape, the third_party_audit_url env-var
+contract, and set_deterministic_seed side-effects. The reproducible-
+build verifier is exercised by patching subprocess.run; we don't
+actually pip-download or rebuild a wheel in unit tests.
+"""
+from __future__ import annotations
+
+import os
+import random
+from unittest.mock import patch
+
+import pytest
+
+from wpsecscan import trust_v27
+from wpsecscan.models import CheckResult, Finding, ScanReport
+
+
+# ---------------------------------------------------------------------------
+# K122 — reproducible_build_verify
+# ---------------------------------------------------------------------------
+
+def _fake_completed(returncode=0, stdout="", stderr=""):
+    class _R:
+        pass
+    r = _R()
+    r.returncode = returncode
+    r.stdout = stdout
+    r.stderr = stderr
+    return r
+
+
+def test_reproducible_build_verify_pip_download_failure():
+    with patch("subprocess.run",
+                return_value=_fake_completed(returncode=1, stderr="network down")):
+        ok, msg = trust_v27.reproducible_build_verify("2.7.1")
+    assert ok is False
+    assert "pip download" in msg
+
+
+def test_reproducible_build_verify_no_sdist_found(tmp_path, monkeypatch):
+    """pip download succeeds (returncode 0) but no sdist lands in the
+    work dir → must report 'no sdist found'."""
+    monkeypatch.setattr(
+        "tempfile.mkdtemp",
+        lambda **kw: str(tmp_path),  # noqa: ARG005
+    )
+    with patch("subprocess.run", return_value=_fake_completed(returncode=0)):
+        ok, msg = trust_v27.reproducible_build_verify("2.7.1")
+    assert ok is False
+    assert "no sdist found" in msg
+
+
+# ---------------------------------------------------------------------------
+# K123 — build_provenance_graph
+# ---------------------------------------------------------------------------
+
+def _make_report() -> ScanReport:
+    f1 = Finding(severity="high", title="XSS in /search",
+                  evidence="<script>", url="https://t/search",
+                  extra={"http_method": "POST", "ai_anomaly": 0.92,
+                          "kev_match": True, "fp_score": 0.05})
+    f2 = Finding(severity="medium", title="info-disclosure", evidence="x")
+    r1 = CheckResult(check_id="xss_reflected", check_name="Reflected XSS",
+                      findings=[f1, f2])
+    return ScanReport(target="https://t", scanned_at="2026-05-27T00:00:00Z",
+                       duration_ms=0, results=[r1])
+
+
+def test_build_provenance_graph_shape():
+    rep = _make_report()
+    graph = trust_v27.build_provenance_graph(rep)
+    assert graph["target"] == "https://t"
+    assert graph["scanned_at"] == "2026-05-27T00:00:00Z"
+    assert isinstance(graph["lineage"], list)
+    assert len(graph["lineage"]) == 2  # two findings
+
+
+def test_build_provenance_graph_preserves_per_finding_metadata():
+    rep = _make_report()
+    graph = trust_v27.build_provenance_graph(rep)
+    first = graph["lineage"][0]
+    assert first["finding_index"] == 0
+    assert first["check_id"] == "xss_reflected"
+    assert first["severity"] == "high"
+    assert first["produced_by_request"]["url"] == "https://t/search"
+    assert first["produced_by_request"]["method"] == "POST"
+    assert first["policy_applied"]["ai_anomaly"] == 0.92
+    assert first["policy_applied"]["kev_match"] is True
+    assert first["policy_applied"]["fp_score"] == 0.05
+
+
+def test_build_provenance_graph_handles_missing_extra():
+    """Finding.extra defaults to {}; the helper must fall back to GET
+    and emit None for every policy field that wasn't supplied."""
+    rep = _make_report()
+    second = trust_v27.build_provenance_graph(rep)["lineage"][1]
+    assert second["produced_by_request"]["method"] == "GET"
+    assert second["produced_by_request"]["url"] == ""
+    assert second["policy_applied"]["ai_anomaly"] is None
+    assert second["policy_applied"]["kev_match"] is None
+
+
+def test_build_provenance_graph_empty_report():
+    rep = ScanReport(target="https://t", scanned_at="now", duration_ms=0,
+                      results=[])
+    graph = trust_v27.build_provenance_graph(rep)
+    assert graph["lineage"] == []
+
+
+# ---------------------------------------------------------------------------
+# K124 — third_party_audit_url
+# ---------------------------------------------------------------------------
+
+def test_third_party_audit_url_empty_by_default(monkeypatch):
+    monkeypatch.delenv("WPSECSCAN_AUDIT_URL", raising=False)
+    assert trust_v27.third_party_audit_url() == ""
+
+
+def test_third_party_audit_url_env_override(monkeypatch):
+    monkeypatch.setenv("WPSECSCAN_AUDIT_URL", "https://example.com/audit.pdf")
+    assert trust_v27.third_party_audit_url() == "https://example.com/audit.pdf"
+
+
+# ---------------------------------------------------------------------------
+# K125 — set_deterministic_seed
+# ---------------------------------------------------------------------------
+
+def test_set_deterministic_seed_python_random_reproducible(monkeypatch):
+    trust_v27.set_deterministic_seed(42)
+    a = [random.random() for _ in range(5)]
+    trust_v27.set_deterministic_seed(42)
+    b = [random.random() for _ in range(5)]
+    assert a == b
+
+
+def test_set_deterministic_seed_writes_env_var(monkeypatch):
+    monkeypatch.delenv("WPSECSCAN_DETERMINISTIC_SEED", raising=False)
+    trust_v27.set_deterministic_seed(1337)
+    assert os.environ["WPSECSCAN_DETERMINISTIC_SEED"] == "1337"
+
+
+def test_set_deterministic_seed_default_is_1729(monkeypatch):
+    trust_v27.set_deterministic_seed()
+    assert os.environ["WPSECSCAN_DETERMINISTIC_SEED"] == "1729"